← Back to SOC feed Coverage →

Malicious bat file

kql MEDIUM Azure-Sentinel
DeviceFileEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-06T11:00:00Z · Confidence: medium

Hunt Hypothesis

A malicious BAT file may be used to execute payloads as part of a ZLoader delivery campaign, indicating potential initial compromise. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage adversarial activity associated with known malicious campaigns.

KQL Query

DeviceFileEvents
| where FileName endswith '.bat'
    and FolderPath has @'Program Files (x86)\Sun Technology Network\Oracle Java SE'

Analytic Rule Definition

id: c903138d-b948-4975-a660-57495b3f8754
name: Malicious bat file
description: |
  ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Initial access
query: |
  DeviceFileEvents
  | where FileName endswith '.bat'
      and FolderPath has @'Program Files (x86)\Sun Technology Network\Oracle Java SE'

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/ZLoader/Malicious bat file.yaml