Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine contains "|" and (ProcessCommandLine contains "findstr" or ProcessCommandLine contains "find.exe" or ProcessCommandLine contains "Select-String") | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains ' | findstr ' | project ExtractedProcessName = tostring(split(ProcessCommandLine, ' | findstr ')[0])

DeviceProcessEvents | where ActionType == 'ProcessCreated' and (InitiatingProcessCommandLine has 'dir' and InitiatingProcessCommandLine has 'findstr') | extend SearchedProcess = extract('findstr ["](.+?)["]', 1, InitiatingProcessCommandLine) | project DeviceName, InitiatingProcessCommandLine, SearchedProcess

DeviceProcessEvents | where ProcessCommandLine contains '| findstr' | extend searchedFor = extract(@'findstr "(.*?)"', 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, searchedFor | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName in~ ("cmd.exe", "powershell.exe") | where ProcessCommandLine has_any ("tasklist", "net", "wmic", "dir", "sc") | where ProcessCommandLine has_any ("| find", "| findstr") | extend AttackerSearch = extract(@'\|(?:\s*)find(?:str)?\s+(?:"([^"]+)"|(\S+))', 1, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, AttackerSearch | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has "tasklist" and InitiatingProcessCommandLine has "|" | where InitiatingProcessCommandLine has_any ("find", "findstr") | extend SearchedProcess = extract(@"(?i)\|\s*(?:findstr|find)\s+(?:/i\s+)?([^\s]+)", 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, SearchedProcess // Timerange will be set in function call.

DeviceProcessEvents | where isnotempty(InitiatingProcessCommandLine) | where InitiatingProcessCommandLine contains "dir" and (InitiatingProcessCommandLine contains "| find " or InitiatingProcessCommandLine contains "| findstr ") | extend SearchedProcess = extract('(?i)\\|\\s*(?:findstr|find)\\s+"([^"]+)"', 1, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, SearchedProcess | order by TimeGenerated desc

DeviceProcessEvents // Look for any command line containing a pipe | where ProcessCommandLine contains "|" // Ensure a built-in listing tool is used before the pipe | where ProcessCommandLine matches regex "(?i)\\b(?:dir|ls|Get-ChildItem|tasklist|wmic)\\b\\s*\\|" // Ensure a string filter is called after the pipe | where ProcessCommandLine matches regex "(?i)\\|\\s*(?:findstr|grep)\\b" // Extract the term passed to findstr or grep (first non-quoted token) | extend SearchedTerm = extract("(?i)(?:findstr|grep)\\s+['\\\"]?([^'\\\"]+)", 1, ProcessCommandLine) | where isnotempty(SearchedTerm) // Summarize by the searched term, showing count and example devices/accounts | summarize EventCount = count(), AffectedDevices = make_set(DeviceName, 10), AffectedUsers = make_set(InitiatingProcessAccountName, 10) by SearchedTerm | project SearchedTerm, EventCount, AffectedDevices, AffectedUsers | order by EventCount desc

DeviceProcessEvents | where ActionType == "ProcessCreated" // Identify invocations of built-in listing tools piped into findstr | where ProcessCommandLine has "|" and ProcessCommandLine has "findstr" | where ProcessCommandLine has_any ("dir","tasklist") // Extract the search term passed to findstr | extend SearchTerm = extract(@"findstr\s+""?([^""\s]+)""?", 1, ProcessCommandLine) | where isnotempty(SearchTerm) // Select relevant details and count occurrences | project TimeGenerated, DeviceName, InitiatingProcessAccountName, SearchTerm, ProcessCommandLine | summarize Occurrences = count() by SearchTerm | sort by Occurrences desc