MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1105Ingress Tool Transfer

Command and Control

View on MITRE ATT&CK →

1 Query

Certutil Used for Remote File Download

highproductionDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has "urlcache" and ProcessCommandLine has "-f" and ProcessCommandLine has_any ("http", "ftp")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Bert-JanP (adapted) · last tested 2025-03-01

attack.mitre.org
github.com
lolbas-project.github.io

+ Add another query for this technique →