Question Analysis

let secondsThreshold = 300; // Network events where a PowerShell process made a remote connection let networkPowershell = DeviceNetworkEvents | where isnotempty(RemoteUrl) and tolower(InitiatingProcessFileName) has "powershell" | project DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, NetworkTime=TimeGenerated; // Process events for PowerShell let pwshProcesses = DeviceProcessEvents | where tolower(FileName) has "powershell" or tolower(ProcessCommandLine) has "powershell" | project DeviceId, ProcessTime=TimeGenerated, ProcessId, ProcessCommandLine; // Join on DeviceId, then ensure the process ids match and timestamps are close networkPowershell | join kind=inner (pwshProcesses) on DeviceId | where InitiatingProcessId == ProcessId and abs(datetime_diff("second", NetworkTime, ProcessTime)) <= secondsThreshold // Extract LaZagne module name from either command line (case-insensitive) | extend ModuleFromProc = extract(@"(?i)\b(lazagne[\w-]*)\b", 1, ProcessCommandLine) | extend ModuleFromInit = extract(@"(?i)\b(lazagne[\w-]*)\b", 1, InitiatingProcessCommandLine) | extend ModuleName = coalesce(ModuleFromProc, ModuleFromInit) | where isnotempty(ModuleName) | project DeviceName, Account=InitiatingProcessAccountName, RemoteUrl, ProcessId, ProcessTime, ProcessCommandLine, InitiatingProcessCommandLine, ModuleName | distinct DeviceName, Account, RemoteUrl, ProcessId, ProcessTime, ModuleName, ProcessCommandLine, InitiatingProcessCommandLine | order by ProcessTime desc