An attacker is suspected of using the Windows shell to enumerate a user’s Internet Explorer bookmarks via the Favorites folder. Identify the exact command they executed to perform this listing.

DeviceProcessEvents
| where InitiatingProcessFileName in ("cmd.exe", "powershell.exe") or FileName in ("cmd.exe", "powershell.exe")
| where ProcessCommandLine has "Favorites" and (ProcessCommandLine has "dir" or ProcessCommandLine has "Get-ChildItem")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceProcessEvents
| where FileName == 'cmd.exe' or FileName == 'powershell.exe'
| where ProcessCommandLine contains 'Favorites'
| project DeviceName, AccountName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents
| where ProcessCommandLine has_any ('dir', 'ls', 'Get-ChildItem')
    and ProcessCommandLine has 'Favorites'
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "dir" and ProcessCommandLine has "%userprofile%" and ProcessCommandLine has "Favorites"
| distinct ProcessCommandLine, DeviceName, AccountName 
| extend timestamp = now(), AccountCustomEntity = AccountName, HostCustomEntity = DeviceName

DeviceProcessEvents
| where ProcessCommandLine has_any ("dir", "ls", "Get-ChildItem")
      and ProcessCommandLine contains "Favorites"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine contains 'Favorites' and (ProcessCommandLine contains 'dir' or ProcessCommandLine contains 'ls' or ProcessCommandLine contains 'Get-ChildItem')
| where ProcessCommandLine matches regex @'(?:dir\s+.*Favorites|ls\s+.*Favorites|Get-ChildItem\s+.*Favorites)'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine has 'dir' and ProcessCommandLine contains 'Favorites' 
| project TimeGenerated, DeviceName, ProcessCommandLine, AccountDomain, AccountName

let favorites_path_rx = @"(?i)(shell:favorites|%userprofile%\\favorites|\\users\\[^\\]+\\favorites|\\documents and settings\\[^\\]+\\favorites)";
let listing_cmd_rx  = @"(?i)\b(dir|tree|ls|gci|get-childitem|for)\b";
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex favorites_path_rx
| where ProcessCommandLine matches regex listing_cmd_rx
| project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ExactCommand=ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated asc

let procs = DeviceProcessEvents
| where isnotempty(ProcessCommandLine)
| project Source = "DeviceProcessEvents", Timestamp = Timestamp, DeviceName, AccountName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;

let devs = DeviceEvents
| where isnotempty(ProcessCommandLine)
| project Source = "DeviceEvents", Timestamp = Timestamp, DeviceName, AccountName, FileName, ProcessId = coalesce(ProcessId, 0), ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;

procs
| union devs
| where tolower(ProcessCommandLine) has_any ("favorites", ".url", ".htm", ".html", "get-childitem", "gci", "dir", "tree", "ls", "attrib", "select-string", "for /f", "/s", "/b")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","explorer.exe","wscript.exe","cscript.exe","rundll32.exe","mshta.exe")
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Count = count(), AnyProcessId = any(ProcessId), AnyInitiatingProcess = any(InitiatingProcessFileName) by ProcessCommandLine, FileName, DeviceName, AccountName
| order by LastSeen desc, Count desc
| take 200
| project FirstSeen, LastSeen, Count, DeviceName, AccountName, FileName, AnyProcessId, AnyInitiatingProcess, ProcessCommandLine

// Look for processes that explicitly reference the Favorites folder AND contain directory-listing verbs/flags
let listing_keywords = dynamic(["dir","tree","ls","gci","get-childitem","get-child","/s","/r","/b","/a","-recurse","--recursive","-name","/ad","/o","/w","/?"]);

let search_proc = DeviceProcessEvents
| where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine)
| extend Cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine))
| where tolower(Cmd) has "favorites"
| where tolower(Cmd) has_any(listing_keywords)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, ProcessId, ExactCommand = Cmd, ProcessCommandLine, InitiatingProcessCommandLine, FileName, FolderPath;

let search_dev = DeviceEvents
| where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine)
| extend Cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine))
| where tolower(Cmd) has "favorites"
| where tolower(Cmd) has_any(listing_keywords)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, ProcessId, ExactCommand = Cmd, ProcessCommandLine, InitiatingProcessCommandLine, FileName, FolderPath;

let search_file = DeviceFileEvents
| where isnotempty(InitiatingProcessCommandLine)
| extend Cmd = tostring(InitiatingProcessCommandLine)
| where tolower(Cmd) has "favorites" or tolower(FolderPath) has "favorites" or tolower(FileName) has "favorites"
| where tolower(Cmd) has_any(listing_keywords)
| project TimeGenerated, DeviceName, AccountDomain = InitiatingProcessAccountDomain, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, ProcessId = InitiatingProcessId, ExactCommand = Cmd, ProcessCommandLine = Cmd, InitiatingProcessCommandLine = Cmd, FileName, FolderPath;

search_proc
| union search_dev, search_file
| order by TimeGenerated desc
| distinct ExactCommand, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, ProcessId, TimeGenerated
| take 100

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine contains 'Favorites'
| where InitiatingProcessFileName in ('cmd.exe', 'powershell.exe')
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

DeviceProcessEvents
| where ProcessCommandLine contains 'Favorites' and ProcessCommandLine contains 'dir'
| project Timestamp, DeviceName, ProcessCommandLine
| order by Timestamp desc
| limit 10

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine has "dir" and ProcessCommandLine has "Favorites"
// Optionally include shell references if relevant:
//| where ProcessCommandLine has "shell:favorites"
| project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ "cmd.exe" or FileName =~ "powershell.exe"
| where ProcessCommandLine has_all ("dir", "Favorites")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Time range placeholder – will be supplied by the calling function
DeviceProcessEvents
| where FileName in~ ("cmd.exe", "powershell.exe")
// Shell commands commonly used to enumerate directory contents
| where ProcessCommandLine has_any ("dir", "Get-ChildItem", "gci", "ls")
// Must also reference the Internet Explorer Favorites folder (literal or env-var form)
| where ProcessCommandLine has_any ("\\Favorites", "%userprofile%\\Favorites", " %userprofile% %", "\"Favorites\"")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated asc

DeviceProcessEvents
| where ProcessCommandLine has "\\Favorites"
| where FileName in ("cmd.exe", "powershell.exe")
| where ProcessCommandLine matches regex @"(?i)\b(dir|ls|tree|get-childitem)\b"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine

DeviceProcessEvents
| where FileName in~ ("cmd.exe", "powershell.exe", "explorer.exe")
| where ProcessCommandLine has "Favorites"
| where ProcessCommandLine matches regex @"\b(dir|tree|ls|Get-ChildItem)\b.*Favorites"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
| sort by TimeGenerated asc