KQL Search

Query Details

Smashjacker Appinit DL Lmodifcation

Query

DeviceProcessEvents
| where ProcessVersionInfoFileDescription
 contains "Registry Console Tool" and ProcessCommandLine contains  "AppInit_DLLs"

Explanation

This query is searching through device process events to find instances where:

  1. The description of the process includes the phrase "Registry Console Tool".
  2. The command line used to start the process includes the term "AppInit_DLLs".

In simple terms, it looks for processes related to the Registry Console Tool that were started with a command line containing "AppInit_DLLs".