Question Analysis

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has "\\.\\" and (ProcessCommandLine has "PhysicalDrive" or ProcessCommandLine has ":") | where ProcessCommandLine has_any ("format-hex", "[byte]", "get-content", "-encoding byte", "convertto-hex") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") // Cmdlet that formats/displays raw bytes | where ProcessCommandLine has_any ("format-hex", "fhx") // Evidence of DOS device path usage (boot sector/raw volume access) | where ProcessCommandLine matches regex @'(?i)\\\\\.\\(physicaldrive\d+|[a-z]:|harddisk\d+\\partition\d+|globalroot\\device\\harddisk\d+(\\partition\d+)?)' | extend UsedCmdlet = extract(@'(?i)\b(format-hex|fhx)\b', 1, ProcessCommandLine) | extend DosDeviceTarget = extract(@'(?i)(\\\\\.\\(?:physicaldrive\d+|[a-z]:|harddisk\d+\\partition\d+|globalroot\\device\\harddisk\d+(?:\\partition\d+)?))', 1, ProcessCommandLine) | summarize EventCount = count(), Devices = dcount(DeviceId), Accounts = dcount(AccountSid), SampleCommands = make_set(ProcessCommandLine, 5), SampleTargets = make_set(DosDeviceTarget, 5) by UsedCmdlet | order by EventCount desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents | extend PCmd = tostring(ProcessCommandLine), IPcmd = tostring(InitiatingProcessCommandLine) | extend PCmdL = tolower(PCmd), IPcmdL = tolower(IPcmd) // look for Format-Hex (PowerShell) and evidence of DOS device/raw volume access (\\.\ or physicaldrive) | where (PCmdL contains "format-hex" or PCmdL contains "formathex" or IPcmdL contains "format-hex" or IPcmdL contains "formathex") and (PCmdL contains "\\\\.\\" or IPcmdL contains "\\\\.\\" or PCmdL contains "physicaldrive" or IPcmdL contains "physicaldrive") | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain = AccountDomain, FileName, ProcessId, InitiatingProcessId, ProcessCommandLine = PCmd, InitiatingProcessCommandLine = IPcmd, ReportId, SourceSystem | sort by TimeGenerated desc | take 100

DeviceProcessEvents | where InitiatingProcessFileName =~ 'powershell.exe' | where ProcessCommandLine has_any ('Format-Hex', '\\.\\', 'Read', 'Boot', 'Sector', 'Volume', 'Raw', 'Bytes') | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc

DeviceProcessEvents | where FileName == 'powershell.exe' | where ProcessCommandLine contains 'PhysicalDrive' or ProcessCommandLine contains '\\.\\' or ProcessCommandLine contains 'boot sector' | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc | limit 100

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName endswith "powershell.exe" | where ProcessCommandLine has "Format-Hex" | where ProcessCommandLine has_any("\\.\\PhysicalDrive", "\\.\\C:") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

// Suspicious raw-disk read piped to a formatting cmdlet DeviceProcessEvents | where ActionType == "ProcessCreated" // process start events only | where FileName has_any ("powershell.exe", "pwsh.exe", "powershell_ise.exe") | where ProcessCommandLine has "\\.\\" // DOS device path indicator | where ProcessCommandLine matches regex @"(?i)\\\.\\(PhysicalDrive|Volume|[A-Z]:)" // typical raw volume paths | where ProcessCommandLine contains_cs "Format-Hex" or ProcessCommandLine contains "format-hex" // cmdlet of interest // Pull out the cmdlet to make it explicit | extend CmdletUsed = extract(@"(?i)(Format-Hex)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, DeviceId, AccountDomain, AccountName, FileName, ProcessCommandLine, CmdletUsed, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ProcessId | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "powershell.exe" | where tolower(ProcessCommandLine) contains "format-hex" | where tolower(ProcessCommandLine) contains "\\.\\" | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has "Format-Hex" // Optionally narrow to DOS device paths | where ProcessCommandLine has "\\.\\" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine