Question Analysis

DeviceProcessEvents | where ProcessCommandLine has_any ('net time', 'w32tm') | distinct InitiatingProcessFileName

DeviceProcessEvents | where FileName in~ ('net.exe', 'w32tm.exe') | summarize count() by InitiatingProcessFileName

DeviceProcessEvents | where FileName in~ ('net.exe', 'w32tm.exe') | extend ExecutorName = InitiatingProcessFileName | summarize Count = count() by ExecutorName | sort by Count desc

DeviceProcessEvents | where ProcessCommandLine has_any ("net time", "w32tm") | project TimeGenerated, Executor=InitiatingProcessFileName, AccountName, DeviceName, Command=ProcessCommandLine | order by TimeGenerated asc | extend test_config_executor_name = Executor // Renaming a column for the answer format

DeviceProcessEvents | where FileName in ("net.exe", "w32tm.exe") | summarize by InitiatingProcessAccountName | project ExecutorName=InitiatingProcessAccountName

DeviceProcessEvents | where ProcessCommandLine contains "net time" or ProcessCommandLine contains "w32tm" | summarize count() by InitiatingProcessAccountName | order by count_ desc

DeviceProcessEvents | where FileName in ('net.exe', 'w32tm.exe') | project InitiatingProcessAccountName

let suspiciousNames = dynamic(["net.exe","net","w32tm.exe","w32tm"]); // Search primary process events DeviceProcessEvents | where FileName in ("net.exe","w32tm.exe","net","w32tm") // Also consider cases where cmd.exe or powershell executes these tools via command line or ProcessCommandLine has_any (" net time","\nw32tm "," w32tm ","/c net time","/c w32tm","powershell -command w32tm","pwsh -c w32tm") | extend targetTool = case(tolower(FileName) contains "w32tm","w32tm", tolower(FileName) contains "net","net", "other") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessParentId, targetTool | summarize Count = count(), Examples = take_any(pack_all()) by InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool | order by Count desc // Fallback to DeviceEvents for cases where DeviceProcessEvents may not capture | union ( DeviceEvents | where FileName in ("net.exe","w32tm.exe","net","w32tm") or ProcessCommandLine has_any (" net time"," w32tm ","/c net time","/c w32tm","powershell -command w32tm","pwsh -c w32tm") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, InitiatingProcessParentId | extend targetTool = iff(tolower(FileName) contains "w32tm","w32tm", iff(tolower(FileName) contains "net","net","other")) | summarize Count = count(), Examples = take_any(pack_all()) by InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool ) | summarize Count = sum(Count), Examples = make_list(Examples, 5) by InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool | order by Count desc | project InitiatingProcessAccountName, InitiatingProcessAccountDomain, targetTool, Count, Examples

// Find executions of 'net time' and 'w32tm' that show system time/timezone let cmds = dynamic(["net time","w32tm","w32tm /query","w32tm /tz","net time /domain"]); DeviceProcessEvents | where Timestamp between (startofday(datetime(1900-01-01)) .. now()) // The time range will be set by the function caller; keep broad filter for command patterns | where tolower(ProcessCommandLine) has_any ("net time","w32tm") or tolower(InitiatingProcessCommandLine) has_any ("net time","w32tm") or tolower(FileName) has_any ("net.exe","w32tm.exe","w32tm") | extend matchedCommand = case( tolower(ProcessCommandLine) has "w32tm", "w32tm", tolower(ProcessCommandLine) has "net time", "net time", tolower(InitiatingProcessCommandLine) has "w32tm", "w32tm", tolower(InitiatingProcessCommandLine) has "net time", "net time", tolower(FileName) has "w32tm", "w32tm", tolower(FileName) has "net", "net", "other") | project Timestamp, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, matchedCommand | where matchedCommand in ("w32tm","net time","net") | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count(), any_InitiatingProcessAccountName=any(InitiatingProcessAccountName), any_InitiatingProcessAccountDomain=any(InitiatingProcessAccountDomain) by InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, matchedCommand, DeviceName | order by FirstSeen asc // Fallback: also search DeviceEvents and DeviceFileEvents for command line or filenames | union ( DeviceEvents | where tolower(ProcessCommandLine) has_any ("net time","w32tm") or tolower(InitiatingProcessCommandLine) has_any ("net time","w32tm") or tolower(FileName) has_any ("net.exe","w32tm.exe","w32tm") | extend matchedCommand = iif(tolower(ProcessCommandLine) has "w32tm" or tolower(InitiatingProcessCommandLine) has "w32tm" or tolower(FileName) has "w32tm", "w32tm", "net time") | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId, matchedCommand ), ( DeviceFileEvents | where tolower(InitiatingProcessCommandLine) has_any ("net time","w32tm") or tolower(FileName) has_any ("net.exe","w32tm.exe","w32tm") | extend matchedCommand = iif(tolower(InitiatingProcessCommandLine) has "w32tm" or tolower(FileName) has "w32tm", "w32tm", "net time") | project Timestamp, DeviceName, FileName, ProcessCommandLine=InitiatingProcessCommandLine, InitiatingProcessFileName=InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName=InitiatingProcessAccountName, InitiatingProcessAccountDomain=InitiatingProcessAccountDomain, InitiatingProcessId, matchedCommand ) | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count(), any_InitiatingProcessAccountName=any(InitiatingProcessAccountName), any_InitiatingProcessAccountDomain=any(InitiatingProcessAccountDomain) by InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, matchedCommand, DeviceName | order by FirstSeen asc

