Detections

title: Public CTI triage - PCPJack
id: 1eb1e1b1-9dc0-576c-9a3a-cb08b68b75c9
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scale/
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'PCPJack'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

index=* (CommandLine="*PCPJack*")

DeviceProcessEvents | where ProcessCommandLine contains "PCPJack"