BIOCs

{"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"OR":[{"LEFT":"$actor_process_image_name","OPERATOR":"IN","RIGHT":["w3wp.exe","httpd.exe","php-cgi.exe","nginx.exe","tomcat.exe"],"FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"nslookup","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"whoami","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" hostname","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" arp ","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" net ","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"qwinsta","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"netstat","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"quser","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" powershell","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"tasklist","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"ipconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"ping","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"certutil","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"rundll32","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"vssadmin","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"tracert","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"systeminfo","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"netsh","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}