// [CVE-2022-41082] ProxyNotShell Exchange Vulnerability
//
// https://www.reddit.com/r/crowdstrike/comments/xsvyn4/situational_awareness_proxynotshell_cve202240140/
// https://nvd.nist.gov/vuln/detail/CVE-2022-40140
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082
//
// Select one of the two queries. 

#event_simpleName=ProcessRollup2 
| event_platform=Win ImageFileName=/\\w3wp\.exe$/i
| CommandLine=/\&(ipconfig|quser|whoami|c\:|cd|dir|echo)/i
| select([cid, aid, TargetProcessId, ParentBaseFileName, ImageFileName, CommandLine])
| "Process Explorer" := format("[Process Explorer](https://falcon.crowdstrike.com/investigate/process-explorer/%s/%s)", field=["aid", "TargetProcessId"])