Question Analysis

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has "Get-Date" or ProcessCommandLine has "[System.DateTime]::Now" | project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine contains 'Get-Date' or ProcessCommandLine contains 'DateTime'

DeviceProcessEvents | where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe" | where ProcessCommandLine has_any ("Get-Date", "[System.DateTime]", "w32tm") | project TimeGenerated, DeviceName, FileName, ProcessCommandLine

DeviceProcessEvents | where FileName has_cs "powershell" | where ProcessCommandLine has_any ("date", "time", "get-date", "systemclock") | project TimeGenerated, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has_any ("Get-Date", "get-date") | project TimeGenerated, DeviceName, ProcessCommandLine

DeviceProcessEvents | where InitiatingProcessFileName == "powershell.exe" | where ProcessCommandLine has_any ("Get-Date", "system clock") | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, AccountName

let psHosts = dynamic(["powershell.exe","pwsh.exe","powershell_ise.exe"]); DeviceProcessEvents | where FileName in~ (psHosts) | extend PCL = tostring(ProcessCommandLine), PCL_L = tolower(ProcessCommandLine) | where PCL_L matches regex @"\b(get-date|\[(system\.)?datetime\]::(utc)?now|get-(wmiobject|ciminstance).*(win32_)?(localtime|utctime)|wmic\s+os\s+get\s+localdatetime)\b" | extend ClockCommand = case( PCL_L matches regex @"\bget-date\b", "Get-Date", PCL_L matches regex @"\[(system\.)?datetime\]::utcnow\b", "[DateTime]::UtcNow", PCL_L matches regex @"\[(system\.)?datetime\]::now\b", "[DateTime]::Now", PCL_L matches regex @"\bget-ciminstance\b.*\b(win32_)?(localtime|utctime)\b", "Get-CimInstance Win32_(LocalTime|UTCTime)", PCL_L matches regex @"\bget-wmiobject\b.*\b(win32_)?(localtime|utctime)\b", "Get-WmiObject Win32_(LocalTime|UTCTime)", PCL_L matches regex @"\bwmic\s+os\s+get\s+localdatetime\b", "wmic os get localdatetime", "Clock retrieval") | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, CommandExecuted=PCL, ClockCommand, InitiatingProcessParentFileName, InitiatingProcessParentId, ProcessId | order by TimeGenerated desc

let time_patterns = dynamic(["get-date","[datetime]::now","[datetime]::utcnow","get-ciminstance","win32_operatingsystem","get-wmiobject","w32tm","get-uptime","get-timezone","get-culture"]); union DeviceProcessEvents, DeviceEvents | where ( tolower(FileName) in ('powershell.exe','pwsh.exe','powershell_ise.exe') or tolower(ProcessCommandLine) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh" or tolower(InitiatingProcessFileName) in ('powershell.exe','pwsh.exe','powershell_ise.exe') or tolower(InitiatingProcessCommandLine) contains "powershell" or tolower(InitiatingProcessCommandLine) contains "pwsh" ) | where ( (isnotempty(ProcessCommandLine) and tolower(ProcessCommandLine) has_any (time_patterns)) or (isnotempty(InitiatingProcessCommandLine) and tolower(InitiatingProcessCommandLine) has_any (time_patterns)) or (isnotempty(tostring(AdditionalFields)) and tolower(tostring(AdditionalFields)) has_any (time_patterns)) ) | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ActionType, ReportId | order by TimeGenerated desc | take 200

