kqlHunting

AntiSleep Domains - MDE DeviceNetworkEvents

raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/AntiSleep.csv"] with (format="csv", ignoreFirstRecord=True);

Detection Query

let AntisleepIOCs = externaldata(type: string, IndicatorValue: string)[@"https://raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/AntiSleep.csv"] with (format="csv", ignoreFirstRecord=True);
let DomainList = AntisleepIOCs
| project IndicatorValue;
DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl in~(DomainList )
| extend VT_domain = iff(isnotempty(RemoteUrl),strcat(@"https://www.virustotal.com/gui/domain/",RemoteUrl),RemoteUrl)
| summarize count() by RemoteUrl, InitiatingProcessFileName, InitiatingProcessAccountUpn

Data Sources

DeviceNetworkEvents

Platforms

windows

Tags

defenderioc

Raw Content

let AntisleepIOCs = externaldata(type: string, IndicatorValue: string)[@"https://raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/AntiSleep.csv"] with (format="csv", ignoreFirstRecord=True);
let DomainList = AntisleepIOCs
| project IndicatorValue;
DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl in~(DomainList )
| extend VT_domain = iff(isnotempty(RemoteUrl),strcat(@"https://www.virustotal.com/gui/domain/",RemoteUrl),RemoteUrl)
| summarize count() by RemoteUrl, InitiatingProcessFileName, InitiatingProcessAccountUpn