Skip to content

Latest commit

 

History

History
16 lines (16 loc) · 875 Bytes

Follina.md

File metadata and controls

16 lines (16 loc) · 875 Bytes
Raw

Follina Detection

// Sources: https://www.reddit.com/r/blueteamsec/comments/v0wgqh/sentinel_kql_detections_for_microsoft_word_zero/ & https://github.com/reprise99/Sentinel-Queries/blob/main/Defender%20for%20Endpoint/Device-msdtPotentialExploit.kql
(union isfuzzy=true
(DeviceProcessEvents
| where ProcessCommandLine contains "msdt.exe"
| where InitiatingProcessFileName has_any (@"outlook.exe", @"winword.exe", @"excel.exe")),
(DeviceProcessEvents
| where InitiatingProcessCommandLine contains "msdt.exe" and ProcessCommandLine !contains "msdt.exe"),
(DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("sdiagnhost.exe", "msdt.exe")
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
and RemoteUrl !endswith ".visualstudio.com"
and RemoteUrl !endswith ".microsoft.com")
)