A Windows endpoint recorded a command-line activity through cmd.exe that lists all running processes. Determine which built-in tool was executed to perform this action.

DeviceProcessEvents | where FileName == 'cmd.exe' and ProcessCommandLine contains 'tasklist' | project TimeGenerated, DeviceName, InitiatingProcessCommandLine

DeviceProcessEvents
| where FileName =~ 'cmd.exe' and ProcessCommandLine has 'tasklist'
| project DeviceName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where 
    FileName =~ "tasklist.exe" 
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("process list", "process get")) 
    or (FileName =~ "powershell.exe" and ProcessCommandLine has "Get-Process")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| summarize Count=count(), SampleCommand=any(ProcessCommandLine) by FileName
| order by Count desc

DeviceProcessEvents
| where InitiatingProcessFileName == "cmd.exe"
| where InitiatingProcessCommandLine has_any ("tasklist", "wmic process", "Get-Process")
| project Timestamp, DeviceName, InitiatingProcessCommandLine
| distinct Timestamp, DeviceName, InitiatingProcessCommandLine
| order by Timestamp desc

DeviceProcessEvents
| where FileName in ('cmd.exe', 'cmd')
| where ProcessCommandLine contains 'tasklist' or ProcessCommandLine contains '/tasklist' or ProcessCommandLine contains '/status'
| project DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCreationTime

DeviceProcessEvents
| where InitiatingProcessFileName == "cmd.exe"
  and InitiatingProcessCommandLine contains "tasklist"
| summarize ExecutedTool = any(FileName) by DeviceName, ProcessCreationTime

let ProcessListRegex = @"(?i)\b(tasklist(\.exe)?|(wmic(\.exe)?\s+(path\s+win32_process|process))|(qprocess(\.exe)?|query(\.exe)?\s+process)|((powershell|pwsh)(\.exe)?\b.*\bget-process\b))\b";
DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where ProcessCommandLine matches regex ProcessListRegex or FileName matches regex @"(?i)^(tasklist|wmic|qprocess|query|powershell|pwsh)\.exe$"
| extend BuiltInTool = case(
    FileName =~ "tasklist.exe" or ProcessCommandLine matches regex @"(?i)\btasklist(\.exe)?\b", "tasklist",
    FileName =~ "wmic.exe" or ProcessCommandLine matches regex @"(?i)\bwmic(\.exe)?\s+(path\s+win32_process|process)\b", "wmic process",
    FileName =~ "qprocess.exe" or ProcessCommandLine matches regex @"(?i)\b(qprocess(\.exe)?|query(\.exe)?\s+process)\b", "query process (qprocess)",
    ProcessCommandLine matches regex @"(?i)\b(powershell|pwsh)(\.exe)?\b.*\bget-process\b", "PowerShell Get-Process",
    "other"
)
| where BuiltInTool != "other"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine, BuiltInTool
| order by TimeGenerated desc
// To summarize which tool was used per device/account, append:
// | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count() by DeviceName, AccountName, BuiltInTool

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents
| extend ProcFile = tostring(coalesce(FileName, InitiatingProcessFileName)),
         CmdLine = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine, tostring(AdditionalFields["CommandLine"])))
| where isnotempty(ProcFile) and tolower(ProcFile) endswith "cmd.exe"
| where isnotempty(CmdLine) and (
      tolower(CmdLine) contains "tasklist" or
      tolower(CmdLine) contains "wmic" or
      tolower(CmdLine) contains "get-process" or
      tolower(CmdLine) contains "powershell" or
      tolower(CmdLine) contains "pslist"
  )
| extend DetectedTool = case(
    tolower(CmdLine) contains "tasklist", "tasklist",
    tolower(CmdLine) contains "wmic", "wmic",
    tolower(CmdLine) contains "get-process" or tolower(CmdLine) contains "powershell", "PowerShell (Get-Process)",
    tolower(CmdLine) contains "pslist", "Sysinternals PsList",
    "unknown"
  )
| project TimeGenerated, DeviceName, AccountName = coalesce(AccountName, InitiatingProcessAccountName), ProcFile, CmdLine, DetectedTool
| sort by TimeGenerated desc
| take 100

