In Windows process event logs, you notice both the net time and w32tm commands being executed to display the system time and timezone. Which executor name from the test configuration was responsible for launching these utilities?

DeviceProcessEvents
| where ProcessCommandLine has_any ('net time', 'w32tm')
| distinct InitiatingProcessFileName

DeviceProcessEvents | where FileName in~ ('net.exe', 'w32tm.exe') | summarize count() by InitiatingProcessFileName

DeviceProcessEvents
| where FileName in~ ('net.exe', 'w32tm.exe')
| extend ExecutorName = InitiatingProcessFileName
| summarize Count = count() by ExecutorName
| sort by Count desc

DeviceProcessEvents
  | where ProcessCommandLine has_any ("net time", "w32tm")
  | project TimeGenerated, Executor=InitiatingProcessFileName, AccountName, DeviceName, Command=ProcessCommandLine
  | order by TimeGenerated asc
  | extend test_config_executor_name = Executor // Renaming a column for the answer format

DeviceProcessEvents
| where FileName in ("net.exe", "w32tm.exe")
| summarize by InitiatingProcessAccountName
| project ExecutorName=InitiatingProcessAccountName

DeviceProcessEvents
| where ProcessCommandLine contains "net time" or ProcessCommandLine contains "w32tm"
| summarize count() by InitiatingProcessAccountName
| order by count_ desc

DeviceProcessEvents
| where FileName in ('net.exe', 'w32tm.exe')
| project InitiatingProcessAccountName

let suspiciousNames = dynamic(["net.exe","net","w32tm.exe","w32tm"]);
// Search primary process events
DeviceProcessEvents
| where FileName in ("net.exe","w32tm.exe","net","w32tm")
// Also consider cases where cmd.exe or powershell executes these tools via command line
or ProcessCommandLine has_any (" net time","\nw32tm "," w32tm ","/c net time","/c w32tm","powershell -command w32tm","pwsh -c w32tm")
| extend targetTool = case(tolower(FileName) contains "w32tm","w32tm", tolower(FileName) contains "net","net", "other")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessParentId, targetTool
| summarize Count = count(), Examples = take_any(pack_all()) by InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool
| order by Count desc

// Fallback to DeviceEvents for cases where DeviceProcessEvents may not capture

| union (
    DeviceEvents
    | where FileName in ("net.exe","w32tm.exe","net","w32tm")
    or ProcessCommandLine has_any (" net time"," w32tm ","/c net time","/c w32tm","powershell -command w32tm","pwsh -c w32tm")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessParentId
    | extend targetTool = iff(tolower(FileName) contains "w32tm","w32tm", iff(tolower(FileName) contains "net","net","other"))
    | summarize Count = count(), Examples = take_any(pack_all()) by InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool
)
| summarize Count = sum(Count), Examples = make_list(Examples, 5) by InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool
| order by Count desc
| project InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool, Count, Examples

// Find executions of 'net time' and 'w32tm' that show system time/timezone
let cmds = dynamic(["net time","w32tm","w32tm /query","w32tm /tz","net time /domain"]);
DeviceProcessEvents
| where Timestamp between (startofday(datetime(1900-01-01)) .. now())
// The time range will be set by the function caller; keep broad filter for command patterns
| where tolower(ProcessCommandLine) has_any ("net time","w32tm") or tolower(InitiatingProcessCommandLine) has_any ("net time","w32tm") or tolower(FileName) has_any ("net.exe","w32tm.exe","w32tm")
| extend matchedCommand = case(
    tolower(ProcessCommandLine) has "w32tm", "w32tm",
    tolower(ProcessCommandLine) has "net time", "net time",
    tolower(InitiatingProcessCommandLine) has "w32tm", "w32tm",
    tolower(InitiatingProcessCommandLine) has "net time", "net time",
    tolower(FileName) has "w32tm", "w32tm",
    tolower(FileName) has "net", "net",
    "other")
| project Timestamp, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, matchedCommand
| where matchedCommand in ("w32tm","net time","net")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count(), any_InitiatingProcessAccountName=any(InitiatingProcessAccountName), any_InitiatingProcessAccountDomain=any(InitiatingProcessAccountDomain) by InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, matchedCommand, DeviceName
| order by FirstSeen asc

