o4-mini-low

DeviceProcessEvents | where ProcessCommandLine contains "/etc/shadow" | where ProcessCommandLine matches regex @">\s*\S+" | where InitiatingProcessAccountName == "root" | extend OutputFile = extract(@">\s*(\S+)", 1, ProcessCommandLine) | where isnotempty(OutputFile) | distinct OutputFile

let LinuxDevices = DeviceInfo | where OSPlatform =~ "Linux" | summarize by DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) | where ProcessCommandLine matches regex @"\b(systemctl|chkconfig|service|update-rc\.d)\b" and ProcessCommandLine has_any ("list","status","--status-all") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, FileName, ProcessId, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has "Format-Hex" // Optionally narrow to DOS device paths | where ProcessCommandLine has "\\.\\" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "dd" and ProcessCommandLine has "if=/proc/" | extend DumpFile = extract(@"of=(\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, DumpFile

DeviceNetworkEvents | where InitiatingProcessFileName == "powershell.exe" // only PowerShell processes | where RemotePort == 445 // SMB port | project Timestamp, DeviceName, InitiatingProcessId, InitiatingProcessCommandLine | distinct InitiatingProcessCommandLine

DeviceProcessEvents | where tolower(FileName) == "netsh.exe" | where tolower(ProcessCommandLine) contains "wlan show profile" and tolower(ProcessCommandLine) contains "key=clear" | project ProcessCreationTime, DeviceName, InitiatingProcessAccountName, ProcessCommandLine

DeviceProcessEvents | where FileName =~ "cmdkey.exe" | where ProcessCommandLine has "/list" | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" // Match either "arp" or "arp.exe" | where FileName has_cs "arp" // Look for the common ARP list switches (case-insensitive): -a, -g, /a, /g | where ProcessCommandLine matches regex @"(?i)\barp\s+[-/][ag]\b" | project ProcessCreationTime, DeviceName, InitiatingProcessAccountName, ProcessCommandLine | sort by ProcessCreationTime asc

DeviceProcessEvents // Look for TCP metric cache listing commands (ss -M/--metrics or ip tcp_metrics) | where (ProcessCommandLine has "ss" and (ProcessCommandLine has "-M" or ProcessCommandLine has "--metrics")) or (ProcessCommandLine has "ip" and ProcessCommandLine has "tcp_metrics") // Exclude any references to the loopback interface | where ProcessCommandLine !contains " lo" and ProcessCommandLine !contains "dev lo" // Extract the invoked utility name from the full path | extend UtilityPath = tostring(split(ProcessCommandLine, ' ')[0]) | extend Utility = tostring(split(UtilityPath, '/')[array_length(split(UtilityPath, '/')) - 1]) // Count invocations per utility and sort by highest usage | summarize InvocationCount = count() by Utility | order by InvocationCount desc

DeviceProcessEvents | where ActionType == "ProcessCreated" // Look for common obfuscation and dynamic code invocation patterns | where ProcessCommandLine matches regex @"(?i)\b(IEX|Invoke-Expression|FromBase64String|Add-Type|Reflection|Assembly\.Load)\b" | project TimeGenerated, DeviceName, ProcessName = FileName, ProcessCommandLine | sort by TimeGenerated desc | distinct ProcessName

DeviceProcessEvents | where FileName == "cmd.exe" | where ProcessCommandLine has "for /L" and ProcessCommandLine has "ping" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | sort by TimeGenerated asc

DeviceProcessEvents | where FolderPath has "\\AppData\\" // Running out of a user profile AppData folder | where ProcessVersionInfoOriginalFileName endswith "powershell.exe" // Internally still PowerShell | where FileName != "powershell.exe" // Exclude the real PowerShell binary name | distinct FileName

DeviceProcessEvents | where ProcessCommandLine has_cs "sc create" | project TimeGenerated, DeviceName, Account=InitiatingProcessAccountName, FileName, ProcessCommandLine | order by TimeGenerated desc

let CopiedExecutables = DeviceFileEvents | where ActionType == "FileCreated" // File copied into a user profile folder | where FolderPath startswith @"C:\Users\" // Copying process came from System32 | where InitiatingProcessFolderPath has @"\System32\" | extend FullPath = strcat(FolderPath, "\\", FileName) | project FileName, FullPath, CopyTime = TimeGenerated; DeviceProcessEvents | where ActionType == "ProcessCreated" // Process started from a user profile folder (the copied executable) | where FolderPath startswith @"C:\Users\" | extend ProcessPath = strcat(FolderPath, "\\", FileName) // Join on the exact path to ensure we only see processes launched from our copied file | join kind=inner CopiedExecutables on $left.ProcessPath == $right.FullPath | project ExecutableName = FileName, CopiedAt = CopyTime, LaunchedAt = TimeGenerated

DeviceProcessEvents | where ActionType == "ProcessCreated" // Only look at PowerShell processes | where FileName has "powershell" or ProcessCommandLine has "powershell" // Filter for UNC path pointing to a C$ share and local TEMP folder | where ProcessCommandLine has "\\" | where tolower(ProcessCommandLine) has "c$" | where tolower(ProcessCommandLine) has "temp" // Select relevant fields | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine // Order by most recent | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName == "cmd.exe" // Filter to child processes of cmd.exe that enumerate network connections | where ProcessCommandLine contains "netstat" // Select relevant details to identify the tool and context | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

