KQL_apt_pandemic.txt

Event | where (EventID == "13" and TargetObject startswith "\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\services\\null\\Instance" or TargetObject startswith "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\null\\Instance" or TargetObject startswith "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet002\\services\\null\\Instance")
SecurityEvent | where EventID == "4688" | where Command startswith "loaddll -a "