KQL Search

Query Details

Suspicious NS Lookup

Query

DeviceProcessEvents
            | where FileName contains "nslookup" and ProcessCommandLine has_any ("-querytype", "qt", "q", "-type=*")
Refernces:

About this query

Tags:

Query:

Explanation

The query is searching for DeviceProcessEvents where the FileName contains "nslookup" and the ProcessCommandLine contains any of the specified values ("-querytype", "qt", "q", "-type=*").