Review Windows process creation events for evidence of a .NET assembly being installed. Which executable was launched with an "/action=install" argument?

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine contains "/action=install" | project Timestamp, DeviceName, FileName, ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine contains "/action=install"
| project FileName

DeviceProcessEvents
| where ActionType == 'ProcessCreated' and ProcessCommandLine has '/action=install'
| project DeviceName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, TimeGenerated

DeviceProcessEvents
| where ProcessCommandLine has "/action=install"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine

DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has "/action=install"
| summarize uniqueProcesses = make_set(FolderPath)
| extend uniqueProcessesCount = array_length(uniqueProcesses)
| project uniqueProcessesCount, uniqueProcesses
| order by uniqueProcessesCount desc

DeviceProcessEvents
| where ActionType == 'ProcessCreated'
| where InitiatingProcessCommandLine contains "/action=install"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

DeviceProcessEvents 
| where ProcessCommandLine contains '/action=install'
| project ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCreationTime, DeviceName, InitiatingProcessParentFileName

DeviceProcessEvents
| where ProcessCommandLine has "/action=install"
| project DeviceName, FileName, ProcessCommandLine, ProcessCreationTime

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine matches regex @"(?i)[/-]action\s*=\s*install"
| summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleCommandLine=any(ProcessCommandLine) by FileName, FolderPath
| order by EventCount desc, LastSeen desc

// Find processes launched with "/action=install" in command line
let argPattern = @"/action=install";
// Check DeviceProcessEvents first
DeviceProcessEvents
| where tolower(ProcessCommandLine) contains tolower(argPattern)
| project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MD5
| extend SourceTable = "DeviceProcessEvents"

| union (
    // DeviceEvents may store process creation logs in some tenants
    DeviceEvents
    | where tolower(ProcessCommandLine) contains tolower(argPattern) or tolower(InitiatingProcessCommandLine) contains tolower(argPattern)
    | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MD5
    | extend SourceTable = "DeviceEvents"
)

| union (
    // Additional coverage: DeviceFileEvents (initiating process fields)
    DeviceFileEvents
    | where tolower(InitiatingProcessCommandLine) contains tolower(argPattern) or tolower(InitiatingProcessFileName) contains tolower(argPattern)
    | project TimeGenerated, DeviceName, FileName = InitiatingProcessFileName, ProcessId = InitiatingProcessId, ProcessCommandLine = InitiatingProcessCommandLine, ProcessCreationTime = InitiatingProcessCreationTime, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256 = InitiatingProcessSHA256, MD5 = InitiatingProcessMD5
    | extend SourceTable = "DeviceFileEvents"
)

| union (
    // Image loads sometimes show modules loaded by installers
    DeviceImageLoadEvents
    | where tolower(InitiatingProcessCommandLine) contains tolower(argPattern)
    | project TimeGenerated, DeviceName, FileName = InitiatingProcessFileName, ProcessId = InitiatingProcessId, ProcessCommandLine = InitiatingProcessCommandLine, ProcessCreationTime = InitiatingProcessCreationTime, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256 = InitiatingProcessSHA256, MD5 = InitiatingProcessMD5
    | extend SourceTable = "DeviceImageLoadEvents"
)

// Deduplicate by device + process id + command line
| summarize arg_count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MD5, SourceTable
| order by FirstSeen desc
| project FirstSeen, LastSeen, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MD5, SourceTable, arg_count

