A Windows host executed an ICMP-based network reconnaissance using a looping instruction in cmd.exe. Identify the exact command line that was used to perform the ping sweep.

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName == "cmd.exe"
| where ProcessCommandLine contains "for" and ProcessCommandLine contains "ping"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName

DeviceProcessEvents
| where ActionType == 'ProcessCreated' and ProcessCommandLine contains 'ping' and ProcessCommandLine contains '-t' and ProcessCommandLine contains 'cmd.exe'

DeviceProcessEvents
| where FileName == 'cmd.exe' and ProcessCommandLine has 'for' and ProcessCommandLine has 'ping'
| project DeviceName, ProcessCommandLine, TimeGenerated
| distinct ProcessCommandLine

DeviceProcessEvents
| where tolower(FileName) == "cmd.exe" or tolower(InitiatingProcessFileName) == "cmd.exe"
| where (
    (tolower(ProcessCommandLine) has "for" and tolower(ProcessCommandLine) has "ping" and ProcessCommandLine matches regex @"for.+(%%?\w).+ping")
    or
    (tolower(InitiatingProcessCommandLine) has "for" and tolower(InitiatingProcessCommandLine) has "ping" and InitiatingProcessCommandLine matches regex @"for.+(%%?\w).+ping")
)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessParentFileName == "cmd.exe"
| where ProcessCommandLine contains "ping"
| where ProcessCommandLine matches regex @".*(for|while|foreach).* ping.*"
| project DeviceName, ProcessCommandLine, TimeGenerated
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName == 'cmd.exe'
| where ProcessCommandLine has_any ('for', 'while') or ProcessCommandLine contains 'ping'
| project DeviceName, ProcessId, ProcessCommandLine, ProcessCreationTime, InitiatingProcessFileName

DeviceProcessEvents
| where InitiatingProcessFileName == "cmd.exe"
| where InitiatingProcessCommandLine has_all ("ping", "-n", "&&") or InitiatingProcessCommandLine has_any ("for", "loop", "%%")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName

let ping_loop_regex = @"\bfor\s+/(l|f)\b[^\r\n]*\bdo\b[^\r\n]*\bping\b|\bset\s+/a\b[^\r\n]*&[^\r\n]*\bping\b[^\r\n]*&[^\r\n]*\bgoto\b";
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "cmd.exe"
| where isnotempty(ProcessCommandLine)
| extend pcl = tolower(ProcessCommandLine)
| where pcl has "ping" and (pcl matches regex ping_loop_regex)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Executions=count() by DeviceName, AccountDomain, AccountName, ProcessCommandLine
| order by LastSeen desc

let cmdSources = (
    DeviceProcessEvents
    | extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
    | project Timestamp, DeviceName, FileName, ProcessId, CmdLine, InitiatingProcessFileName
)
| union (
    DeviceEvents
    | extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
    | project Timestamp, DeviceName, FileName, ProcessId, CmdLine, InitiatingProcessFileName
);

cmdSources
| where isnotempty(CmdLine)
| where (FileName has_cs "cmd.exe") or (InitiatingProcessFileName has_cs "cmd.exe") or tolower(CmdLine) contains "cmd.exe"
| where tolower(CmdLine) contains "ping"
| where (tolower(CmdLine) contains "for /l" or tolower(CmdLine) contains "for /f" or tolower(CmdLine) contains "for %")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Examples=make_set(CmdLine, 20) by DeviceName, FileName, ProcessId
| mv-expand Examples
| project DeviceName, FileName, ProcessId, PingSweepCommandLine=Examples, FirstSeen, LastSeen
| order by FirstSeen desc

// Find cmd.exe-based ping sweeps using looping constructs
let loopPingRegex = @"(?i)\bfor\b.*\bping\b|\bping\b.*\bfor\b";
// Primary: process creation events (best fidelity)
let proc = DeviceProcessEvents
| where FileName has_cs "cmd.exe" or ProcessCommandLine has_cs "cmd.exe"
| where isnotempty(ProcessCommandLine) and ProcessCommandLine matches regex loopPingRegex
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessId, CommandLine = ProcessCommandLine;
// Supplementary: other device events that may contain process command lines
let dev = DeviceEvents
| where (FileName has_cs "cmd.exe") or (ProcessCommandLine has_cs "cmd.exe") or (InitiatingProcessFileName has_cs "cmd.exe")
| extend ProcessId = coalesce(ProcessId, InitiatingProcessId), CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| where isnotempty(CommandLine) and CommandLine matches regex loopPingRegex
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessId, CommandLine;

union isfuzzy=true proc, dev
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName), Users=make_set(AccountName), Count=count(), PIDs=make_set(ProcessId) by CommandLine
| order by FirstSeen desc
| project FirstSeen, LastSeen, Count, Devices, Users, PIDs, CommandLine
| take 100

// NOTE: TimeGenerated/time range is applied by the caller/environment. If needed, add an explicit where TimeGenerated between(...) filter.

union DeviceProcessEvents, DeviceEvents
| where FileName =~ "cmd.exe" or ProcessCommandLine has "cmd.exe"
| where ProcessCommandLine has "ping"
| where (
    tolower(ProcessCommandLine) contains "for" 
    or ProcessCommandLine contains "%i"
    or ProcessCommandLine contains "%%i"
    or tolower(ProcessCommandLine) contains " do "
  )
// get the most recent record for each distinct command line
| summarize arg_max(TimeGenerated, *) by ProcessCommandLine
| project TimeGenerated, DeviceName, ProcessId, InitiatingProcessId, InitiatingProcessFileName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where tolower(InitiatingProcessFileName) == "cmd.exe"
| where InitiatingProcessCommandLine contains "ping" and InitiatingProcessCommandLine contains "for /l"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| sort by TimeGenerated desc
| take 5

DeviceProcessEvents
| where FileName =~ 'cmd.exe'
| where ProcessCommandLine contains 'ping' and ProcessCommandLine contains 'for'
| project TimeGenerated, DeviceName, ProcessCommandLine
| order by TimeGenerated desc
| limit 10

DeviceProcessEvents
| where ActionType =~ "ProcessCreated"
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has_all ("ping", "for")
| project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName == "cmd.exe"
| where ProcessCommandLine contains "for /L" and ProcessCommandLine contains "ping"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents
| where TimeGenerated between (ago(7d) .. now())   // Portal/function time-range overrides this
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has_any ("for /l", "FOR /L")
| where ProcessCommandLine has "ping"
| where ProcessCommandLine matches regex @"(?i)for\s+/l\s+%+[a-z0-9]+\s+in\s+\([^)]*\)\s+do\s+ping"
| project TimeGenerated,
          DeviceName,
          AccountName,
          ProcessCommandLine
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ExecCount=count() by DeviceName, AccountName, ProcessCommandLine
| order by LastSeen desc

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where InitiatingProcessCommandLine contains "ping" and InitiatingProcessCommandLine contains "for /l"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where InitiatingProcessCommandLine has "ping"
| where InitiatingProcessCommandLine has "for"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
// Apply your time range filter here (e.g. | where TimeGenerated between (start .. end))
| where FileName == "cmd.exe"
| where ProcessCommandLine matches regex @"(?i)for\s+/?l.*ping"
| project TimeGenerated, DeviceName, ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where FileName == "cmd.exe"
| where ProcessCommandLine has "for /L" and ProcessCommandLine has "ping"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
| sort by TimeGenerated asc