Winrar Encryption
Query
DeviceProcessEvents
| where ((FileName == @"rar.exe" or ProcessVersionInfoInternalFileName == @"WinRAR" ) and ProcessCommandLine has_any ("-hp*", "-p*", "-dw", "-tb", "-ta", "/hp*", "/p*", "/dw", "/tb", "/ta")) or (FileName in("7z.exe", "7za.exe") and ProcessCommandLine has_any("-p*", "-sdel") )
References:About this query
Tags:
Query:
Explanation
The query is looking for specific processes and command line arguments in the DeviceProcessEvents table. It checks if the FileName is either "rar.exe" or "WinRAR" and if the ProcessCommandLine contains certain strings. It also checks if the FileName is either "7z.exe" or "7za.exe" and if the ProcessCommandLine contains certain other strings.