Question Analysis

DeviceProcessEvents | where InitiatingProcessFileName in ("cmd.exe", "powershell.exe") or FileName in ("cmd.exe", "powershell.exe") | where ProcessCommandLine has "Favorites" and (ProcessCommandLine has "dir" or ProcessCommandLine has "Get-ChildItem") | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceProcessEvents | where FileName == 'cmd.exe' or FileName == 'powershell.exe' | where ProcessCommandLine contains 'Favorites' | project DeviceName, AccountName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where ProcessCommandLine has_any ('dir', 'ls', 'Get-ChildItem') and ProcessCommandLine has 'Favorites' | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where Timestamp > ago(7d) | where ProcessCommandLine has "dir" and ProcessCommandLine has "%userprofile%" and ProcessCommandLine has "Favorites" | distinct ProcessCommandLine, DeviceName, AccountName | extend timestamp = now(), AccountCustomEntity = AccountName, HostCustomEntity = DeviceName

DeviceProcessEvents | where ProcessCommandLine has_any ("dir", "ls", "Get-ChildItem") and ProcessCommandLine contains "Favorites" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains 'Favorites' and (ProcessCommandLine contains 'dir' or ProcessCommandLine contains 'ls' or ProcessCommandLine contains 'Get-ChildItem') | where ProcessCommandLine matches regex @'(?:dir\s+.*Favorites|ls\s+.*Favorites|Get-ChildItem\s+.*Favorites)' | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has 'dir' and ProcessCommandLine contains 'Favorites' | project TimeGenerated, DeviceName, ProcessCommandLine, AccountDomain, AccountName

let favorites_path_rx = @"(?i)(shell:favorites|%userprofile%\\favorites|\\users\\[^\\]+\\favorites|\\documents and settings\\[^\\]+\\favorites)"; let listing_cmd_rx = @"(?i)\b(dir|tree|ls|gci|get-childitem|for)\b"; DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe") | where ProcessCommandLine matches regex favorites_path_rx | where ProcessCommandLine matches regex listing_cmd_rx | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ExactCommand=ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated asc

let procs = DeviceProcessEvents | where isnotempty(ProcessCommandLine) | project Source = "DeviceProcessEvents", Timestamp = Timestamp, DeviceName, AccountName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine; let devs = DeviceEvents | where isnotempty(ProcessCommandLine) | project Source = "DeviceEvents", Timestamp = Timestamp, DeviceName, AccountName, FileName, ProcessId = coalesce(ProcessId, 0), ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine; procs | union devs | where tolower(ProcessCommandLine) has_any ("favorites", ".url", ".htm", ".html", "get-childitem", "gci", "dir", "tree", "ls", "attrib", "select-string", "for /f", "/s", "/b") | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","explorer.exe","wscript.exe","cscript.exe","rundll32.exe","mshta.exe") | summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Count = count(), AnyProcessId = any(ProcessId), AnyInitiatingProcess = any(InitiatingProcessFileName) by ProcessCommandLine, FileName, DeviceName, AccountName | order by LastSeen desc, Count desc | take 200 | project FirstSeen, LastSeen, Count, DeviceName, AccountName, FileName, AnyProcessId, AnyInitiatingProcess, ProcessCommandLine

// Look for processes that explicitly reference the Favorites folder AND contain directory-listing verbs/flags let listing_keywords = dynamic(["dir","tree","ls","gci","get-childitem","get-child","/s","/r","/b","/a","-recurse","--recursive","-name","/ad","/o","/w","/?"]); let search_proc = DeviceProcessEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | extend Cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine)) | where tolower(Cmd) has "favorites" | where tolower(Cmd) has_any(listing_keywords) | project TimeGenerated, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, ProcessId, ExactCommand = Cmd, ProcessCommandLine, InitiatingProcessCommandLine, FileName, FolderPath; let search_dev = DeviceEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | extend Cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine)) | where tolower(Cmd) has "favorites" | where tolower(Cmd) has_any(listing_keywords) | project TimeGenerated, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, ProcessId, ExactCommand = Cmd, ProcessCommandLine, InitiatingProcessCommandLine, FileName, FolderPath; let search_file = DeviceFileEvents | where isnotempty(InitiatingProcessCommandLine) | extend Cmd = tostring(InitiatingProcessCommandLine) | where tolower(Cmd) has "favorites" or tolower(FolderPath) has "favorites" or tolower(FileName) has "favorites" | where tolower(Cmd) has_any(listing_keywords) | project TimeGenerated, DeviceName, AccountDomain = InitiatingProcessAccountDomain, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, ProcessId = InitiatingProcessId, ExactCommand = Cmd, ProcessCommandLine = Cmd, InitiatingProcessCommandLine = Cmd, FileName, FolderPath; search_proc | union search_dev, search_file | order by TimeGenerated desc | distinct ExactCommand, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, ProcessId, TimeGenerated | take 100

DeviceProcessEvents | where TimeGenerated > ago(30d) | where ProcessCommandLine contains 'Favorites' | where InitiatingProcessFileName in ('cmd.exe', 'powershell.exe') | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

DeviceProcessEvents | where ProcessCommandLine contains 'Favorites' and ProcessCommandLine contains 'dir' | project Timestamp, DeviceName, ProcessCommandLine | order by Timestamp desc | limit 10

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "dir" and ProcessCommandLine has "Favorites" // Optionally include shell references if relevant: //| where ProcessCommandLine has "shell:favorites" | project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "cmd.exe" or FileName =~ "powershell.exe" | where ProcessCommandLine has_all ("dir", "Favorites") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

// Time range placeholder – will be supplied by the calling function DeviceProcessEvents | where FileName in~ ("cmd.exe", "powershell.exe") // Shell commands commonly used to enumerate directory contents | where ProcessCommandLine has_any ("dir", "Get-ChildItem", "gci", "ls") // Must also reference the Internet Explorer Favorites folder (literal or env-var form) | where ProcessCommandLine has_any ("\\Favorites", "%userprofile%\\Favorites", " %userprofile% %", "\"Favorites\"") | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated asc

DeviceProcessEvents | where ProcessCommandLine has "\\Favorites" | where FileName in ("cmd.exe", "powershell.exe") | where ProcessCommandLine matches regex @"(?i)\b(dir|ls|tree|get-childitem)\b" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine

DeviceProcessEvents | where FileName in~ ("cmd.exe", "powershell.exe", "explorer.exe") | where ProcessCommandLine has "Favorites" | where ProcessCommandLine matches regex @"\b(dir|tree|ls|Get-ChildItem)\b.*Favorites" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine | sort by TimeGenerated asc