Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName == "cmd.exe" | where ProcessCommandLine contains "for" and ProcessCommandLine contains "ping" | project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName

DeviceProcessEvents | where ActionType == 'ProcessCreated' and ProcessCommandLine contains 'ping' and ProcessCommandLine contains '-t' and ProcessCommandLine contains 'cmd.exe'

DeviceProcessEvents | where FileName == 'cmd.exe' and ProcessCommandLine has 'for' and ProcessCommandLine has 'ping' | project DeviceName, ProcessCommandLine, TimeGenerated | distinct ProcessCommandLine

DeviceProcessEvents | where tolower(FileName) == "cmd.exe" or tolower(InitiatingProcessFileName) == "cmd.exe" | where ( (tolower(ProcessCommandLine) has "for" and tolower(ProcessCommandLine) has "ping" and ProcessCommandLine matches regex @"for.+(%%?\w).+ping") or (tolower(InitiatingProcessCommandLine) has "for" and tolower(InitiatingProcessCommandLine) has "ping" and InitiatingProcessCommandLine matches regex @"for.+(%%?\w).+ping") ) | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessParentFileName == "cmd.exe" | where ProcessCommandLine contains "ping" | where ProcessCommandLine matches regex @".*(for|while|foreach).* ping.*" | project DeviceName, ProcessCommandLine, TimeGenerated | order by TimeGenerated desc

DeviceProcessEvents | where FileName == 'cmd.exe' | where ProcessCommandLine has_any ('for', 'while') or ProcessCommandLine contains 'ping' | project DeviceName, ProcessId, ProcessCommandLine, ProcessCreationTime, InitiatingProcessFileName

DeviceProcessEvents | where InitiatingProcessFileName == "cmd.exe" | where InitiatingProcessCommandLine has_all ("ping", "-n", "&&") or InitiatingProcessCommandLine has_any ("for", "loop", "%%") | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName

let ping_loop_regex = @"\bfor\s+/(l|f)\b[^\r\n]*\bdo\b[^\r\n]*\bping\b|\bset\s+/a\b[^\r\n]*&[^\r\n]*\bping\b[^\r\n]*&[^\r\n]*\bgoto\b"; DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "cmd.exe" | where isnotempty(ProcessCommandLine) | extend pcl = tolower(ProcessCommandLine) | where pcl has "ping" and (pcl matches regex ping_loop_regex) | project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Executions=count() by DeviceName, AccountDomain, AccountName, ProcessCommandLine | order by LastSeen desc

let cmdSources = ( DeviceProcessEvents | extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | project Timestamp, DeviceName, FileName, ProcessId, CmdLine, InitiatingProcessFileName ) | union ( DeviceEvents | extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | project Timestamp, DeviceName, FileName, ProcessId, CmdLine, InitiatingProcessFileName ); cmdSources | where isnotempty(CmdLine) | where (FileName has_cs "cmd.exe") or (InitiatingProcessFileName has_cs "cmd.exe") or tolower(CmdLine) contains "cmd.exe" | where tolower(CmdLine) contains "ping" | where (tolower(CmdLine) contains "for /l" or tolower(CmdLine) contains "for /f" or tolower(CmdLine) contains "for %") | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Examples=make_set(CmdLine, 20) by DeviceName, FileName, ProcessId | mv-expand Examples | project DeviceName, FileName, ProcessId, PingSweepCommandLine=Examples, FirstSeen, LastSeen | order by FirstSeen desc

// Find cmd.exe-based ping sweeps using looping constructs let loopPingRegex = @"(?i)\bfor\b.*\bping\b|\bping\b.*\bfor\b"; // Primary: process creation events (best fidelity) let proc = DeviceProcessEvents | where FileName has_cs "cmd.exe" or ProcessCommandLine has_cs "cmd.exe" | where isnotempty(ProcessCommandLine) and ProcessCommandLine matches regex loopPingRegex | project TimeGenerated, DeviceName, AccountName, FileName, ProcessId, CommandLine = ProcessCommandLine; // Supplementary: other device events that may contain process command lines let dev = DeviceEvents | where (FileName has_cs "cmd.exe") or (ProcessCommandLine has_cs "cmd.exe") or (InitiatingProcessFileName has_cs "cmd.exe") | extend ProcessId = coalesce(ProcessId, InitiatingProcessId), CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | where isnotempty(CommandLine) and CommandLine matches regex loopPingRegex | project TimeGenerated, DeviceName, AccountName, FileName, ProcessId, CommandLine; union isfuzzy=true proc, dev | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName), Users=make_set(AccountName), Count=count(), PIDs=make_set(ProcessId) by CommandLine | order by FirstSeen desc | project FirstSeen, LastSeen, Count, Devices, Users, PIDs, CommandLine | take 100 // NOTE: TimeGenerated/time range is applied by the caller/environment. If needed, add an explicit where TimeGenerated between(...) filter.

union DeviceProcessEvents, DeviceEvents | where FileName =~ "cmd.exe" or ProcessCommandLine has "cmd.exe" | where ProcessCommandLine has "ping" | where ( tolower(ProcessCommandLine) contains "for" or ProcessCommandLine contains "%i" or ProcessCommandLine contains "%%i" or tolower(ProcessCommandLine) contains " do " ) // get the most recent record for each distinct command line | summarize arg_max(TimeGenerated, *) by ProcessCommandLine | project TimeGenerated, DeviceName, ProcessId, InitiatingProcessId, InitiatingProcessFileName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where tolower(InitiatingProcessFileName) == "cmd.exe" | where InitiatingProcessCommandLine contains "ping" and InitiatingProcessCommandLine contains "for /l" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine | sort by TimeGenerated desc | take 5

DeviceProcessEvents | where FileName =~ 'cmd.exe' | where ProcessCommandLine contains 'ping' and ProcessCommandLine contains 'for' | project TimeGenerated, DeviceName, ProcessCommandLine | order by TimeGenerated desc | limit 10

DeviceProcessEvents | where ActionType =~ "ProcessCreated" | where FileName =~ "cmd.exe" | where ProcessCommandLine has_all ("ping", "for") | project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName == "cmd.exe" | where ProcessCommandLine contains "for /L" and ProcessCommandLine contains "ping" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents | where TimeGenerated between (ago(7d) .. now()) // Portal/function time-range overrides this | where FileName =~ "cmd.exe" | where ProcessCommandLine has_any ("for /l", "FOR /L") | where ProcessCommandLine has "ping" | where ProcessCommandLine matches regex @"(?i)for\s+/l\s+%+[a-z0-9]+\s+in\s+\([^)]*\)\s+do\s+ping" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ExecCount=count() by DeviceName, AccountName, ProcessCommandLine | order by LastSeen desc

DeviceProcessEvents | where InitiatingProcessFileName =~ "cmd.exe" | where InitiatingProcessCommandLine contains "ping" and InitiatingProcessCommandLine contains "for /l" | project TimeGenerated, DeviceName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName =~ "cmd.exe" | where InitiatingProcessCommandLine has "ping" | where InitiatingProcessCommandLine has "for" | project TimeGenerated, DeviceName, InitiatingProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents // Apply your time range filter here (e.g. | where TimeGenerated between (start .. end)) | where FileName == "cmd.exe" | where ProcessCommandLine matches regex @"(?i)for\s+/?l.*ping" | project TimeGenerated, DeviceName, ProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where FileName == "cmd.exe" | where ProcessCommandLine has "for /L" and ProcessCommandLine has "ping" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | sort by TimeGenerated asc