• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Distribution from remote location

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•1•0•15

    This query checks for alerts related to file drop and remote execution where the file name matches PsExec and similar tools used for distribution

    Microsoft Sentinel (KQL)

    Tags

    S1139 - INC RansomwareS0029 - PsExecTA0002 - ExecutionT1021 - Remote ServicesTA0008 - Lateral MovementT1570 - Lateral Tool TransferT1204.002 - Malicious FileFile EventProcess CreationNetwork Connection OutboundWindowsMicrosoft Servicebus Clientkqltactic:Ransomware

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?