Shivammalaviya

DeviceNetworkEvents 
| where (RemoteIP =~ "89.248.165.72" or RemoteIP =~ "116.204.211.22" or RemoteIP =~ "120.36.97.210" or RemoteIP =~ "47.88.21.70" or RemoteIP =~ "112.5.154.7" or RemoteIP =~ "193.149.176.112")

Shivammalaviya

154.89.5.86
80.82.77.193
35.244.159.8
151.236.89.26
188.191.1.66
91.231.239.2
212.83.8.79
45.143.203.3
20.50.80.209
176.192.99.26

Shivammalaviya

loguntsov@gmail.com
johnyboy77@q3mcco35auwcstmt.onion
smtbrowser@thesecure.biz
21yelow21@jabb.im
leo@q3mcco35auwcstmt.onion
jamonsmaslom@xmpp.jp
azot@q3mcco35auwcstmt.onion
nroot@162.244.81.252
vladimir.tyrenko@mail.ru
WS#ED4rfv@5.141.22.50

Shivammalaviya

let RussiaUkraineIOCs = materialize (
(externaldata(report:string)
[@"https://raw.githubusercontent.com/Orange-Cyberdefense/russia-ukraine_IOCs/main/OCD-Datalake-russia-ukraine_IOCs-ALL.csv"]
with (format = "txt",ignoreFirstRecord=true))
| extend report = parse_csv(report)
| extend Type = tostring(report[0])
| where Type in('url','domain','ip','file','fqdn')
| project  tostring(report[1]));
union 
DeviceNetworkEvents,DeviceProcessEvents,DeviceFileEvents,DeviceImageLoadEvents

Shivammalaviya

DeviceRegistryEvents 
| where (RegistryKey contains @"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon")

Shivammalaviya

DeviceProcessEvents 
| where ((InitiatingProcessFolderPath endswith @"\cmd.exe") 
and (FolderPath endswith @"\powershell.exe") 
and ProcessCommandLine contains "wiNd" 
and ProcessCommandLine contains "hiddeN" 
and ProcessCommandLine contains "Bypass" 
and ProcessCommandLine contains "NoNi" 
and ProcessCommandLine contains "IeX" 
and ProcessCommandLine contains "DowNloadStriNg" 
and ProcessCommandLine contains "install.mp3")

Shivammalaviya

DeviceInfo 
|summarize arg_max(Timestamp, *) by DeviceName
|where OSPlatform !in ('Linux','macOS','iOS','Android')
|where OnboardingStatus == 'Can be onboarded'
|distinct Timestamp, DeviceName, DeviceType, DeviceId, OSPlatform, OSDistribution, OSVersion, ReportId
|summarize DeviceCount=count() by DeviceType, OSPlatform
|order by DeviceCount desc

Shivammalaviya

DeviceFileEvents
| where ((InitiatingProcessFolderPath endswith @"\svchost.txt") 
and FolderPath contains @"\Calldriver.exe" 
and FolderPath contains @"\Driver.sys" 
and FolderPath contains @"\dll.dll" 
and FolderPath contains @"\kill.bat" 
and FolderPath contains @"\speedmem2.hg")

Shivammalaviya

DeviceProcessEvents 
| where (ProcessCommandLine contains "sun.ocx" 
and ProcessCommandLine contains "DllRegisterServer" 
and (FolderPath endswith @"\rundll32.exe"))

Shivammalaviya

DeviceFileEvents 
| where (FolderPath contains @"\Program Files\WindowsApps\wjoiyyxzllm.exe" 
or FolderPath contains @"\Program Files\WindowsApps\wjoiyyxzllm.dll")