{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Malware Protection Essentials (Preview)\n---\n\nThis wokbook provide details about Suspicious Malware Activities from File, Process and Registry events generated by EDR (Endpoint Detection and Response) solutions.\n\n\n"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "c470616d-5af0-483a-a595-28a684d878a1",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "value": {
              "durationMs": 86400000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "f0450560-ef16-4aa9-a3ad-7485dd909587",
            "version": "KqlParameterItem/1.0",
            "name": "Help",
            "type": 10,
            "isRequired": true,
            "jsonData": "[{ \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }]",
            "label": "Show Help"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "\r\n|File|Process|Registry|\r\n|------|-------|----|\r\n|Files Created in Startup Folders|List of Suspicious Processes Created with Base64 CommandLine Argumnet|Startup Registry Creation/Moification|\r\n|Top 10 Hosts where Files Created in Startup Folders|Top 10 Devices with Suspicious Process|Top 10 Devices with Most Startup Registry Modification|\r\n|Top 10 Accounts to Create Files in Startup Folders|Top 10 Processes with Suspicious CommandLine|Top 10 Users with Most Startup Registry Modification|\r\n|List of Scheduled Task Created with Encoded Command|List of Backup Deletion Acitivties using LOL Binaries|Windows Update Disabled Devices|\r\n|Top 10 Processes Creating Scheduled Task with Encoded Command|Top 10 Devices with Most Backup Deletion Activity|Windows Firewall Allow Rule Addition Events|\r\n|Top 10 Users Creating Scheduled Task with Encoded Command|List of Processes Started from Unusual Locations|Top 10 Devices with Most Windows Firewall Allow Rule Addition|\r\n||Top 10 Devices where Processes Started from Unusual Locations|Top 10 Users to add Windows Firewall Allow Rule|"
      },
      "conditionalVisibility": {
        "parameterName": "Help",
        "comparison": "isEqualTo",
        "value": "Yes"
      },
      "name": "text - 8"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "3d902e84-3e5b-4631-85d1-c229ec2abf75",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "File Activity",
            "subTarget": "File",
            "style": "link"
          },
          {
            "id": "bbc20288-b398-4f63-b7a9-e3830213bb34",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Process Activity",
            "subTarget": "Process",
            "style": "link"
          },
          {
            "id": "edab4a44-8ca3-4ba1-bede-4186f4376d28",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Registry Activity",
            "subTarget": "Registry",
            "style": "link"
          }
        ]
      },
      "name": "links - 3"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let startupRegistryList = dynamic([\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData",
              "size": 0,
              "title": "Startup Registry Creation/Moification {TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "filter": true
              }
            },
            "name": "RegistryActivity-Startup1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let startupRegistryList = dynamic([\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData\r\n| summarize Count=count() by DvcHostname\r\n| take 10",
              "size": 0,
              "title": "Top 10 Devices with Most Startup Registry Modification {TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "RegistryActivity-Startup2",
            "styleSettings": {
              "maxWidth": "50%"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let startupRegistryList = dynamic([\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows',\r\n      'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows Advanced Threat Protection'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData\r\n| summarize Count=count() by ActorUsername\r\n| take 10",
              "size": 0,
              "title": "Top 10 Users with Most Startup Registry Modification {TimeRange}",
              "noDataMessage": "No Data for given TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "RegistryActivity-Startup3",
            "styleSettings": {
              "maxWidth": "50%"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  let windowsUpdateRegistryList = dynamic([\r\n    'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate',\r\n    'HKEY_LOCAL_MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') \r\n  | where RegistryKey has_any (windowsUpdateRegistryList) \r\n  | where RegistryValue has_any ('AUOptions', 'NoAutoUpdate') and RegistryValueData == '1'\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData",
              "size": 0,