// Search for cmd.exe invoking commands that list processes
let suspects = DeviceProcessEvents
| where ProcessCommandLine has_cs "cmd.exe" or InitiatingProcessFileName has_cs "cmd.exe"
| where ProcessCommandLine has_any ("tasklist","wmic process","wmic.exe","powershell -command","powershell.exe -command","powershell -c","Get-Process")
| project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, ProcessCreationTime;

let deviceEventsMatches = DeviceEvents
| where ProcessCommandLine has_cs "cmd.exe" or InitiatingProcessFileName has_cs "cmd.exe"
| where ProcessCommandLine has_any ("tasklist","wmic process","wmic.exe","powershell -command","powershell.exe -command","powershell -c","Get-Process")
| project TimeGenerated, DeviceName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName;

union suspects, deviceEventsMatches
| extend ExecutedTool = case(
    tolower(ProcessCommandLine) contains "tasklist", "tasklist",
    tolower(ProcessCommandLine) contains "wmic", "wmic",
    tolower(ProcessCommandLine) contains "get-process" or tolower(ProcessCommandLine) contains "powershell", "powershell",
    "other")
| sort by TimeGenerated desc
| distinct DeviceName, TimeGenerated, ProcessId, ExecutedTool, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| take 100

// Find cmd.exe events that executed commands to list processes and identify which built-in tool was used
DeviceEvents
| where FileName =~ "cmd.exe" or InitiatingProcessFileName =~ "cmd.exe"
// Time range will be applied externally by the query runtime
| where tolower(tostring(ProcessCommandLine)) contains "tasklist"
    or tolower(tostring(ProcessCommandLine)) contains "wmic"
    or tolower(tostring(ProcessCommandLine)) contains "tlist"
    or tolower(tostring(ProcessCommandLine)) contains "get-process"
    or tolower(tostring(ProcessCommandLine)) contains "/c tasklist"
    or tolower(tostring(ProcessCommandLine)) contains "/c wmic"
    or tolower(tostring(ProcessCommandLine)) contains "/c tlist"
    or tolower(tostring(ProcessCommandLine)) contains "/c powershell"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "tasklist"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "wmic"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "tlist"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "get-process"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "/c tasklist"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "/c wmic"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "/c tlist"
    or tolower(tostring(InitiatingProcessCommandLine)) contains "/c powershell"
| extend DetectedTool = case(
    tolower(tostring(ProcessCommandLine)) contains "tasklist" or tolower(tostring(InitiatingProcessCommandLine)) contains "tasklist", "tasklist",
    tolower(tostring(ProcessCommandLine)) contains "wmic" or tolower(tostring(InitiatingProcessCommandLine)) contains "wmic", "wmic",
    tolower(tostring(ProcessCommandLine)) contains "tlist" or tolower(tostring(InitiatingProcessCommandLine)) contains "tlist", "tlist",
    tolower(tostring(ProcessCommandLine)) contains "get-process" or tolower(tostring(InitiatingProcessCommandLine)) contains "get-process" or tolower(tostring(ProcessCommandLine)) contains "powershell" or tolower(tostring(InitiatingProcessCommandLine)) contains "powershell", "powershell Get-Process",
    "unknown")
| project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, AccountName, ActionType, DetectedTool
| order by TimeGenerated desc
// Also include a summarized view
| union (
    // summary
    DeviceEvents
    | where FileName =~ "cmd.exe" or InitiatingProcessFileName =~ "cmd.exe"
    | where tolower(tostring(ProcessCommandLine)) contains "tasklist"
        or tolower(tostring(ProcessCommandLine)) contains "wmic"
        or tolower(tostring(ProcessCommandLine)) contains "tlist"
        or tolower(tostring(ProcessCommandLine)) contains "get-process"
        or tolower(tostring(ProcessCommandLine)) contains "/c tasklist"
        or tolower(tostring(ProcessCommandLine)) contains "/c wmic"
        or tolower(tostring(ProcessCommandLine)) contains "/c tlist"
        or tolower(tostring(ProcessCommandLine)) contains "/c powershell"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "tasklist"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "wmic"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "tlist"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "get-process"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "/c tasklist"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "/c wmic"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "/c tlist"
        or tolower(tostring(InitiatingProcessCommandLine)) contains "/c powershell"
    | extend DetectedTool = case(
        tolower(tostring(ProcessCommandLine)) contains "tasklist" or tolower(tostring(InitiatingProcessCommandLine)) contains "tasklist", "tasklist",
        tolower(tostring(ProcessCommandLine)) contains "wmic" or tolower(tostring(InitiatingProcessCommandLine)) contains "wmic", "wmic",
        tolower(tostring(ProcessCommandLine)) contains "tlist" or tolower(tostring(InitiatingProcessCommandLine)) contains "tlist", "tlist",
        tolower(tostring(ProcessCommandLine)) contains "get-process" or tolower(tostring(InitiatingProcessCommandLine)) contains "get-process" or tolower(tostring(ProcessCommandLine)) contains "powershell" or tolower(tostring(InitiatingProcessCommandLine)) contains "powershell", "powershell Get-Process",
        "unknown")
    | summarize Count = count() by DetectedTool, DeviceName
)
| limit 500

