KQL_win_malware_notpetya.txt

SecurityEvent | where EventID == "4688" | where ((Image endswith "\\fsutil.exe" and CommandLine contains " deletejournal ") or CommandLine matches regex ".*\\AppData\\Local\\Temp\.* \\\\\.\\pipe\\\.*" or (Image endswith "\\wevtutil.exe" and CommandLine contains " cl ") or (Image endswith "\\rundll32.exe" and CommandLine endswith ".dat,#1") or "*\\perfc.dat*")