// Find processes where the command line contains "/action=install" (case-insensitive) in DeviceProcessEvents and DeviceEvents
let installArg = "/action=install";
let dpe = DeviceProcessEvents
| where isnotempty(ProcessCommandLine) and tostring(ProcessCommandLine) !="" and tolower(ProcessCommandLine) contains installArg
| where ActionType in ("ProcessCreated","Creation","Created","Process created","ProcessCreation")
| extend CmdLine = ProcessCommandLine, ProcFile = FileName
| project TimeGenerated, Timestamp, DeviceName, DeviceId, ProcFile, PID = ProcessId, CmdLine, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, SHA256, MD5, ActionType;
let de = DeviceEvents
| where isnotempty(ProcessCommandLine) and tostring(ProcessCommandLine) != "" and tolower(ProcessCommandLine) contains installArg
| where ActionType in ("ProcessCreated","Creation","Created","Process created","ProcessCreation")
| extend CmdLine = ProcessCommandLine, ProcFile = FileName
| project TimeGenerated, Timestamp, DeviceName, DeviceId, ProcFile, PID = ProcessId, CmdLine, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, SHA256, MD5, ActionType;
union isfuzzy=true dpe, de
| summarize arg_max(TimeGenerated, *) by DeviceId, PID, CmdLine
| order by TimeGenerated desc
| project TimeGenerated, DeviceName, DeviceId, ProcFile, PID, CmdLine, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, SHA256, MD5, ActionType
| take 100

(
    DeviceProcessEvents
    | where tostring(ProcessCommandLine) has_cs "/action=install" or tolower(tostring(ProcessCommandLine)) has "/action=install"
    | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, AccountName, AccountDomain, SHA256, MD5, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId
)
| union (
    DeviceEvents
    | where tostring(ProcessCommandLine) has_cs "/action=install" or tolower(tostring(ProcessCommandLine)) has "/action=install"
    | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, AccountName, AccountDomain, SHA256, MD5, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId
)
| distinct TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, AccountName, AccountDomain, SHA256, MD5, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId
| order by TimeGenerated desc
| extend MatchedArgument = 
    case(
        tolower(tostring(ProcessCommandLine)) contains "/action=install", "/action=install",
        tolower(tostring(InitiatingProcessCommandLine)) contains "/action=install", "/action=install",
        ""
    )
| where MatchedArgument != ""
| project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, AccountName, AccountDomain, SHA256, MD5, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, MatchedArgument

DeviceProcessEvents
| where (ProcessCommandLine contains "/action=install" or InitiatingProcessCommandLine contains "/action=install")
| extend ExecutableLaunched = FileName, ExecutablePath = FolderPath
| project TimeGenerated, DeviceName, ExecutableLaunched, ExecutablePath, CommandLine = ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc
| take 100

DeviceProcessEvents
| where ProcessCommandLine contains "/action=install"
| project DeviceName, FileName, ProcessCommandLine, ProcessCreationTime
| order by ProcessCreationTime desc

DeviceProcessEvents
| where ProcessCommandLine contains '/action=install'
| distinct FileName, ProcessCommandLine, Timestamp
| project FileName, ProcessCommandLine, Timestamp

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine has "/action=install"
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where tolower(ProcessCommandLine) contains "/action=install"
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
// Time filter is applied automatically by the hunting UI / workbook. Remove or modify the next line if you need a fixed range.
//| where TimeGenerated between (datetime(2024-01-01) .. datetime(2024-01-31))
| where tolower(ProcessCommandLine) has "/action=install"
// Focus on process creation events if ActionType is populated in your environment
//| where ActionType == "CreateProcess" or isnull(ActionType)
| project TimeGenerated,
          DeviceName,
          FileName,
          FolderPath,
          ProcessCommandLine,
          AccountName,
          AccountDomain,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| summarize FirstSeen = min(TimeGenerated),
            LastSeen  = max(TimeGenerated),
            LaunchCount = count()
          by DeviceName, FileName, FolderPath, ProcessCommandLine
| order by LastSeen desc

DeviceProcessEvents
| where ProcessCommandLine contains "/action=install"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine

DeviceProcessEvents
| where ProcessCommandLine has "/action=install"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, ProcessId

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where tolower(ProcessCommandLine) contains "/action=install"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine has "/action=install"
| project TimeGenerated, DeviceName, Executable = FileName, ProcessCommandLine
| order by TimeGenerated desc