KQL Search

Query Details

Rundllwithoutcommandline

Query

DeviceProcessEvents
| where FileName == "rundll32.exe" or ProcessVersionInfoOriginalFileName == @"RUNDLL32.EXE"| where ProcessCommandLine matches regex "^$"

References:

About this query

Tags:

Query: Notes:

Explanation

Sure! Here's a simple summary of the provided KQL (Kusto Query Language) query:

  1. Data Source: The query is looking at DeviceProcessEvents, which is a table containing events related to processes on devices.

  2. File Name Filter: It filters the events to include only those where the FileName is "rundll32.exe" or the ProcessVersionInfoOriginalFileName is "RUNDLL32.EXE".

  3. Command Line Filter: It further filters these events to include only those where the ProcessCommandLine is empty (matches the regex pattern "^$", which represents an empty string).

In summary, this query retrieves events where the process is "rundll32.exe" and the command line used to start the process is empty.