Question Analysis

DeviceProcessEvents | where ProcessCommandLine contains 'Enable-PSRemoting -Force'

DeviceProcessEvents | where ProcessCommandLine has_all ("powershell", "enable-psremoting") | project Timestamp, ProcessCommandLine, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessParentFileName | order by Timestamp desc

DeviceProcessEvents | where FileName endswith "powershell.exe" and ProcessTokenElevation != "" and ProcessTokenElevation !in ("Default") and (isnotempty(IsInitiatingProcessRemoteSession) or isnotempty(IsProcessRemoteSession)) | where ProcessCommandLine contains "Enable-PSRemoting" or ProcessCommandLine contains "winrm quickconfig" or ProcessCommandLine contains "Set-WSManQuickConfig" | project DeviceName, InitiatingProcessAccountName, ProcessCommandLine, TimeGenerated

union isfuzzy=true DeviceProcessEvents, DeviceEvents | where (tolower(FileName) contains "powershell" or tolower(FileName) contains "pwsh" or tolower(ProcessCommandLine) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh") // Look for common PSRemoting enabling commands | where ( tolower(ProcessCommandLine) contains "enable-psremoting" or tolower(ProcessCommandLine) contains "winrm quickconfig" or tolower(ProcessCommandLine) contains "set-item wsman" or tolower(ProcessCommandLine) contains "enable-wsmancredssp" or tolower(ProcessCommandLine) contains "enable-pssessionconfiguration" ) // Restrict to elevated sessions (token elevation or high integrity) | where ( tolower(ProcessTokenElevation) contains "elev" or tolower(InitiatingProcessTokenElevation) contains "elev" or tolower(ProcessIntegrityLevel) contains "high" or tolower(InitiatingProcessIntegrityLevel) contains "high" ) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessId, InitiatingProcessId, ProcessCommandLine, InitiatingProcessCommandLine, ProcessTokenElevation, InitiatingProcessTokenElevation, ReportId, _ResourceId | sort by TimeGenerated desc | take 100

// Find PowerShell executions that enabled PSRemoting or related WSMan settings let RemotingPatterns = dynamic(["Enable-PSRemoting","Enable-WSManCredSSP","Enable-PsRemoting","winrm quickconfig","winrm qc","Set-Item -Path WSMan:","Set-WSManQuickConfig","Enable-WSMan","Configure-SMRemoting"]); let pwshNames = dynamic(["powershell.exe","pwsh.exe","powershell_ise.exe"]); // DeviceProcessEvents: has elevation fields let dpe = DeviceProcessEvents | where TimeGenerated >= ago(30d) | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) or FileName has_any(pwshNames) | where ProcessCommandLine has_any(RemotingPatterns) or InitiatingProcessCommandLine has_any(RemotingPatterns) or FileName has_any(pwshNames) | extend FullCommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | project TimeGenerated, SourceTable = "DeviceProcessEvents", DeviceName, DeviceId, AccountDomain, AccountName, FullCommandLine, InitiatingCommandLine = InitiatingProcessCommandLine, InitiatingFile = InitiatingProcessFileName, ProcessTokenElevation, InitiatingProcessTokenElevation, InitiatingSession = InitiatingProcessSessionId, ReportId, FileName | extend ElevationConcat = tolower(coalesce(ProcessTokenElevation, InitiatingProcessTokenElevation, "")) | extend IsElevated = case(ElevationConcat contains "high" or ElevationConcat contains "elevat" or ElevationConcat contains "%%16895", "Yes", ElevationConcat == "" or ElevationConcat == "unknown", "Unknown", "No"); // DeviceEvents: may not have token elevation reliably let de = DeviceEvents | where TimeGenerated >= ago(30d) | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) or FileName has_any(pwshNames) | where ProcessCommandLine has_any(RemotingPatterns) or InitiatingProcessCommandLine has_any(RemotingPatterns) or FileName has_any(pwshNames) | extend FullCommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | project TimeGenerated, SourceTable = "DeviceEvents", DeviceName, DeviceId, AccountDomain, AccountName, FullCommandLine, InitiatingCommandLine = InitiatingProcessCommandLine, InitiatingFile = InitiatingProcessFileName, InitiatingSession = InitiatingProcessSessionId, ReportId, FileName | extend IsElevated = "Unknown"; union dpe, de | extend DetectedCommand = extract(@"(?i)((Enable-PSRemoting|Enable-WSManCredSSP|Enable-PsRemoting|winrm\s+quickconfig|winrm\s+qc|Set-Item\s+-Path\s+WSMan:|Set-WSManQuickConfig|Enable-WSMan)[^\r\n;]{0,400})", 1, FullCommandLine) | where isnotempty(DetectedCommand) | where IsElevated == "Yes" or IsElevated == "Unknown" | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), AnyAccount = any(AccountName), AnyInitiatingFile = any(InitiatingFile), AnyInitiatingSession = any(InitiatingSession), AnyFileName = any(FileName), AnyReportId = any(ReportId) by DeviceId, DeviceName, IsElevated, DetectedCommand, FullCommandLine, SourceTable | order by LastSeen desc | project FirstSeen, LastSeen, Count, DeviceName, DeviceId, IsElevated, DetectedCommand, FullCommandLine, SourceTable, AnyAccount, AnyInitiatingFile, AnyInitiatingSession, AnyFileName, AnyReportId