DeviceProcessEvents | where FileName endswith "powershell.exe" | where ProcessCommandLine has_any ("Get-NetTCPConnection", "Get-NetUDPEndpoint", "Get-NetTCPStats", "netstat") | extend Cmdlet = extract(@"(?i)(Get-NetTCPConnection|Get-NetUDPEndpoint|Get-NetTCPStats|netstat)\b", 1, ProcessCommandLine) | summarize Count = count() by Cmdlet | order by Count desc

DeviceProcessEvents | where FileName == "python3" or ProcessCommandLine has "python3" | where ProcessCommandLine has "/tmp" and (ProcessCommandLine has "http.server" or ProcessCommandLine has "SimpleHTTPServer" or ProcessCommandLine has "-m http.server") | where ProcessCommandLine has "9090" | project ProcessCreationTime, DeviceName, ProcessId, ProcessCommandLine | sort by ProcessCreationTime asc

DeviceProcessEvents | where FileName in ("schtasks.exe", "at.exe") | where ProcessCommandLine has "/create" | project Timestamp, DeviceName, FileName, ProcessCommandLine | distinct FileName

DeviceFileEvents | where FolderPath startswith "/var/spool/cron/crontabs" | where ActionType in ("FileCreated", "FileWrite", "FileModified") | project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where FileName == "powershell.exe" | where ProcessCommandLine has_any ("Get-Process", "gps") | extend ScriptBlockText = tostring(AdditionalFields.ScriptBlockText) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, ScriptBlockText | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("Get-WmiObject", "gwmi", "Get-CimInstance", "Invoke-WmiMethod") | extend WmiClass = extract(@"(?i)(?:-ClassName|-Class)\s+([A-Za-z0-9_:.]+)", 1, ProcessCommandLine) | where isnotempty(WmiClass) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, WmiClass, ProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName == "cmd.exe" | where ProcessCommandLine has "tasklist" or ProcessCommandLine has_cs "wmic process list" | summarize Occurrences = count() by BuiltInTool = strcat(FolderPath, "\\", FileName) | project BuiltInTool, Occurrences

DeviceProcessEvents | where ActionType == "ProcessCreated" // Identify invocations of built-in listing tools piped into findstr | where ProcessCommandLine has "|" and ProcessCommandLine has "findstr" | where ProcessCommandLine has_any ("dir","tasklist") // Extract the search term passed to findstr | extend SearchTerm = extract(@"findstr\s+""?([^""\s]+)""?", 1, ProcessCommandLine) | where isnotempty(SearchTerm) // Select relevant details and count occurrences | project TimeGenerated, DeviceName, InitiatingProcessAccountName, SearchTerm, ProcessCommandLine | summarize Occurrences = count() by SearchTerm | sort by Occurrences desc

DeviceProcessEvents | where FileName =~ "schtasks.exe" | where ProcessCommandLine has "/create" | where ProcessCommandLine has "powershell" | parse ProcessCommandLine with * "-File " ScriptNameRaw:string ".ps1" * | extend Ps1Script = strcat(trim('"', ScriptNameRaw), ".ps1") | where isnotempty(Ps1Script) | project TimeGenerated, DeviceName, AccountName, Ps1Script, ProcessCommandLine | sort by TimeGenerated desc

let ShellFilePath = "/etc/shells"; // 1) Find any processes that reference /etc/shells in their command line let ProcHits = DeviceProcessEvents | where ProcessCommandLine contains ShellFilePath | project TimeGenerated, DeviceName, AccountName, CommandLine = ProcessCommandLine; // 2) Find any file‐access events reading the /etc/shells file let FileHits = DeviceFileEvents | where FileName == "shells" and FolderPath endswith "/etc" | where ActionType has "Read" | project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, CommandLine = InitiatingProcessCommandLine; // Combine and sort union ProcHits, FileHits | sort by TimeGenerated desc

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where tolower(ProcessCommandLine) has "awk" // look for BEGIN rule and system call launching a shell | where tolower(ProcessCommandLine) has "begin" and tolower(ProcessCommandLine) has "system(\"/bin/sh" | project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine | sort by TimeGenerated desc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (LinuxDevices) // Note: the TimeGenerated filter is set via the external time range picker | where ProcessCommandLine matches regex "(?i)\\b(?:curl|wget|fetch)\\b.*\\|\\s*(?:bash|sh|zsh)\\b" | extend DownloaderTool = tostring(extract("(?i)\\b(curl|wget|fetch)\\b", 1, ProcessCommandLine)), ShellUsed = tostring(extract("\\|\\s*(bash|sh|zsh)\\b", 1, ProcessCommandLine)) | project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, DownloaderTool, ShellUsed, ProcessCommandLine, InitiatingProcessFileName, ProcessId | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" // Only look for curl or wget invocations | where ProcessCommandLine contains "curl" or ProcessCommandLine contains "wget" // Focus on raw GitHub URLs | where ProcessCommandLine contains "raw.githubusercontent.com" // Extract the full URL being fetched | extend DownloadUrl = extract(@"(https?://raw\.githubusercontent\.com/[^\s'""\|]+)", 1, ProcessCommandLine) | where isnotempty(DownloadUrl) // Derive the script name from the URL by taking the last path segment | extend ScriptName = tostring(split(DownloadUrl, "/")[-1]) // Filter for typical shell script extensions | where ScriptName endswith ".sh" or ScriptName endswith ".bash" // Summarize by script name to see which scripts were pulled and executed | summarize Count = count() by ScriptName | sort by Count desc