{"query": {"constant_score": {"filter": {"bool": {"should": [{"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* url.dll,*OpenURL *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* url.dll,*OpenURLA *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* url.dll,*FileProtocolHandler *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* zipfldr.dll,*RouteTheCall *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* Shell32.dll,*Control_RunDLL *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe javascript:*"}}, {"wildcard": {"process_command_line.keyword": "* url.dll,*OpenURL *"}}, {"wildcard": {"process_command_line.keyword": "* url.dll,*OpenURLA *"}}, {"wildcard": {"process_command_line.keyword": "* url.dll,*FileProtocolHandler *"}}, {"wildcard": {"process_command_line.keyword": "* zipfldr.dll,*RouteTheCall *"}}, {"wildcard": {"process_command_line.keyword": "* Shell32.dll,*Control_RunDLL *"}}, {"wildcard": {"process_command_line.keyword": "* javascript:*"}}, {"wildcard": {"process_command_line.keyword": "*.RegisterXLL*"}}]}}}}}
tactic = "Execution"
technique = "Rundll32"
procedure = "Rundll32 execute JavaScript Remote Payload With GetObject"
tech_code = "T1085"

203427a32283d373d2bdb2011e11b62259bbe145
<mask token>

{'query': {'constant_score': {'filter': {'bool': {'should': [{'wildcard': {
    'process_command_line.keyword': '*\\\\rundll32.exe* url.dll,*OpenURL *'
    }}, {'wildcard': {'process_command_line.keyword':
    '*\\\\rundll32.exe* url.dll,*OpenURLA *'}}, {'wildcard': {
    'process_command_line.keyword':
    '*\\\\rundll32.exe* url.dll,*FileProtocolHandler *'}}, {'wildcard': {
    'process_command_line.keyword':
    '*\\\\rundll32.exe* zipfldr.dll,*RouteTheCall *'}}, {'wildcard': {
    'process_command_line.keyword':
    '*\\\\rundll32.exe* Shell32.dll,*Control_RunDLL *'}}, {'wildcard': {
    'process_command_line.keyword': '*\\\\rundll32.exe javascript:*'}}, {
    'wildcard': {'process_command_line.keyword': '* url.dll,*OpenURL *'}},
    {'wildcard': {'process_command_line.keyword': '* url.dll,*OpenURLA *'}},
    {'wildcard': {'process_command_line.keyword':
    '* url.dll,*FileProtocolHandler *'}}, {'wildcard': {
    'process_command_line.keyword': '* zipfldr.dll,*RouteTheCall *'}}, {
    'wildcard': {'process_command_line.keyword':
    '* Shell32.dll,*Control_RunDLL *'}}, {'wildcard': {
    'process_command_line.keyword': '* javascript:*'}}, {'wildcard': {
    'process_command_line.keyword': '*.RegisterXLL*'}}]}}}}}
<mask token>

{'query': {'constant_score': {'filter': {'bool': {'should': [{'wildcard': {
    'process_command_line.keyword': '*\\\\rundll32.exe* url.dll,*OpenURL *'
    }}, {'wildcard': {'process_command_line.keyword':
    '*\\\\rundll32.exe* url.dll,*OpenURLA *'}}, {'wildcard': {
    'process_command_line.keyword':
    '*\\\\rundll32.exe* url.dll,*FileProtocolHandler *'}}, {'wildcard': {
    'process_command_line.keyword':
    '*\\\\rundll32.exe* zipfldr.dll,*RouteTheCall *'}}, {'wildcard': {
    'process_command_line.keyword':
    '*\\\\rundll32.exe* Shell32.dll,*Control_RunDLL *'}}, {'wildcard': {
    'process_command_line.keyword': '*\\\\rundll32.exe javascript:*'}}, {
    'wildcard': {'process_command_line.keyword': '* url.dll,*OpenURL *'}},
    {'wildcard': {'process_command_line.keyword': '* url.dll,*OpenURLA *'}},
    {'wildcard': {'process_command_line.keyword':
    '* url.dll,*FileProtocolHandler *'}}, {'wildcard': {
    'process_command_line.keyword': '* zipfldr.dll,*RouteTheCall *'}}, {
    'wildcard': {'process_command_line.keyword':
    '* Shell32.dll,*Control_RunDLL *'}}, {'wildcard': {
    'process_command_line.keyword': '* javascript:*'}}, {'wildcard': {
    'process_command_line.keyword': '*.RegisterXLL*'}}]}}}}}
tactic = 'Execution'
technique = 'Rundll32'
procedure = 'Rundll32 execute JavaScript Remote Payload With GetObject'
tech_code = 'T1085'

{"query": {"constant_score": {"filter": {"bool": {"should": [{"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* url.dll,*OpenURL *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* url.dll,*OpenURLA *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* url.dll,*FileProtocolHandler *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* zipfldr.dll,*RouteTheCall *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe* Shell32.dll,*Control_RunDLL *"}}, {"wildcard": {"process_command_line.keyword": "*\\\\rundll32.exe javascript:*"}}, {"wildcard": {"process_command_line.keyword": "* url.dll,*OpenURL *"}}, {"wildcard": {"process_command_line.keyword": "* url.dll,*OpenURLA *"}}, {"wildcard": {"process_command_line.keyword": "* url.dll,*FileProtocolHandler *"}}, {"wildcard": {"process_command_line.keyword": "* zipfldr.dll,*RouteTheCall *"}}, {"wildcard": {"process_command_line.keyword": "* Shell32.dll,*Control_RunDLL *"}}, {"wildcard": {"process_command_line.keyword": "* javascript:*"}}, {"wildcard": {"process_command_line.keyword": "*.RegisterXLL*"}}]}}}}}
tactic = "Execution"
technique = "Rundll32"
procedure = "Rundll32 execute JavaScript Remote Payload With GetObject"
tech_code = "T1085"
