Question Analysis

DeviceProcessEvents | where FileName =~ "bitsadmin.exe" | where ProcessCommandLine contains "/create" or ProcessCommandLine contains "/addfile" | extend JobName_create = extract(@"/create\s+([^\s]+)", 1, ProcessCommandLine) | extend JobName_addfile = extract(@"/addfile\s+([^\s]+)", 1, ProcessCommandLine) | extend CustomJobName = coalesce(JobName_create, JobName_addfile) | where isnotnull(CustomJobName) | project Timestamp, DeviceName, ProcessCommandLine, CustomJobName

DeviceProcessEvents | where FileName =~ "bitsadmin.exe" | where ProcessCommandLine has "/create" | extend JobName = extract(@"/create\s+([^\s]+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, JobName | where isnotempty(JobName) | sort by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "bitsadmin.exe" | where ProcessCommandLine contains "create" | extend JobName = extract(@"create\s+(\S+)", 1, ProcessCommandLine) | project DeviceName, TimeGenerated, JobName, InitiatingProcessAccountName, ProcessCommandLine | where isnotempty(JobName) | sort by TimeGenerated desc

DeviceProcessEvents | where FileName endswith 'bitsadmin.exe' | where ProcessCommandLine contains 'create' | extend JobName = extract(@'\s/\s*(\S+)$', 1, ProcessCommandLine) | project TimeGenerated, DeviceName, JobName

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "bitsadmin.exe" or ProcessCommandLine has "bitsadmin" // Extract job name from /create or /transfer (handles quoted and unquoted names, optional /download|/upload|/upload-reply) | extend CreateQuoted = extract(@"(?i)(?:^|\s)(?:-|/)create\s+(?:(?:-|/)?(?:download|upload|upload-reply)\s+)?""([^""]+)""", 1, ProcessCommandLine) | extend CreateUnquoted = iff(isempty(CreateQuoted), extract(@"(?i)(?:^|\s)(?:-|/)create\s+(?:(?:-|/)?(?:download|upload|upload-reply)\s+)?(\S+)", 1, ProcessCommandLine), "") | extend TransferQuoted = iff(isempty(CreateQuoted) and isempty(CreateUnquoted), extract(@"(?i)(?:^|\s)(?:-|/)transfer\s+(?:(?:-|/)?(?:download|upload|upload-reply)\s+)?""([^""]+)""", 1, ProcessCommandLine), "") | extend TransferUnquoted = iff(isempty(CreateQuoted) and isempty(CreateUnquoted) and isempty(TransferQuoted), extract(@"(?i)(?:^|\s)(?:-|/)transfer\s+(?:(?:-|/)?(?:download|upload|upload-reply)\s+)?(\S+)", 1, ProcessCommandLine), "") | extend JobName = coalesce(CreateQuoted, CreateUnquoted, TransferQuoted, TransferUnquoted) | where isnotempty(JobName) | project TimeGenerated, DeviceId, DeviceName, AccountDomain, AccountName, ProcessCommandLine, JobName | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Examples=make_set(ProcessCommandLine, 3) by DeviceId, DeviceName, AccountDomain, AccountName, JobName | order by LastSeen desc

DeviceProcessEvents | where FileName =~ 'bitsadmin.exe' | where ProcessCommandLine contains '/create' | extend JobName = extract(@'/create\s+([^\s]+)', 1, ProcessCommandLine) | project Timestamp, DeviceName, ProcessCommandLine, JobName | summarize JobNames = makeset(JobName) by DeviceName

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "bitsadmin.exe" | where ProcessCommandLine has "/create" // Use a regex parse that captures either a quoted or unquoted job name | parse kind=regex ProcessCommandLine with ".*bitsadmin\\.exe\\s+/create\\s+(\"[^\"]+\"|\\S+).*" JobName // Clean up any surrounding double-quotes | extend CustomJobName = trim('"', JobName) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, CustomJobName

DeviceProcessEvents // -- filter to bitsadmin executions that create a BITS job ------------------------------------ | where FileName =~ 'bitsadmin.exe' or ProcessCommandLine has_cs 'bitsadmin.exe' | extend cmd = tostring(ProcessCommandLine) // keep only invocations that attempt to *create* a job | where tolower(cmd) has '/create' // -- extract the argument that represents the custom job name --------------------------------- | extend idx = indexof(tolower(cmd), '/create') // location of the verb | extend afterCreate = substring(cmd, idx + 7) // text that follows "/create" | extend afterCreate = trim_start(' ', afterCreate) // remove leading spaces | extend tokens = split(afterCreate, ' ') // tokenise | extend firstTok = tostring(tokens[0]) // first argument after the verb // if the first argument is itself a switch (/download or /upload) take the next one instead | extend jobTok = case(tolower(firstTok) == '/download' or tolower(firstTok) == '/upload', tostring(tokens[1]), firstTok) | extend JobName = trim("'\"", jobTok) // strip any surrounding quotes | where isnotempty(JobName) // -- output ------------------------------------------------------------------------ | project TimeGenerated, DeviceName, DeviceId, AccountName, ProcessCommandLine, JobName | summarize Executions = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, DeviceId, AccountName, JobName | order by LastSeen desc

DeviceProcessEvents | where tolower(InitiatingProcessFileName) == "bitsadmin.exe" or tolower(FileName) == "bitsadmin.exe" | where ProcessCommandLine has "/create" | extend CustomJobName = extract(@"/create\s+(\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, CustomJobName | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName has_cs "bitsadmin.exe" | where ProcessCommandLine has_cs "/create" | extend JobName = extract('(?i)/create\\s+"?([^"\\s]+)"?', 1, ProcessCommandLine) | where isnotempty(JobName) | project TimeGenerated, DeviceName, AccountName, ProcessId, JobName, ProcessCommandLine