              "title": "Windows Update Disabled Devices {TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "RegistryActivity-WindowsUpdate1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  let firewallRegistryList = dynamic([\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Static\\\\System',\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Configurable\\\\System',\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Defaults\\\\FirewallPolicy\\\\FirewallRules',\r\n        'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') \r\n  | where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE')\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData",
              "size": 0,
              "title": "Windows Firewall Allow Rule Addition Events {TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "RegistryActivity-WindowsFirewall1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  let firewallRegistryList = dynamic([\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Static\\\\System',\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Configurable\\\\System',\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Defaults\\\\FirewallPolicy\\\\FirewallRules',\r\n        'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') \r\n  | where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE')\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData\r\n| summarize Count=count() by DvcHostname\r\n| take 10",
              "size": 0,
              "title": "Top 10 Devices with Most Windows Firewall Allow Rule Addition {TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "RegistryActivity-WindowsFirewall2",
            "styleSettings": {
              "maxWidth": "50%"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  let firewallRegistryList = dynamic([\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Static\\\\System',\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\RestrictedServices\\\\Configurable\\\\System',\r\n        'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Defaults\\\\FirewallPolicy\\\\FirewallRules',\r\n        'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') \r\n  | where RegistryKey has_any (firewallRegistryList) and RegistryValueData has_all ('Action=Allow', 'Active=TRUE')\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData\r\n| summarize Count=count() by ActorUsername\r\n| take 10",
              "size": 0,
              "title": "Top 10 Users to add Windows Firewall Allow Rule {TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "RegistryActivity-WindowsFirewall2 - Copy",
            "styleSettings": {
              "maxWidth": "50%"
            }
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Registry"
      },
      "name": "groupRegistry"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "_ASim_ProcessEvent\r\n  | where EventType == 'ProcessCreated'\r\n  | extend CommandLineArgs = todynamic(array_slice(split(CommandLine, \" \"), 1, -1))\r\n  | where strlen(CommandLineArgs) > 0\r\n  | mv-apply CommandLineArgs on \r\n      (\r\n      where CommandLineArgs contains \"base64\"\r\n      )\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      DvcIpAddr,\r\n      DvcDomain,\r\n      TargetUsername,\r\n      TargetProcessName,\r\n      CommandLine",
              "size": 0,
              "title": "List of Suspicious Processes Created with Base64 CommandLine Argumnet {TimeRange}",
              "noDataMessage": "No Data for this Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "ProcessActivity-SuspiciousProcess1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "_ASim_ProcessEvent\r\n| where EventType == 'ProcessCreated'\r\n| extend CommandLineArgs = todynamic(array_slice(split(CommandLine, \" \"), 1, -1))\r\n| where strlen(CommandLineArgs) > 0\r\n| mv-apply CommandLineArgs on \r\n    (\r\n    where CommandLineArgs contains \"base64\"\r\n    )\r\n| project\r\n    TimeGenerated,\r\n    DvcHostname,\r\n    DvcIpAddr,\r\n    DvcDomain,\r\n    TargetUsername,\r\n    TargetProcessName,\r\n    CommandLine\r\n| summarize Count=count() by DvcHostname\r\n| top 10 by Count ",
              "size": 0,
              "title": "Top 10 Devices with Suspicious Process {TimeRange}",
              "noDataMessage": "No Data for this Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "ProcessActivity-SuspiciousProcess2",
            "styleSettings": {
              "margin": "50",
              "padding": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "_ASim_ProcessEvent\r\n| where EventType == 'ProcessCreated'\r\n| extend CommandLineArgs = todynamic(array_slice(split(CommandLine, \" \"), 1, -1))\r\n| where strlen(CommandLineArgs) > 0\r\n| mv-apply CommandLineArgs on \r\n    (\r\n    where CommandLineArgs contains \"base64\"\r\n    )\r\n| project\r\n    TimeGenerated,\r\n    DvcHostname,\r\n    DvcIpAddr,\r\n    DvcDomain,\r\n    TargetUsername,\r\n    TargetProcessName,\r\n    CommandLine\r\n| summarize Count=count() by TargetProcessName\r\n| top 10 by Count ",
