KQL_win_mal_adwind.txt

SecurityEvent | where EventID == "4688" | where CommandLine matches regex ".*\\AppData\\Roaming\\Oracle.*\\java.*\.exe .*" or CommandLine matches regex ".*cscript\.exe .*Retrive.*\.vbs .*"
Event | where (EventID == "11" and TargetFilename matches regex ".*\\AppData\\Roaming\\Oracle\\bin\\java.*\.exe" or TargetFilename matches regex ".*\\Retrive.*\.vbs")
Event | where (EventID == "13" and TargetObject startswith "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" and Details startswith "%AppData%\\Roaming\\Oracle\\bin\\")