DeviceProcessEvents
| where TimeGenerated >= ago(1d)
| where tolower(InitiatingProcessFileName) == 'cmd.exe'
| where isnotempty(InitiatingProcessCommandLine) and tolower(InitiatingProcessCommandLine) contains 'tasklist'
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessCreationTime, ReportId, _ResourceId

let cmdListEvents = DeviceProcessEvents
| where tolower(InitiatingProcessFileName) == "cmd.exe"
| where (tolower(FileName) contains "tasklist" or tolower(ProcessCommandLine) contains "tasklist" or tolower(InitiatingProcessCommandLine) contains "tasklist")
| extend BuiltInTool = iif(tolower(FileName) contains "tasklist", "tasklist.exe", iif(tolower(ProcessCommandLine) contains "tasklist", "tasklist.exe", iif(tolower(InitiatingProcessCommandLine) contains "tasklist", "tasklist.exe", "Unknown")))
| where BuiltInTool != "Unknown"
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, ProcessId, InitiatingProcessId, BuiltInTool

; cmdListEvents

DeviceProcessEvents
| where InitiatingProcessFileName =~ 'cmd.exe'
| where ProcessCommandLine contains 'tasklist'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, ProcessCreationTime, InitiatingProcessAccountName
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ 'cmd.exe'
| where ProcessCommandLine contains 'tasklist' or ProcessCommandLine contains 'wmic process'
| extend Tool = extract(@'(\btasklist\b|\bwmic process\b)', 1, ProcessCommandLine)
| summarize DistinctTools = make_set(Tool) by TimeGenerated, DeviceName, FileName

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
// Filter to known built-in tools typically used to list running processes
| where FileName in~ ("tasklist.exe", "wmic.exe")
// Optionally refine to further confirm the process-listing context
// by inspecting the command line for relevant keywords (uncomment line below if needed)
// | where ProcessCommandLine has_any ("list", "tasklist", "process")
| project TimeGenerated, DeviceName, AccountName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where FileName in~ ("tasklist.exe", "wmic.exe")
| project TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"          // launched from command prompt
| where FileName in ("tasklist.exe", "wmic.exe")        // known process-enumeration tools
| where FileName == "tasklist.exe"                      // tasklist – always lists processes
   or (FileName == "wmic.exe" and                      // wmic – make sure it was used to list processes
       ProcessCommandLine has "process" and ProcessCommandLine has "list")
| extend ToolExecuted = FileName
| summarize FirstSeen = min(TimeGenerated),
            LastSeen  = max(TimeGenerated),
            DevicesAffected = dcount(DeviceId)
            by ToolExecuted
| order by LastSeen desc

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where ProcessCommandLine contains "tasklist"
| project TimeGenerated, DeviceName, ProcessId, InitiatingProcessFileName, ProcessCommandLine

DeviceProcessEvents
| where FileName =~ "cmd.exe"
| where InitiatingProcessCommandLine has "tasklist" or ProcessCommandLine has "tasklist"
| project TimeGenerated, DeviceName, FileName, InitiatingProcessCommandLine, ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where FileName == "cmd.exe"
| where ProcessCommandLine has_any ("tasklist","wmic","powershell","Get-Process")
| extend Tool = case(
    ProcessCommandLine contains "tasklist", "tasklist",
    ProcessCommandLine contains "wmic", "wmic",
    ProcessCommandLine contains "Get-Process", "Get-Process",
    ProcessCommandLine contains "powershell", "PowerShell",
    "Unknown")
| where Tool != "Unknown"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, Tool
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, InitiatingProcessAccountName, Tool
| order by Count desc

DeviceProcessEvents
| where InitiatingProcessFileName == "cmd.exe"
| where ProcessCommandLine has "tasklist" or ProcessCommandLine has_cs "wmic process list"
| summarize Occurrences = count() by BuiltInTool = strcat(FolderPath, "\\", FileName)
| project BuiltInTool, Occurrences