Question Analysis

DeviceProcessEvents | where ProcessCommandLine has_any('curl', 'wget') and ProcessCommandLine contains 'bash' | extend ScriptUrl = tostring(split(ProcessCommandLine, '|')[0]) | extend ScriptName = tostring(split(ScriptUrl, '/')[array_length(split(ScriptUrl, '/')) - 1]) | project DeviceName, FileName, ProcessCommandLine, ScriptUrl, ScriptName

DeviceProcessEvents | where ProcessCommandLine contains @"curl" or ProcessCommandLine contains @"wget" | where ProcessCommandLine contains @"raw.githubusercontent.com" | where ProcessCommandLine contains @"bash" or ProcessCommandLine contains @"| bash" | extend ScriptUrl = extract(@"https?://raw\.githubusercontent\.com[^\s|]+", 0, ProcessCommandLine) | extend ScriptName = extract(@"[^/]+$", 0, ScriptUrl) | project TimeGenerated, DeviceName, ProcessCommandLine, ScriptUrl, ScriptName | distinct ScriptName, DeviceName, TimeGenerated, ProcessCommandLine, ScriptUrl

DeviceProcessEvents | where InitiatingProcessCommandLine contains "curl" or InitiatingProcessCommandLine contains "wget" | where InitiatingProcessCommandLine matches regex @"https:\/\/raw.githubusercontent.com\/.*\.sh" and InitiatingProcessCommandLine contains "bash" | extend ScriptName = extract(@"[\w-]+\.sh", 0, InitiatingProcessCommandLine) | project Timestamp, DeviceId, DeviceName, InitiatingProcessCommandLine, ScriptName

DeviceProcessEvents | where ProcessCommandLine contains 'curl' or ProcessCommandLine contains 'wget' | where ProcessCommandLine contains 'github' | where ProcessCommandLine contains '| bash' | extend ScriptName = extract('.*\\/([^\\/\\?\\s]+)', 1, ProcessCommandLine) | project Timestamp, DeviceName, ProcessCommandLine, ScriptName | order by Timestamp desc

DeviceProcessEvents | where ProcessCommandLine matches regex @'\bcurl\b.*\|\b.*\bbash\b' or ProcessCommandLine matches regex @'\bwget\b.*\|\b.*\bbash\b' | extend FullURL = extract(@'(https?://[^\s|]+)', 1, ProcessCommandLine) | extend arr = split(FullURL, '/') | extend ScriptName = arr[array_length(arr) - 1] | project TimeGenerated, DeviceName, ProcessCommandLine, ScriptName | summarize ScriptNames = make_set(ScriptName) by DeviceName

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has_any ("curl", "wget") | where ProcessCommandLine has "raw.githubusercontent.com" and ProcessCommandLine has "bash" | extend DownloadedUrl = extract(@"(https?:\/\/[^\s|]+)", 0, ProcessCommandLine) | extend ScriptName = extract(@"\/([^\/\?]+)(\?.*)?$", 1, DownloadedUrl) | project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine, DownloadedUrl, ScriptName | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by DeviceId, DeviceName, AccountName, ScriptName | order by EndTime desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where tolower(InitiatingProcessCommandLine) has_any ("curl", "wget") and tolower(InitiatingProcessCommandLine) has "raw.githubusercontent.com" and tolower(InitiatingProcessCommandLine) has "| bash" | extend ScriptName = extract(@"raw\.githubusercontent\.com[^ ]+/(?<script>[^ ]+)", 1, tolower(InitiatingProcessCommandLine)) | project Timestamp, DeviceName, InitiatingProcessCommandLine, ScriptName | order by Timestamp desc

DeviceProcessEvents | where ProcessCommandLine has_any ("curl", "wget") | where ProcessCommandLine contains "raw.githubusercontent.com" | where ProcessCommandLine contains "| bash" | extend ScriptName = extract(@"https?://raw\.githubusercontent\.com/[^/]+/[^/]+/[^/]+/([^ \|]+)", 1, ProcessCommandLine) | where isnotempty(ScriptName) | summarize Occurrences = count() by ScriptName, ProcessCommandLine | order by Occurrences desc

DeviceProcessEvents | where ProcessCommandLine has_any ("curl", "wget") | where ProcessCommandLine contains "raw.githubusercontent.com" | where ProcessCommandLine contains "bash" | extend ScriptName = extract(@"raw\.githubusercontent\.com/\S+/([^/]+\.sh)", 1, ProcessCommandLine) | where isnotempty(ScriptName) | distinct ScriptName

DeviceProcessEvents | where TimeGenerated between (startofday(ago(7d)) .. now()) // timerange will be set by the external control | where ProcessCommandLine has_any ("curl", "wget") | where ProcessCommandLine contains "raw.githubusercontent.com" | where ProcessCommandLine contains "bash" or ProcessCommandLine contains "|" // Extract the raw.githubusercontent.com URL | extend DownloadUrl = extract(@"(https?://raw\.githubusercontent\.com/[^\s|]+)", 1, ProcessCommandLine) | where isnotempty(DownloadUrl) // Parse out the script name (last segment of the URL) | extend ScriptName = tostring(split(DownloadUrl, "/")[array_length(split(DownloadUrl, "/")) - 1]) | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, DownloadUrl, ScriptName | sort by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" // Only look for curl or wget invocations | where ProcessCommandLine contains "curl" or ProcessCommandLine contains "wget" // Focus on raw GitHub URLs | where ProcessCommandLine contains "raw.githubusercontent.com" // Extract the full URL being fetched | extend DownloadUrl = extract(@"(https?://raw\.githubusercontent\.com/[^\s'""\|]+)", 1, ProcessCommandLine) | where isnotempty(DownloadUrl) // Derive the script name from the URL by taking the last path segment | extend ScriptName = tostring(split(DownloadUrl, "/")[-1]) // Filter for typical shell script extensions | where ScriptName endswith ".sh" or ScriptName endswith ".bash" // Summarize by script name to see which scripts were pulled and executed | summarize Count = count() by ScriptName | sort by Count desc