// Fallback: also search DeviceEvents and DeviceFileEvents for command line or filenames
| union (
    DeviceEvents
    | where tolower(ProcessCommandLine) has_any ("net time","w32tm") or tolower(InitiatingProcessCommandLine) has_any ("net time","w32tm") or tolower(FileName) has_any ("net.exe","w32tm.exe","w32tm")
    | extend matchedCommand = iif(tolower(ProcessCommandLine) has "w32tm" or tolower(InitiatingProcessCommandLine) has "w32tm" or tolower(FileName) has "w32tm", "w32tm", "net time")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, matchedCommand
), (
    DeviceFileEvents
    | where tolower(InitiatingProcessCommandLine) has_any ("net time","w32tm") or tolower(FileName) has_any ("net.exe","w32tm.exe","w32tm")
    | extend matchedCommand = iif(tolower(InitiatingProcessCommandLine) has "w32tm" or tolower(FileName) has "w32tm", "w32tm", "net time")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine=InitiatingProcessCommandLine, InitiatingProcessFileName=InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName=InitiatingProcessAccountName, InitiatingProcessAccountDomain=InitiatingProcessAccountDomain, InitiatingProcessId, matchedCommand
)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count(), any_InitiatingProcessAccountName=any(InitiatingProcessAccountName), any_InitiatingProcessAccountDomain=any(InitiatingProcessAccountDomain) by InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, matchedCommand, DeviceName
| order by FirstSeen asc

(DeviceProcessEvents
| where FileName has_any ("net.exe","w32tm.exe","cmd.exe","powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("net time","w32tm","/c net time","/c w32tm")
| project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId
)
| union (
DeviceEvents
| where FileName has_any ("net.exe","w32tm.exe","cmd.exe","powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("net time","w32tm","/c net time","/c w32tm")
| project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName = InitiatingProcessAccountName, InitiatingProcessAccountDomain = InitiatingProcessAccountDomain, InitiatingProcessId = InitiatingProcessId
)
| sort by TimeGenerated desc
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count() by InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessId
| where Count > 0
| project InitiatorName = coalesce(InitiatingProcessAccountName, "<unknown>"), InitiatorDomain = InitiatingProcessAccountDomain, InitiatorProcess = InitiatingProcessFileName, InitiatorProcessId = InitiatingProcessId, FirstSeen, LastSeen, Count
| order by LastSeen desc

DeviceProcessEvents
| where InitiatingProcessFileName in ("net.exe","w32tm.exe") or FileName in ("net.exe","w32tm.exe") or (ProcessCommandLine contains "net time" or ProcessCommandLine contains "w32tm")
| extend ExecutorName = coalesce(tostring(AdditionalFields.ExecutorName), InitiatingProcessAccountName)
| where isnotempty(ExecutorName)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, ExecutorName
| summarize Occurrences = count() by ExecutorName, InitiatingProcessFileName, ProcessCommandLine, DeviceName
| order by Occurrences desc

DeviceProcessEvents
| where FileName in ('net.exe', 'w32tm.exe')
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, ProcessCreationTime
| order by Timestamp desc

DeviceProcessEvents
| where ProcessCommandLine contains 'net time' or ProcessCommandLine contains 'w32tm'
| summarize Executors = make_set(InitiatingProcessAccountName) by DeviceName
| project DeviceName, Executors

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName in~ ("net.exe", "w32tm.exe") or ProcessCommandLine has_any ("net time", "w32tm")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessCommandLine has "net time" or InitiatingProcessCommandLine has "w32tm"
| project TimeGenerated, InitiatingProcessAccountName, InitiatingProcessCommandLine, ProcessId
| sort by TimeGenerated desc

DeviceProcessEvents
| where tolower(FileName) in ("net.exe", "w32tm.exe")
| extend ExecutorName = tostring(AdditionalFields.executor_name)
| summarize Count = count() by ExecutorName
| sort by Count desc

DeviceProcessEvents
| where ProcessCommandLine contains "net time" or ProcessCommandLine contains "w32tm"
| summarize Executions = count() by InitiatingProcessAccountName
| order by Executions desc

DeviceProcessEvents
| where ProcessCommandLine matches regex @"(?i)\b(?:net\s+time|w32tm)\b"
| distinct InitiatingProcessAccountName