# captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi — KQL variant (derived from captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi.sigma via sigma convert)
# source-sha256: a23b3b55a33febaf7a4d853de4c9b118a98bd0da452eb493e019c7b5fa417af1 v1
(Image endswith "\\svchost32.exe" and Image contains "\\AppData\\") or ((Image endswith "\\chrome.exe" or Image endswith "\\msedge.exe" or Image endswith "\\firefox.exe") and CommandLine contains "--remote-debugging-port")

DestinationIp =~ "213.145.86.112" or (DestinationHostname endswith "ms365-device.com" or DestinationHostname endswith "ms365-live.com")