Data Source
DeviceProcessEvents
9 queries tagged with this data source.
-
Analytics Rules
Detect Excel Xll Addin Spawning Shell Or Network
Excel loading an XLL add-in that then spawns a shell or beacons out — the spreadsheet-as-shell malware delivery vector.
-
Analytics Rules
Detect Peoplesoft Process Spawning Unexpected Shell
Oracle PeopleSoft server processes (psadmin, psappsrv, java) spawning cmd, bash, whoami, curl, or net — post-exploitation shape of a PeopleSoft RCE.
-
Analytics Rules
Detect Remote Shell Command Arrival Over Wire
Shell command that arrived over the network — outbound-then-inbound-executed script pattern uncommon in legitimate remote code execution.
-
Analytics Rules
Detect Sharepoint Toolshell Rce Encoded Command
SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.
-
Hunting
Hunt Encoded Command Usage Across Fleet Time Baseline
Encoded-command executions correlated across the fleet against a rolling per-host time baseline. TimeBucket alone as the join key — deliberately no DeviceId.
-
Hunting
Hunt Linux Process Argv0 Vs Executable Mismatch
Linux processes where argv[0] doesn't match the actual binary that was executed — a process wearing another process's name tag.
-
Hunting
Hunt Npm Postinstall Config Modification No User Context
npm postinstall/lifecycle scripts that modified config without a corresponding interactive user command — AsyncAPI-shaped supply-chain compromise.
-
Hunting
Hunt Npm Postinstall Grandchild Network Payload
npm supply-chain worms where the payload runs two process generations down — 'sins of the grandfather' shape. Traces npm → sh -c → curl.
-
Posture
Inventory Installed Npm Packages With Lifecycle Scripts
Inventory of npm packages installed across your fleet that carry postinstall / preinstall / install lifecycle scripts — the finite, closable population for sins-of-the-grandfather class attacks.