Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine contains "apple" or ProcessCommandLine contains "berry" or ProcessCommandLine contains "grape" or ProcessCommandLine contains "melon" or ProcessCommandLine contains "lemon" or ProcessCommandLine contains "orange" or ProcessCommandLine contains "pear" or ProcessCommandLine contains "plum" or ProcessCommandLine contains "bean" or ProcessCommandLine contains "corn" or ProcessCommandLine contains "rice" or ProcessCommandLine contains "fish" or ProcessCommandLine contains "meat" or ProcessCommandLine contains "egg" or ProcessCommandLine contains "milk" or ProcessCommandLine contains "honey" or ProcessCommandLine contains "sugar" or ProcessCommandLine contains "salt" or ProcessCommandLine contains "pie" or ProcessCommandLine contains "donut" or ProcessCommandLine contains "candy" or FileName contains "apple" or FileName contains "berry" or FileName contains "grape" or FileName contains "melon" or FileName contains "lemon" or FileName contains "orange" or FileName contains "pear" or FileName contains "plum" or FileName contains "bean" or FileName contains "corn" or FileName contains "rice" or FileName contains "fish" or FileName contains "meat" or FileName contains "egg" or FileName contains "milk" or FileName contains "honey" or FileName contains "sugar" or FileName contains "salt" or FileName contains "pie" or FileName contains "donut" or FileName contains "candy" or InitiatingProcessCommandLine contains "apple" or InitiatingProcessCommandLine contains "berry" or InitiatingProcessCommandLine contains "grape" or InitiatingProcessCommandLine contains "melon" or InitiatingProcessCommandLine contains "lemon" or InitiatingProcessCommandLine contains "orange" or InitiatingProcessCommandLine contains "pear" or InitiatingProcessCommandLine contains "plum" or InitiatingProcessCommandLine contains "bean" or InitiatingProcessCommandLine contains "corn" or InitiatingProcessCommandLine contains "rice" or InitiatingProcessCommandLine contains "fish" or InitiatingProcessCommandLine contains "meat" or InitiatingProcessCommandLine contains "egg" or InitiatingProcessCommandLine contains "milk" or InitiatingProcessCommandLine contains "honey" or InitiatingProcessCommandLine contains "sugar" or InitiatingProcessCommandLine contains "salt" or InitiatingProcessCommandLine contains "pie" or InitiatingProcessCommandLine contains "donut" or InitiatingProcessCommandLine contains "candy" or InitiatingProcessFileName contains "apple" or InitiatingProcessFileName contains "berry" or InitiatingProcessFileName contains "grape" or InitiatingProcessFileName contains "melon" or InitiatingProcessFileName contains "lemon" or InitiatingProcessFileName contains "orange" or InitiatingProcessFileName contains "pear" or InitiatingProcessFileName contains "plum" or InitiatingProcessFileName contains "bean" or InitiatingProcessFileName contains "corn" or InitiatingProcessFileName contains "rice" or InitiatingProcessFileName contains "fish" or InitiatingProcessFileName contains "meat" or InitiatingProcessFileName contains "egg" or InitiatingProcessFileName contains "milk" or InitiatingProcessFileName contains "honey" or InitiatingProcessFileName contains "sugar" or InitiatingProcessFileName contains "salt" or InitiatingProcessFileName contains "pie" or InitiatingProcessFileName contains "donut" or InitiatingProcessFileName contains "candy" | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has_any ("cookie", "egg", "cheese", "bacon", "peach", "apple", "onion") | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath

DeviceProcessEvents | where ProcessCommandLine matches regex @'\b(cookie|bread|cake|pie|fruit|apple|banana|cherry|grape|berry|meat|fish|rice|noodle|pasta|soup|salad|cheese|milk|egg)\b' or InitiatingProcessCommandLine matches regex @'\b(cookie|bread|cake|pie|fruit|apple|banana|cherry|grape|berry|meat|fish|rice|noodle|pasta|soup|salad|cheese|milk|egg)\b' | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ActionType | order by Timestamp desc | limit 100

DeviceProcessEvents | where ProcessCommandLine has 'nmap' or ProcessCommandLine has 'finger' | project TimeGenerated, DeviceName, ProcessCommandLine, FileName | order by TimeGenerated desc

union DeviceProcessEvents, DeviceFileEvents, DeviceImageLoadEvents | where TimeGenerated >= ago(7d) | where isnotempty(FileName) or isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | where FileName has_any ("cookie", "potato", "apple", "banana", "cake", "milk", "taco") or ProcessCommandLine has_any ("cookie", "potato", "apple", "banana", "cake", "milk", "taco") or InitiatingProcessCommandLine has_any ("cookie", "potato", "apple", "banana", "cake", "milk", "taco") | project TimeGenerated, Type, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc