KQL_win_malware_wannacry.txt

SecurityEvent | where EventID == "4688" | where (Image endswith "\\tasksche.exe" or Image endswith "\\mssecsvc.exe" or Image endswith "\\taskdl.exe" or Image contains "\\@WanaDecryptor@" or Image endswith "\\taskhsvc.exe" or Image endswith "\\taskse.exe" or Image endswith "\\111.exe" or Image endswith "\\lhdfrgui.exe" or Image endswith "\\diskpart.exe" or Image endswith "\\linuxnew.exe" or Image endswith "\\wannacry.exe" or CommandLine contains "vssadmin delete shadows" or CommandLine matches regex ".*icacls .* /grant Everyone:F /T /C /Q.*" or CommandLine contains "bcdedit /set {default} recoveryenabled no" or CommandLine contains "wbadmin delete catalog -quiet" or CommandLine contains "@Please_Read_Me@.txt")