              "size": 0,
              "title": "Top 10 Processes with Suspicious CommandLine {TimeRange}",
              "noDataMessage": "No Data for this Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "RegistryActivity-SuspiciousProcess3",
            "styleSettings": {
              "margin": "50",
              "padding": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": " _ASim_ProcessEvent\r\n  | where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')\r\n  | where CommandLine has_all ('delete', 'shadow')\r\n  | union isfuzzy=True \r\n      (imProcess\r\n      | where TargetProcessFilename =~ 'bcedit.exe'\r\n      | where CommandLine has_all ('/set', 'recoveryenabled no')\r\n      )\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      DvcIpAddr,\r\n      DvcDomain,\r\n      TargetUsername,\r\n      TargetProcessName,\r\n      CommandLine,\r\n      ParentProcessName",
              "size": 0,
              "title": "List of Backup Deletion Acitivties using LOL Binaries {TimeRange}",
              "noDataMessage": "No Data for this Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "ProcessActivity-BackupDeletion1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "_ASim_ProcessEvent\r\n| where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')\r\n| where CommandLine has_all ('delete', 'shadow')\r\n| union isfuzzy=True \r\n    (imProcess\r\n    | where TargetProcessFilename =~ 'bcedit.exe'\r\n    | where CommandLine has_all ('/set', 'recoveryenabled no')\r\n    )\r\n| project\r\n    TimeGenerated,\r\n    DvcHostname,\r\n    DvcIpAddr,\r\n    DvcDomain,\r\n    TargetUsername,\r\n    TargetProcessName,\r\n    CommandLine,\r\n    ParentProcessName\r\n| summarize Count=count() by DvcHostname\r\n| top 10 by Count ",
              "size": 0,
              "title": "Top 10 Devices with Most Backup Deletion Activity {TimeRange}",
              "noDataMessage": "No Data for this Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "name": "ProcessActivity-BackupDeletion2",
            "styleSettings": {
              "margin": "50",
              "padding": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let fileLocations = dynamic([\r\n      '\\\\AppData\\\\Local\\\\Temp\\\\',\r\n      '\\\\Recycle Bin\\\\'\r\n      ]);\r\n_ASim_ProcessEvent\r\n| where EventType == 'ProcessCreated' and TargetProcessName has_any (fileLocations)\r\n| project\r\n      TimeGenerated,\r\n      TargetUsername,\r\n      TargetProcessName,\r\n      CommandLine,\r\n      ParentProcessName,\r\n      DvcHostname,\r\n      DvcIpAddr,\r\n      DvcDomain",
              "size": 0,
              "title": "List of Processes Started from Unusual Locations {TimeRange}",
              "noDataMessage": "No Data for this Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "filter": true
              }
            },
            "name": "ProcessActivity-MaliciousProcessLocation1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let fileLocations = dynamic([\r\n      '\\\\AppData\\\\Local\\\\Temp\\\\',\r\n      '\\\\Recycle Bin\\\\'\r\n      ]);\r\n_ASim_ProcessEvent\r\n| where EventType == 'ProcessCreated' and TargetProcessName has_any (fileLocations)\r\n| project\r\n      TimeGenerated,\r\n      TargetUsername,\r\n      TargetProcessName,\r\n      CommandLine,\r\n      ParentProcessName,\r\n      DvcHostname,\r\n      DvcIpAddr,\r\n      DvcDomain\r\n| summarize Count=count() by DvcHostname\r\n| top 10 by Count",
              "size": 0,
              "title": "Top 10 Devices where Processes Started from Unusual Locations {TimeRange}",
              "noDataMessage": "No Data for this Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "name": "ProcessActivity-MaliciousProcessLocation2"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Process"
      },
      "name": "groupProcess"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  // List of startup folders to monitor\r\n  let startupFolderList = dynamic([\r\n      '\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\',\r\n      '\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\',\r\n      '/etc/init.d/',\r\n      '/etc/rc.d/',\r\n      '/etc/cron.d/'\r\n    ]);\r\n  _ASim_FileEvent\r\n  | where EventType == 'FileCreated'\r\n  | where FilePath has_any (startupFolderList)\r\n  | project FileName, FilePath, DvcHostname, DvcDomain, User, DvcId, TenantId, Process, CommandLine",
              "size": 0,
              "title": "Files Created in Startup Folders {TimeRange}",
              "noDataMessage": "No Data for Given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "filter": true
