Question Analysis

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine contains "\\" | where ProcessCommandLine contains "TEMP" | project Timestamp, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents | where InitiatingProcessFileName == 'powershell.exe' | where ProcessCommandLine has 'copy' or ProcessCommandLine has 'cp' | where ProcessCommandLine has '\\c$' and ProcessCommandLine has 'TEMP' | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where tolower(FileName) in ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has "C$" and ProcessCommandLine has "\\" and ProcessCommandLine has "$" | where ProcessCommandLine contains "temp" or ProcessCommandLine contains "%temp%" or ProcessCommandLine contains "appdata\\local\\temp" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | sort by TimeGenerated desc

let tempPath = "\\TEMP\\"; let cshare = "$"; DeviceProcessEvents | where ProcessCommandLine has tempPath and ProcessCommandLine has cshare | summarize count(), make_list(ProcessCommandLine) | order by count_ desc | extend Full_PowerShell_Command = list_ProcessCommandLine[0] | project-away count_, list_ProcessCommandLine

DeviceProcessEvents | where tolower(FileName) == "powershell.exe" | where ProcessCommandLine has "\\" and ProcessCommandLine has "C$" | where tolower(ProcessCommandLine) contains "temp" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine | order by TimeGenerated desc | limit 10

DeviceProcessEvents | where FileName has_any ('powershell', 'PowerShell') | where ProcessCommandLine contains 'copy' or ProcessCommandLine contains 'xcopy' | where ProcessCommandLine contains 'C$' and ProcessCommandLine contains 'TEMP' | project TimeGenerated, DeviceName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName contains "powershell" and ProcessCommandLine contains "copy" and ProcessCommandLine contains "C$" and ProcessCommandLine contains "TEMP" | project ProcessCommandLine

DeviceProcessEvents | where ActionType == 'ProcessCreated' | where FileName in~ ('powershell.exe','pwsh.exe','powershell_ise.exe') // Remote admin share (\\host\c$\...) | where ProcessCommandLine contains '\\c$\\' // Copy via PowerShell (Copy-Item or common aliases) | where ProcessCommandLine has_any ('copy','cp','cpi','robocopy') // Destination mentions a TEMP location/variable | where ProcessCommandLine contains '$env:TEMP' or ProcessCommandLine contains '$env:TMP' or ProcessCommandLine contains '%TEMP%' or ProcessCommandLine contains '%TMP%' or ProcessCommandLine contains '\\AppData\\Local\\Temp' or ProcessCommandLine contains '\\Windows\\Temp' or ProcessCommandLine contains ':\\Temp' or ProcessCommandLine contains '\\Temp\\' | project TimeGenerated, DeviceName, AccountDomain, AccountName, PowerShellCommand=ProcessCommandLine | order by TimeGenerated desc

let srcRegex = @"(?i)\\\\[^\\]+\\C\$\\"; let destRegex = @"(?i)(%temp%|\$env:TEMP|\\Temp\\|\\Users\\[^\\]+\\AppData\\Local\\Temp\\)"; union DeviceProcessEvents, DeviceEvents | extend Cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | where isnotempty(Cmd) | where (FileName has "powershell" or Cmd has "powershell" or Cmd has "pwsh") | where Cmd matches regex srcRegex and Cmd matches regex destRegex | project TimeGenerated = coalesce(Timestamp, TimeGenerated), DeviceName, Account = coalesce(InitiatingProcessAccountName, AccountName), ProcessFileName = FileName, ProcessId, CommandLine = Cmd | order by TimeGenerated desc

DeviceProcessEvents | where isnotempty(ProcessCommandLine) | where tolower(ProcessCommandLine) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh" | where tolower(ProcessCommandLine) contains "copy-item" | where tolower(ProcessCommandLine) contains "c$" | project TimeGenerated, DeviceName, AccountDomain, AccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, ProcessCommandLine

DeviceProcessEvents | where FileName contains "powershell.exe" | where ProcessCommandLine contains "C$" and ProcessCommandLine contains "temp" | project Timestamp, DeviceName, AccountName, ProcessCommandLine | order by Timestamp desc

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("Copy-Item", "copy") | where ProcessCommandLine has "C$" and ProcessCommandLine has "temp" | project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ActionType =~ "ProcessCreated" | where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe" | where ProcessCommandLine has "C$" and ProcessCommandLine has "temp" and ProcessCommandLine has_any ("copy", "cp", "xcopy") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FolderPath, FileName, SHA256, InitiatingProcessCommandLine | order by TimeGenerated desc

// PowerShell file-copy from a remote C$ share to the local TEMP folder DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName has_cs "powershell" // powershell.exe, pwsh.exe, etc. // must reference a remote administrative C$ share | where ProcessCommandLine contains "\\" and ProcessCommandLine contains "\\c$" // indication of a copy operation | where ProcessCommandLine has_any ("copy-item", "Copy-Item", " copy ", "copy ") // destination is some form of the local temporary directory | where ProcessCommandLine has_any ("%temp%", "\\temp\\", "\\Temp\\", "windows\\temp", "$env:TEMP", "$env:temp") // ———————————————————————————————————————— | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has "Copy-Item" and ProcessCommandLine contains "\\C$" and ProcessCommandLine contains "Temp" | project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine | sort by Timestamp desc

DeviceProcessEvents | where ActionType == "ProcessCreated" // Only look at PowerShell processes | where FileName has "powershell" or ProcessCommandLine has "powershell" // Filter for UNC path pointing to a C$ share and local TEMP folder | where ProcessCommandLine has "\\" | where tolower(ProcessCommandLine) has "c$" | where tolower(ProcessCommandLine) has "temp" // Select relevant fields | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine // Order by most recent | order by TimeGenerated desc