Identify the PowerShell cmdlet used on Windows to format and display the raw volume bytes after an attacker read the boot sector via a DOS device path.

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "\\.\\" and (ProcessCommandLine has "PhysicalDrive" or ProcessCommandLine has ":")
| where ProcessCommandLine has_any ("format-hex", "[byte]", "get-content", "-encoding byte", "convertto-hex")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
// Cmdlet that formats/displays raw bytes
| where ProcessCommandLine has_any ("format-hex", "fhx")
// Evidence of DOS device path usage (boot sector/raw volume access)
| where ProcessCommandLine matches regex @'(?i)\\\\\.\\(physicaldrive\d+|[a-z]:|harddisk\d+\\partition\d+|globalroot\\device\\harddisk\d+(\\partition\d+)?)'
| extend UsedCmdlet = extract(@'(?i)\b(format-hex|fhx)\b', 1, ProcessCommandLine)
| extend DosDeviceTarget = extract(@'(?i)(\\\\\.\\(?:physicaldrive\d+|[a-z]:|harddisk\d+\\partition\d+|globalroot\\device\\harddisk\d+(?:\\partition\d+)?))', 1, ProcessCommandLine)
| summarize EventCount = count(), Devices = dcount(DeviceId), Accounts = dcount(AccountSid), SampleCommands = make_set(ProcessCommandLine, 5), SampleTargets = make_set(DosDeviceTarget, 5) by UsedCmdlet
| order by EventCount desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents
| extend PCmd = tostring(ProcessCommandLine), IPcmd = tostring(InitiatingProcessCommandLine)
| extend PCmdL = tolower(PCmd), IPcmdL = tolower(IPcmd)
// look for Format-Hex (PowerShell) and evidence of DOS device/raw volume access (\\.\ or physicaldrive)
| where (PCmdL contains "format-hex" or PCmdL contains "formathex" or IPcmdL contains "format-hex" or IPcmdL contains "formathex")
  and (PCmdL contains "\\\\.\\" or IPcmdL contains "\\\\.\\" or PCmdL contains "physicaldrive" or IPcmdL contains "physicaldrive")
| project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain = AccountDomain, FileName, ProcessId, InitiatingProcessId, ProcessCommandLine = PCmd, InitiatingProcessCommandLine = IPcmd, ReportId, SourceSystem
| sort by TimeGenerated desc
| take 100

DeviceProcessEvents
| where InitiatingProcessFileName =~ 'powershell.exe'
| where ProcessCommandLine has_any ('Format-Hex', '\\.\\', 'Read', 'Boot', 'Sector', 'Volume', 'Raw', 'Bytes')
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

DeviceProcessEvents
| where FileName == 'powershell.exe'
| where ProcessCommandLine contains 'PhysicalDrive' or ProcessCommandLine contains '\\.\\' or ProcessCommandLine contains 'boot sector'
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
| order by TimeGenerated desc
| limit 100

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName endswith "powershell.exe"
| where ProcessCommandLine has "Format-Hex"
| where ProcessCommandLine has_any("\\.\\PhysicalDrive", "\\.\\C:")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

// Suspicious raw-disk read piped to a formatting cmdlet
DeviceProcessEvents
| where ActionType == "ProcessCreated" // process start events only
| where FileName has_any ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
| where ProcessCommandLine has "\\.\\"                              // DOS device path indicator
| where ProcessCommandLine matches regex @"(?i)\\\.\\(PhysicalDrive|Volume|[A-Z]:)" // typical raw volume paths
| where ProcessCommandLine contains_cs "Format-Hex" or ProcessCommandLine contains "format-hex" // cmdlet of interest
// Pull out the cmdlet to make it explicit
| extend CmdletUsed = extract(@"(?i)(Format-Hex)", 1, ProcessCommandLine)
| project TimeGenerated,
          DeviceName,
          DeviceId,
          AccountDomain,
          AccountName,
          FileName,
          ProcessCommandLine,
          CmdletUsed,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          SHA256,
          ProcessId
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where tolower(ProcessCommandLine) contains "format-hex"
| where tolower(ProcessCommandLine) contains "\\.\\"
| project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "Format-Hex"
// Optionally narrow to DOS device paths
| where ProcessCommandLine has "\\.\\"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine