Question Analysis

DeviceProcessEvents | where ProcessCommandLine has "PowerShell" and ProcessCommandLine has "RegisterByXml" | extend XmlFileName = tostring(AdditionalFields.XmlFileName) | project TimeGenerated, ProcessId, ProcessCommandLine, XmlFileName

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has "RegisterByXml" or ProcessCommandLine has "RegisterTaskDefinition" or ProcessCommandLine has "RegisterTask" | where ProcessCommandLine has ".xml" | extend XMLFileName = extract(@"([\w\d:\\/_\-\.]+\.xml)", 1, ProcessCommandLine) | where isnotempty(XMLFileName) | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, XMLFileName

let pwsh_bins = dynamic(["powershell.exe","pwsh.exe","powershell_ise.exe"]); let task_ns1 = @"root\microsoft\windows\taskscheduler"; let ps_wmi_calls = DeviceEvents | where (ActionType in~ ("WmiMethodInvoked","WmiMethodCall","WmiMethodExecuted")) or (tolower(ActionType) has "wmi" and tolower(ActionType) has "method") | where InitiatingProcessFileName in~ (pwsh_bins) | extend MethodName = tolower(coalesce(tostring(AdditionalFields.MethodName), tostring(AdditionalFields.Method), tostring(AdditionalFields["methodName"]))) | extend WmiNamespace = tolower(coalesce(tostring(AdditionalFields.Namespace), tostring(AdditionalFields["NameSpace"]), tostring(AdditionalFields["WmiNamespace"]))) | where MethodName == "registerbyxml" and (isempty(WmiNamespace) or WmiNamespace has task_ns1) | project TimeGenerated, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine; let ps_cmd_matches = DeviceProcessEvents | where FileName in~ (pwsh_bins) | where (ProcessCommandLine has_cs "RegisterByXml" or InitiatingProcessCommandLine has_cs "RegisterByXml") | project TimeGenerated, DeviceId, DeviceName, InitiatingProcessFileName=FileName, InitiatingProcessId=ProcessId, InitiatingProcessCommandLine=coalesce(ProcessCommandLine, InitiatingProcessCommandLine); union ps_wmi_calls, ps_cmd_matches | extend Cmd = InitiatingProcessCommandLine // Extract XML path or bare filename from the PowerShell command line | extend xml_candidates = extract_all(@"(?i)(?:['""])?((?:[A-Z]:\\|\\\\)[^'""\s]+\.xml)", Cmd) | extend xml_names = extract_all(@"(?i)([^\\/:'""\s]+\.xml)", Cmd) | extend xml_token = case(array_length(xml_candidates) > 0, tostring(xml_candidates[0]), array_length(xml_names) > 0, tostring(xml_names[0]), "") | extend XmlFileName = tostring(extract(@"([^\\/:]+\.xml)", 1, xml_token)) | where isnotempty(XmlFileName) | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Devices=make_set(DeviceName, 10) by XmlFileName | order by Events desc, LastSeen desc

// Find PowerShell processes that reference RegisterByXml or mention .xml, extract XML names and correlate with .xml file events let process_candidates = DeviceProcessEvents | where tolower(ProcessCommandLine) contains "powershell" or tolower(FileName) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh" | where ProcessCommandLine contains "RegisterByXml" or ProcessCommandLine contains ".xml" or tostring(AdditionalFields) contains "RegisterByXml" or tostring(AdditionalFields) contains ".xml" | extend XmlMatches = extract_all(@"([^\s]+\.xml)", ProcessCommandLine) | mv-expand XmlFile = XmlMatches to typeof(string) | project ProcTime=Timestamp, DeviceName, DeviceId, ProcessId, InitiatingProcessId, Account=AccountName, ProcessCommandLine, XmlFile; let file_events = DeviceFileEvents | where tolower(FileName) endswith ".xml" | where tolower(InitiatingProcessFileName) contains "powershell" or tolower(InitiatingProcessCommandLine) contains "powershell" or tolower(InitiatingProcessCommandLine) contains "pwsh" | project FileTime=Timestamp, DeviceName, DeviceId, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId; let device_events_xml = DeviceEvents | where tostring(AdditionalFields) contains "RegisterByXml" or tostring(AdditionalFields) contains ".xml" | extend XmlMatches = extract_all(@"([^\s]+\.xml)", tostring(AdditionalFields)) | mv-expand XmlFile = XmlMatches to typeof(string) | project EvTime=Timestamp, DeviceName, DeviceId, ProcessCommandLine, XmlFile, Account=AccountName; process_candidates | join kind=leftouter (file_events) on DeviceId | where isnotempty(XmlFile) or (isnotnull(FileTime) and abs(datetime_diff('second', ProcTime, FileTime)) <= 120) | extend ObservedXml = iff(isnotempty(XmlFile), XmlFile, FileName) | project DeviceName, Account, ProcessId, InitiatingProcessId, ProcTime, FileTime, ObservedXml, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath | union (device_events_xml | project DeviceName, Account, ProcessId=long(null), InitiatingProcessId=long(null), ProcTime=EvTime, FileTime=EvTime, ObservedXml=XmlFile, ProcessCommandLine, InitiatingProcessFileName="", InitiatingProcessCommandLine="", FolderPath="") | where isnotempty(ObservedXml) | summarize FirstSeen=min(ProcTime), LastSeen=max(ProcTime), AnyCommands = make_set(ProcessCommandLine,5), FileEvents = make_set(pack('File',ObservedXml,'Folder',FolderPath,'InitiatingCmd',InitiatingProcessCommandLine),20) by DeviceName, Account, ObservedXml | order by FirstSeen desc | take 200

// Investigate PowerShell activity leveraging WMI to register a scheduled task via XML import DeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has "RegisterByXml" | extend XmlFileName = extract(@"(?i)([A-Z]:\\[\w\\.\-]+\.xml)", 1, ProcessCommandLine) | project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine, XmlFileName | order by TimeGenerated desc

// ------------- PowerShell using WMI RegisterByXml (scheduled-task import) ------------- // Time range is controlled by the hunting UI – no explicit time filter is added here. DeviceProcessEvents // 1. Limit to the various PowerShell interpreters | where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") // 2. Command line must show the WMI method plus an XML reference | where ProcessCommandLine has "RegisterByXml" and ProcessCommandLine has ".xml" // 3. Try to extract the XML path // 3a. 1st attempt – a normal absolute path (e.g. C:\Temp\task.xml) | extend xmlPath = extract(@'([A-Za-z]:\\[^\s''"<>]+?\.xml)', 1, ProcessCommandLine) // 3b. Fallback – grab the first token that simply ends with .xml (covers relative paths, URLs, vars, etc.) | extend xmlPath = iff(isnull(xmlPath) or xmlPath == "", extract(@'(\S+?\.xml)', 1, ProcessCommandLine), xmlPath) // 4. Pull out just the file name so we can answer the analyst’s question | extend xmlFile = tostring(split(xmlPath, "\\")[-1]) // 5. Return concise context around each occurrence | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ExecCount = count() by DeviceName, AccountName, xmlFile, xmlPath, ProcessCommandLine | order by LastSeen desc