Microsoft-Windows-Security-Auditing Event ID 4689

Kusto (12)

• Base64 encoded Windows process command-lines (Normalized Process Events) severity medium T1027, T1059, T1140
• Detect Malicious Usage of Recovery Tools to Delete Backup Files severity high T1490
• Dev-0228 File Path Hashes November 2021 (ASIM Version) severity high T1003, T1569
• Imminent Ransomware severity high T1547, T1562
• Malware in the recycle bin (Normalized Process Events) severity medium T1564
• Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) severity medium T1547
• New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) severity high T1072, T1570
• Potential re-named sdelete usage (ASIM Version) severity low T1036, T1485
• Probable AdFind Recon Tool Usage (Normalized Process Events) severity high T1018
• Process Creation with Suspicious CommandLine Arguments severity medium T1027, T1059
• Sdelete deployed via GPO and run recursively (ASIM Version) severity medium T1485
• SUNBURST suspicious SolarWinds child processes (Normalized Process Events) severity medium T1059, T1543