              }
            },
            "showPin": false,
            "name": "FileActivity-Startup1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  // List of startup folders to monitor\r\n  let startupFolderList = dynamic([\r\n      '\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\',\r\n      '\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\',\r\n      '/etc/init.d/',\r\n      '/etc/rc.d/',\r\n      '/etc/cron.d/'\r\n    ]);\r\n  _ASim_FileEvent\r\n  | where EventType == 'FileCreated'\r\n  | where FilePath has_any (startupFolderList)\r\n  | project FileName, FilePath, DvcHostname, DvcId, TenantId, Process, CommandLine\r\n  | summarize Count=count() by DvcHostname\r\n  | top 10 by Count",
              "size": 0,
              "title": "Top 10 Hosts where Files Created in Startup Folders {TimeRange}",
              "noDataMessage": "No Data for Given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "unstackedbar"
            },
            "customWidth": "50",
            "name": "FileActivity-Startup2",
            "styleSettings": {
              "maxWidth": "50%"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  // List of startup folders to monitor\r\n  let startupFolderList = dynamic([\r\n      '\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\',\r\n      '\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\',\r\n      '/etc/init.d/',\r\n      '/etc/rc.d/',\r\n      '/etc/cron.d/'\r\n    ]);\r\n  _ASim_FileEvent\r\n  | where EventType == 'FileCreated'\r\n  | where FilePath has_any (startupFolderList)\r\n  | project FileName, FilePath, DvcHostname, DvcId, TenantId, Process, CommandLine, ActorUsername\r\n  | summarize Count=count() by ActorUsername\r\n  | top 10 by Count",
              "size": 0,
              "title": "Top 10 Accounts to Create Files in Startup Folders {TimeRange}",
              "noDataMessage": "No Data for Given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "FileActivity-Startup3",
            "styleSettings": {
              "maxWidth": "50%"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "_ASim_FileEvent\r\n| where EventType in ('FileCreated', 'FileModified')\r\n| where FilePath has '\\\\Windows\\\\System32\\\\Tasks'\r\n| extend CommandLineArgs = todynamic(array_slice(split(CommandLine, \" \"), 1, -1))\r\n  | where strlen(CommandLineArgs) > 0\r\n  | mv-apply CommandLineArgs on \r\n      (\r\n      where CommandLineArgs contains \"base64\"\r\n      )\r\n| project TimeGenerated, DvcHostname, DvcDomain, User, Process, CommandLine, FileName, FilePath\r\n",
              "size": 0,
              "title": "List of Scheduled Task Created with Encoded Command {TimeRange}",
              "noDataMessage": "No Data for Given Time Range",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "FileActivity-ScheduledTask1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "_ASim_FileEvent\r\n| where EventType in ('FileCreated', 'FileModified')\r\n| where FilePath has '\\\\Windows\\\\System32\\\\Tasks'\r\n| extend CommandLineArgs = todynamic(array_slice(split(CommandLine, \" \"), 1, -1))\r\n  | where strlen(CommandLineArgs) > 0\r\n  | mv-apply CommandLineArgs on \r\n      (\r\n      where CommandLineArgs contains \"base64\"\r\n      )\r\n| project TimeGenerated, DvcHostname, DvcDomain, User, Process, CommandLine, FileName, FilePath\r\n| summarize Count=count() by Process\r\n| top 10 by Count",
              "size": 0,
              "title": "Top 10 Processes Creating Scheduled Task with Encoded Command {TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "FileActivity-ScheduledTask2",
            "styleSettings": {
              "maxWidth": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "_ASim_FileEvent\r\n| where EventType in ('FileCreated', 'FileModified')\r\n| where FilePath has '\\\\Windows\\\\System32\\\\Tasks'\r\n| extend CommandLineArgs = todynamic(array_slice(split(CommandLine, \" \"), 1, -1))\r\n  | where strlen(CommandLineArgs) > 0\r\n  | mv-apply CommandLineArgs on \r\n      (\r\n      where CommandLineArgs contains \"base64\"\r\n      )\r\n| project TimeGenerated, DvcHostname, DvcDomain, User, Process, CommandLine, FileName, FilePath\r\n| summarize Count=count() by User\r\n| top 10 by Count",
              "size": 0,
              "title": "Top 10 Users Creating Scheduled Task with Encoded Command{TimeRange}",
              "noDataMessage": "No Data for given Time Range",
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "FileActivity-ScheduledTask3",
            "styleSettings": {
              "maxWidth": "50"
            }
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "File"
      },
      "name": "groupFile"
    }
  ],
  "fromTemplateId": "sentinel-MalwareProtectionEssentials",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}