Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName == "pnputil.exe" | where ProcessCommandLine contains "-a" | project Timestamp, DeviceName, ProcessCommandLine

DeviceProcessEvents | where FileName in~ ("pnputil.exe", "rundll32.exe") | where ProcessCommandLine has_any ("/add-driver", "add-driver", ".inf") | extend InfFile=extract(@"([\w\:\\.-]+\.inf)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InfFile, AccountName, InitiatingProcessAccountName

DeviceProcessEvents | where InitiatingProcessCommandLine has "inf"

DeviceProcessEvents | where ProcessCommandLine contains "pnputil" or ProcessCommandLine contains "dism" | where ProcessCommandLine contains "/add-driver" or ProcessCommandLine contains "/install-driver" | extend INFFileName = extract(@"\\([^\\]+\.inf)", 1, ProcessCommandLine) | project ProcessCreationTime, ProcessId, DeviceName, ProcessCommandLine, INFFileName | where isnotempty(INFFileName)

DeviceProcessEvents | where InitiatingProcessCommandLine contains "add-driver" | extend INF_FileName = extract(@"[^\s]*\.inf", 0, InitiatingProcessCommandLine) | project DeviceName, DeviceId, InitiatingProcessCommandLine, INF_FileName, ProcessCreationTime

// Find .inf filenames referenced by pnputil/devcon/rundll32 driver-install invocations union isfuzzy=true DeviceProcessEvents, DeviceEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | extend Cmdline = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) // Look for known installer utilities or InstallHinfSection calls | where Cmdline has_cs "pnputil" or Cmdline has_cs "rundll32" or Cmdline has_cs "devcon" or Cmdline contains_cs "InstallHinfSection" // Split the command line into tokens and normalize | mv-expand token = split(Cmdline, ' ') | extend token = trim('\"''', tostring(token)) // Tokens that end with .inf (case-insensitive) | where tolower(token) endswith ".inf" | extend inf = token | project TimeGenerated, DeviceName, DeviceId, ReportId, ProcessId = coalesce(ProcessId, InitiatingProcessId), ProcessFileName = coalesce(FileName, InitiatingProcessFileName), InitiatingProcessId, InitiatingProcessCommandLine, Cmdline, inf | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), Cmdlines = make_set(Cmdline, 5), Initiators = make_set(ProcessFileName, 5) by DeviceName, DeviceId, ReportId, ProcessId, inf | order by FirstSeen desc | limit 200

DeviceProcessEvents | where TimeGenerated between (startofday(ago(7d)) .. now()) // Focus on common Windows utilities used to install drivers | where tolower(ProcessCommandLine) contains "pnputil" or tolower(ProcessCommandLine) contains "devcon" or tolower(ProcessCommandLine) contains "rundll32 setupapi" or tolower(ProcessCommandLine) contains "setupapi.dll,InstallHinfSection" or tolower(ProcessCommandLine) contains "install-hinfsection" // Extract potential .inf filenames from the command line | extend Cmd = tostring(ProcessCommandLine) | extend INF = extract(@"([\w:\\\.\-\s]+?\.inf)", 1, Cmd) | extend INF = trim('\"', INF) | where isnotempty(INF) | project TimeGenerated, DeviceName, ProcessId, FileName = ProcessVersionInfoOriginalFileName, ProcessFileName = ProcessVersionInfoOriginalFileName, InitiatingProcessFileName, InitiatingProcessId, AccountName, AccountDomain, ProcessCommandLine = Cmd, INF | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count() by DeviceName, INF, InitiatingProcessFileName, InitiatingProcessId, AccountDomain, AccountName | order by LastSeen desc | limit 50

DeviceProcessEvents | where (InitiatingProcessFileName in ('pnputil.exe','pnputil') or tolower(coalesce(InitiatingProcessCommandLine, ProcessCommandLine)) contains 'add-driver') | extend CmdLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | extend InfPath = extract(@"(?i)([A-Za-z]:\\.*?\.inf)", 1, CmdLine) | extend InfPath = iff(isempty(InfPath), "", InfPath) | extend InfFileName = extract(@"([^\\]+\.inf)$", 1, InfPath) | project TimeGenerated, DeviceName, InitiatingProcessId, InitiatingProcessFileName, CmdLine, InfPath, InfFileName

DeviceProcessEvents | where ProcessCommandLine contains "pnputil.exe" and ProcessCommandLine contains "add-driver" | extend InfFileName = extract("add-driver\\s+([^\\s]+)", 1, ProcessCommandLine) | project Timestamp, DeviceName, ProcessCommandLine, InfFileName | order by Timestamp desc

DeviceProcessEvents | where ProcessCommandLine contains 'pnputil' and ProcessCommandLine contains '/add-driver' | extend INF_File = extract(@'/add-driver\s+([^\s]+\.inf)', 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, INF_File | order by TimeGenerated desc

DeviceProcessEvents | where ActionType in ("Create", "ProcessCreated") | where ProcessCommandLine has "add-driver" | where ProcessCommandLine has_any ("dism", "pnputil") | extend INFFile = extract(@'([A-Za-z]?:\\[^\s]+\.inf)', 0, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, INFFile | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where tolower(ProcessCommandLine) has "add-driver" and tolower(ProcessCommandLine) has ".inf" | extend InfFile = extract(@"(\\S+\\.inf)", 1, tolower(ProcessCommandLine)) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InfFile

DeviceProcessEvents | where InitiatingProcessCommandLine has "add-driver" | extend INFFile = extract("(?i)/add-driver\\s+([^\\s]+\\.inf)", 1, InitiatingProcessCommandLine) | where isnotempty(INFFile) | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, INFFile | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains "add-driver" and ProcessCommandLine contains ".inf" | extend INFFile = extract(@"(\S+\.inf)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, INFFile | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName has_any ("pnputil.exe", "dism.exe", "devcon.exe") | where ProcessCommandLine contains ".inf" | extend InfFile = extract(@"(?i)([^\s]+\.inf)", 1, ProcessCommandLine) | where isnotempty(InfFile) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine, InfFile

DeviceProcessEvents | where FileName in ("pnputil.exe", "dism.exe") and (ProcessCommandLine has "add-driver" or ProcessCommandLine has "/add-driver") | extend InfFile = extract(@"(?i)(?:add-driver|/add-driver)\s+""?([^""\s]+\.inf)""?", 1, ProcessCommandLine) | where isnotempty(InfFile) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InfFile