Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine contains "fsutil usn deletejournal" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated asc

DeviceProcessEvents | where ActionType == 'ProcessCreated' | where InitiatingProcessCommandLine has 'fsutil' and InitiatingProcessCommandLine has 'usn' and InitiatingProcessCommandLine has 'deletejournal' | project DeviceName, InitiatingProcessCommandLine, ProcessCreationTime

DeviceProcessEvents | where ProcessCommandLine has_any ("usn deletejournal", "fsutil usn deletejournal") | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessCommandLine

DeviceProcessEvents // Use DeviceProcessEvents for process-level details | where ProcessCommandLine contains "usn" and ProcessCommandLine contains "deletejournal" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, ActionType, FolderPath | order by TimeGenerated desc | take 1 // Ensure you only get the most recent event

DeviceProcessEvents | where ProcessCommandLine has_any ("fsutil usn deletejournal", "fsutil usn delete", "$UsnJrnl") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ProcessCreationTime | order by TimeGenerated desc

DeviceProcessEvents | where ActionType =~ "ProcessCreated" and (ProcessCommandLine contains "delete" and ProcessCommandLine contains "USN" and ProcessCommandLine contains "journal") | project DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessAccountName, InitiatingProcessAccountDomain | limit 100

DeviceProcessEvents | where FileName =~ "fsutil.exe" or ProcessCommandLine has "fsutil" | where ProcessCommandLine has_all ("usn", "deletejournal") | project Time=ProcessCreationTime, DeviceName, AccountDomain, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName | order by Time desc

// Search DeviceProcessEvents and DeviceEvents for process start records matching USN change journal deletion commands let keywords = dynamic(["usn","deletejournal","delete journal","fsutil usn","usn delete"]); // Helper to search a table for matching commandlines let SearchTable = (tableName: string) { toscalar( // we can't dynamic reference table by name easily, so we'll rely on union below print dummy=1 ) }; // Union the two relevant tables that contain process creation info union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents, DeviceImageLoadEvents | where TimeGenerated between (startofday(ago(30d)) .. now()) // placeholder; time range in function call will override | extend cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, ProcessCommandLine, ProcessCommandLine) | where isnotempty(cmd) | where cmd has_any ("usn", "deletejournal") or cmd contains_cs("fsutil usn") or cmd has_any ("\"deletejournal\"", "delete journal", "usn delete") | project TimeGenerated, DeviceName, DeviceId, ReportId, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessAccountName, ProcessId, ProcessCommandLine=cmd, ActionType, FileName | distinct DeviceName, DeviceId, InitiatingProcessId, ProcessId, ProcessCommandLine, TimeGenerated, InitiatingProcessFileName, InitiatingProcessAccountName, ActionType, ReportId, FileName | order by TimeGenerated desc | take 100

(DeviceProcessEvents | where isnotempty(ProcessCommandLine) | where tostring(tolower(ProcessCommandLine)) has "usn" and (tostring(tolower(ProcessCommandLine)) has "deletejournal" or tostring(tolower(ProcessCommandLine)) has "delete journal") | project TimeGenerated, Timestamp, DeviceName, ProcessCommandLine, FileName, ProcessId, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessId, AccountName, AccountDomain = AccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountDomain, ReportId, _ResourceId ) | union ( DeviceEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | extend ProcessCommandLine2 = iff(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine) | where tostring(tolower(ProcessCommandLine2)) has "usn" and (tostring(tolower(ProcessCommandLine2)) has "deletejournal" or tostring(tolower(ProcessCommandLine2)) has "delete journal") | project TimeGenerated, Timestamp, DeviceName, ProcessCommandLine = ProcessCommandLine2, FileName, ProcessId = coalesce(ProcessId, InitiatingProcessId), ProcessCreationTime = coalesce(ProcessCreationTime, InitiatingProcessCreationTime), InitiatingProcessFileName, InitiatingProcessId, AccountName, AccountDomain = AccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountDomain, ReportId, _ResourceId ) | extend CommandLower = tostring(tolower(ProcessCommandLine)) | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), AnyProcessName = any(FileName), AnyInitiating = any(InitiatingProcessFileName), AnyProcessId = any(ProcessId), AnyAccount = any(iff(isnotempty(AccountName), AccountName, InitiatingProcessAccountName)), SampleCommand = any(ProcessCommandLine) by CommandLower, DeviceName | project DeviceName, FirstSeen, LastSeen, AnyAccount, AnyProcessName, AnyInitiating, AnyProcessId, SampleCommand | order by FirstSeen desc | limit 100

