Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "taskmgr.exe" | where InitiatingProcessFileName =~ "cmd.exe" | project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents | where FileName == 'Taskmgr.exe' and InitiatingProcessFileName == 'cmd.exe' | where ProcessCommandLine !contains '/s' | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents | where FileName =~ "taskmgr.exe" | where InitiatingProcessFileName =~ "cmd.exe" | where ProcessCommandLine has_any("/", "-") and not(ProcessCommandLine has_any("/1", "/2", "/3", "/4", "/5", "/6")) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessFileName

DeviceProcessEvents | where InitiatingProcessCommandLine has_any ("cmd.exe", "/") | where ProcessCommandLine contains "taskmgr" | extend weird_flag = iff(ProcessCommandLine has "@echo off", "false", "true") | summarize by AccountName, AccountSid, DeviceId, DeviceName, InitCmd = InitiatingProcessCommandLine, Cmd = ProcessCommandLine, weird_flag | order by Cmd asc nulls last

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "taskmgr.exe" or ProcessCommandLine has_cs "taskmgr" | where InitiatingProcessFileName =~ "cmd.exe" // Require a switch after taskmgr (unusual because Task Manager is typically launched without flags) | where ProcessCommandLine matches regex @"(?i)\btaskmgr(?:\.exe)?\b.*(?:^|\s)[-/][^\s\""]+" // Extract one or more flags used with taskmgr | extend Flags = extract_all(@"(?i)(?:^|\s)([-/][\w\.-]+)", ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FullCommand=ProcessCommandLine, Flags | order by TimeGenerated asc

let suspiciousRegex = @"(?i)\/(e\b|s\b|q\b|off\b|k\b|c\b)"; union DeviceProcessEvents, DeviceEvents | where tolower(InitiatingProcessFileName) has "cmd" and (tolower(FileName) == "taskmgr.exe" or tolower(ProcessCommandLine) has "taskmgr") | extend InitiatingCommand = tostring(InitiatingProcessCommandLine), TargetCmd = tostring(ProcessCommandLine) | extend SuspiciousFlagFound = (InitiatingCommand matches regex suspiciousRegex) or (TargetCmd matches regex suspiciousRegex) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingCommand, FileName, TargetCmd, ProcessId, InitiatingProcessId, SuspiciousFlagFound | sort by SuspiciousFlagFound desc, TimeGenerated desc | limit 100

DeviceProcessEvents | where FileName has_cs "taskmgr" or ProcessCommandLine has_cs "taskmgr" | where InitiatingProcessFileName has_cs "cmd" or InitiatingProcessCommandLine has_cs "cmd" | extend InitiatorCmdLine = tostring(InitiatingProcessCommandLine), TargetCmdLine = tostring(ProcessCommandLine) // flag detection: look for typical slash/dash flags in the taskmgr command line or common cmd execution switches | extend TargetHasFlag = iff(TargetCmdLine matches regex @"\s/[^ \t]+" or TargetCmdLine matches regex @"\s-[^\s]+", 1, 0) | where TargetHasFlag == 1 or InitiatorCmdLine contains "/c" or InitiatorCmdLine contains "/k" | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessId, InitiatorCmdLine, FileName, ProcessId, TargetCmdLine, InitiatingProcessCreationTime, ProcessCreationTime | order by TimeGenerated desc | take 200

// Find Task Manager (taskmgr.exe) launched where initiating process is cmd.exe (or contains cmd) // Use DeviceProcessEvents primarily, fall back to DeviceEvents let process_table = DeviceProcessEvents; let event_table = DeviceEvents; process_table | where true // Filter to Task Manager processes by filename or commandline | where (tolower(FileName) has "taskmgr" ) or (tolower(ProcessCommandLine) has "taskmgr") // Ensure initiating process exists and is cmd | where (tolower(InitiatingProcessFileName) has "cmd") or (tolower(InitiatingProcessCommandLine) has "cmd") or (tolower(InitiatingProcessFileName) has "c:\\windows\\system32\\cmd.exe") | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, FileName, ProcessCommandLine, ProcessId | sort by TimeGenerated desc | take 100 // Also check DeviceEvents for similar entries | union ( event_table | where true | where (tolower(FileName) has "taskmgr") or (tolower(ProcessCommandLine) has "taskmgr") or (tolower(ProcessCommandLine) has "taskmgr.exe") | where (tolower(InitiatingProcessFileName) has "cmd") or (tolower(InitiatingProcessCommandLine) has "cmd") | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId=InitiatingProcessId, InitiatingProcessAccountName, FileName, ProcessCommandLine, ProcessId=ProcessId | sort by TimeGenerated desc | take 100 ) | sort by TimeGenerated desc | top 50 by TimeGenerated

DeviceProcessEvents | where tolower(FileName) contains "taskmgr.exe" or tolower(ProcessCommandLine) contains "taskmgr.exe" | where tolower(InitiatingProcessFileName) contains "cmd.exe" or tolower(InitiatingProcessCommandLine) contains "cmd" | where ProcessCommandLine contains "/" // presence of a slash-delimited flag indicates an unusual flag | project TimeGenerated, DeviceName, DeviceId, ProcessId, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessSessionId | extend FullCommandExecuted = strcat(coalesce(InitiatingProcessCommandLine, ""), " ", coalesce(ProcessCommandLine, "")) | sort by TimeGenerated desc

let TimeRange = 7d; DeviceProcessEvents | where TimeGenerated >= ago(TimeRange) | where InitiatingProcessFileName == "cmd.exe" | where tolower(InitiatingProcessCommandLine) contains "taskmgr" | extend FullCommand = InitiatingProcessCommandLine | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, FullCommand, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessSessionId | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ 'taskmgr.exe' | where InitiatingProcessFileName =~ 'cmd.exe' | where ProcessCommandLine contains ' ' | project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessFileName =~ "cmd.exe" | where FileName =~ "taskmgr.exe" | where ProcessCommandLine has "/" | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine | order by TimeGenerated desc

// Investigate instances where Task Manager (taskmgr.exe) was launched *from* a cmd.exe shell // and received at least one command-line argument (i.e. an “unusual” flag). // The query returns the full command that was executed together with basic context. // (Timerange is supplied when the function is invoked) DeviceProcessEvents | where FileName =~ "taskmgr.exe" // child process | where InitiatingProcessFileName =~ "cmd.exe" // launched from cmd.exe | where isnotempty(ProcessCommandLine) // we have a command line | where not(ProcessCommandLine matches regex @"(?i)^\s*taskmgr\.exe\s*$") // command line contains something more than just the executable name | extend UnusualFlag = trim("\"", tostring(extract(@"taskmgr\.exe\s+(.*)$",1,ProcessCommandLine))) | project TimeGenerated, DeviceName, DeviceId, Account = strcat(InitiatingProcessAccountDomain, "\\", InitiatingProcessAccountName), TaskmgrCommand = ProcessCommandLine, ParentCmdLine = InitiatingProcessCommandLine, UnusualFlag | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "taskmgr.exe" | where InitiatingProcessFileName =~ "cmd.exe" // Optionally, if you know part of the unusual flag pattern, you can add a further filter like: // | where InitiatingProcessCommandLine contains "-unusualFlag" | project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessId | sort by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | where tolower(FileName) endswith "cmd.exe" | where tolower(ProcessCommandLine) has "taskmgr.exe" | project TimeGenerated, DeviceName, ProcessCommandLine