MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1059.003Windows Command Shell

Execution

View on MITRE ATT&CK →

2 Queries

Cmd.exe Spawned by Suspicious Parent Process

highproductionMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "cmd.exe"
| where InitiatingProcessFileName in~ ("mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "wmiprvse.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

triathIC · last tested 2025-03-01

attack.mitre.org
learn.microsoft.com

+ Add another query for this technique →