(DeviceProcessEvents | where FileName has_any ("net.exe","w32tm.exe","cmd.exe","powershell.exe","pwsh.exe") | where ProcessCommandLine has_any ("net time","w32tm","/c net time","/c w32tm") | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessId ) | union ( DeviceEvents | where FileName has_any ("net.exe","w32tm.exe","cmd.exe","powershell.exe","pwsh.exe") | where ProcessCommandLine has_any ("net time","w32tm","/c net time","/c w32tm") | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName = InitiatingProcessAccountName, InitiatingProcessAccountDomain = InitiatingProcessAccountDomain, InitiatingProcessId = InitiatingProcessId ) | sort by TimeGenerated desc | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count() by InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessId | where Count > 0 | project InitiatorName = coalesce(InitiatingProcessAccountName, "<unknown>"), InitiatorDomain = InitiatingProcessAccountDomain, InitiatorProcess = InitiatingProcessFileName, InitiatorProcessId = InitiatingProcessId, FirstSeen, LastSeen, Count | order by LastSeen desc

DeviceProcessEvents | where InitiatingProcessFileName in ("net.exe","w32tm.exe") or FileName in ("net.exe","w32tm.exe") or (ProcessCommandLine contains "net time" or ProcessCommandLine contains "w32tm") | extend ExecutorName = coalesce(tostring(AdditionalFields.ExecutorName), InitiatingProcessAccountName) | where isnotempty(ExecutorName) | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, ExecutorName | summarize Occurrences = count() by ExecutorName, InitiatingProcessFileName, ProcessCommandLine, DeviceName | order by Occurrences desc

DeviceProcessEvents | where FileName in ('net.exe', 'w32tm.exe') | project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, ProcessCreationTime | order by Timestamp desc

DeviceProcessEvents | where ProcessCommandLine contains 'net time' or ProcessCommandLine contains 'w32tm' | summarize Executors = make_set(InitiatingProcessAccountName) by DeviceName | project DeviceName, Executors

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName in~ ("net.exe", "w32tm.exe") or ProcessCommandLine has_any ("net time", "w32tm") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has "net time" or InitiatingProcessCommandLine has "w32tm" | project TimeGenerated, InitiatingProcessAccountName, InitiatingProcessCommandLine, ProcessId | sort by TimeGenerated desc

DeviceProcessEvents | where tolower(FileName) in ("net.exe", "w32tm.exe") | extend ExecutorName = tostring(AdditionalFields.executor_name) | summarize Count = count() by ExecutorName | sort by Count desc

DeviceProcessEvents | where ProcessCommandLine contains "net time" or ProcessCommandLine contains "w32tm" | summarize Executions = count() by InitiatingProcessAccountName | order by Executions desc

DeviceProcessEvents | where ProcessCommandLine matches regex @"(?i)\b(?:net\s+time|w32tm)\b" | distinct InitiatingProcessAccountName