// Look for process creation events showing deletion of USN change journal let keywords = dynamic(["fsutil","usn","deletejournal","esentutl","esentutl /r","esentutl /p","del"]); DeviceProcessEvents | where TimeGenerated between (startofday(ago(30d)) .. now()) // ProcessCreationTime/TimeGenerated timeframe will be set by function call, but include a 30d fallback | where tostring(ProcessCommandLine) != "" | where tolower(ProcessCommandLine) contains "usn" and tolower(ProcessCommandLine) contains "deletejournal" // Include common variants and other utilities that might be used | where tolower(ProcessCommandLine) contains "fsutil" or tolower(ProcessCommandLine) contains "esentutl" or tolower(ProcessCommandLine) contains "deletejournal" | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain, AccountSid, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, FileName, ProcessCommandLine, ProcessCreationTime, ReportId | extend FullCommandLine = iff(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine) | summarize any(FullCommandLine) by DeviceName, DeviceId, ProcessId, InitiatingProcessId, ProcessCreationTime, TimeGenerated, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName | order by TimeGenerated desc | take 50 // Fallback to DeviceEvents if no hits in DeviceProcessEvents | union ( DeviceEvents | where TimeGenerated between (startofday(ago(30d)) .. now()) | where tostring(ProcessCommandLine) != "" | where tolower(ProcessCommandLine) contains "usn" and tolower(ProcessCommandLine) contains "deletejournal" | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain, AccountSid, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessFileName = InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId = InitiatingProcessId, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, ProcessCreationTime = InitiatingProcessCreationTime | extend FullCommandLine = ProcessCommandLine | order by TimeGenerated desc | take 50 ) | distinct *

DeviceProcessEvents | where ProcessCommandLine contains "fsutil" and ProcessCommandLine contains "deletejournal" | project Timestamp, DeviceName, AccountName, ProcessCommandLine | order by Timestamp desc

DeviceProcessEvents | where ProcessCommandLine contains "fsutil" and ProcessCommandLine contains "usn" and ProcessCommandLine contains "deletejournal" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc | limit 10

union DeviceProcessEvents, DeviceEvents | where ActionType in~ ("CreateProcess","ProcessCreated") | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | where (ProcessCommandLine has "fsutil" or InitiatingProcessCommandLine has "fsutil") and ((ProcessCommandLine has_any ("usn", "deletejournal") or InitiatingProcessCommandLine has_any ("usn", "deletejournal"))) | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has_any ("deletejournal", "usn") | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" // only process start events | where tolower(ProcessCommandLine) has_all ("fsutil", "usn", "deletejournal") // optional: keep devices or users of interest // | where DeviceName =~ "<suspect host>" | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has_cs "fsutil" and InitiatingProcessCommandLine has_cs "deletejournal" | project TimeGenerated, DeviceName, InitiatingProcessCommandLine | sort by TimeGenerated asc

DeviceProcessEvents | where InitiatingProcessCommandLine contains "fsutil" and InitiatingProcessCommandLine contains "deleteJournal" | project TimeGenerated, DeviceName, InitiatingProcessCommandLine | sort by TimeGenerated asc

DeviceProcessEvents | where ActionType == "ProcessCreated" // Look specifically for the fsutil usn deletejournal command | where tolower(FileName) == "fsutil.exe" and tolower(ProcessCommandLine) contains "usn" and tolower(ProcessCommandLine) contains "deletejournal" // Show the relevant details including the full command line | project TimeGenerated, DeviceName, AccountName, ProcessId, ProcessCommandLine | sort by TimeGenerated asc