let powershell_names = dynamic(["powershell","powershell.exe","powershell_ise.exe","pwsh","pwsh.exe"]); let clock_patterns = dynamic([ "get-date", "[datetime]::now", "[system.datetime]::now", "w32tm /query", "get-uptime", "get-ciminstance", "get-wmiobject", "get-computerinfo", "(get-date)", "csSystemBootTime" ]); // Prefer DeviceProcessEvents for command line telemetry let dpe = DeviceProcessEvents | where isnotempty(ProcessCommandLine) or isnotempty(FileName) | where ( array_length(powershell_names) == 0 or ( tolower(FileName) contains "powershell" or tolower(FileName) contains "pwsh" or tolower(ProcessCommandLine) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh" ) ) | extend cmd = tostring(ProcessCommandLine) | where tolower(cmd) contains "get-date" or tolower(cmd) contains "[datetime]::now" or tolower(cmd) contains "[system.datetime]::now" or tolower(cmd) contains "w32tm /query" or tolower(cmd) contains "get-uptime" or tolower(cmd) contains "get-ciminstance" or tolower(cmd) contains "get-wmiobject" or tolower(cmd) contains "get-computerinfo" or tolower(cmd) contains "(get-date)" | extend matched = iff(tolower(cmd) contains "get-date","get-date", iff(tolower(cmd) contains "[datetime]::now","[datetime]::now", iff(tolower(cmd) contains "[system.datetime]::now","[system.datetime]::now", iff(tolower(cmd) contains "w32tm /query","w32tm /query", iff(tolower(cmd) contains "get-uptime","get-uptime", iff(tolower(cmd) contains "get-ciminstance","get-ciminstance", iff(tolower(cmd) contains "get-wmiobject","get-wmiobject", iff(tolower(cmd) contains "get-computerinfo","get-computerinfo","other")))))))) | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCreationTime, ProcessCommandLine=cmd, InitiatingProcessFileName, InitiatingProcessCommandLine, matched; let de = DeviceEvents | where isnotempty(ProcessCommandLine) or isnotempty(FileName) or isnotempty(InitiatingProcessCommandLine) | where ( tolower(FileName) contains "powershell" or tolower(FileName) contains "pwsh" or tolower(ProcessCommandLine) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh" or tolower(InitiatingProcessCommandLine) contains "powershell" or tolower(InitiatingProcessCommandLine) contains "pwsh" ) | extend CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | extend cmd = tostring(CommandLine) | where tolower(cmd) contains "get-date" or tolower(cmd) contains "[datetime]::now" or tolower(cmd) contains "[system.datetime]::now" or tolower(cmd) contains "w32tm /query" or tolower(cmd) contains "get-uptime" or tolower(cmd) contains "get-ciminstance" or tolower(cmd) contains "get-wmiobject" or tolower(cmd) contains "get-computerinfo" or tolower(cmd) contains "(get-date)" | extend matched = iff(tolower(cmd) contains "get-date","get-date", iff(tolower(cmd) contains "[datetime]::now","[datetime]::now", iff(tolower(cmd) contains "[system.datetime]::now","[system.datetime]::now", iff(tolower(cmd) contains "w32tm /query","w32tm /query", iff(tolower(cmd) contains "get-uptime","get-uptime", iff(tolower(cmd) contains "get-ciminstance","get-ciminstance", iff(tolower(cmd) contains "get-wmiobject","get-wmiobject", iff(tolower(cmd) contains "get-computerinfo","get-computerinfo","other")))))))) | project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCreationTime, ProcessCommandLine=cmd, InitiatingProcessFileName, InitiatingProcessCommandLine, matched; union dpe, de | sort by TimeGenerated desc | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), ExampleCommands = make_list(ProcessCommandLine, 5) by DeviceName, FileName, tostring(ProcessId), InitiatingProcessFileName, matched | project FirstSeen, LastSeen, Count, DeviceName, FileName, ProcessId = tostring(ProcessId), InitiatingProcessFileName, matched, ExampleCommands | top 100 by LastSeen desc

DeviceProcessEvents | where FileName in~ ("powershell.exe","pwsh.exe") or ProcessCommandLine has_any ("powershell","pwsh") | where ProcessCommandLine matches regex @"(?i)\b(Get-Date|Get-Date\(|Get-WmiObject\s+Win32_LocalTime|Get-CimInstance\s+Win32_UTCTime|Get-CimInstance\s+Win32_LocalTime|\[DateTime\]::Now|w32tm\s+/query|Get-Culture|Get-TimeZone)\b" | project TimeGenerated, DeviceName, AccountName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | extend MatchedCommand = extract(@"(?i)(Get-Date\b.*|Get-WmiObject\s+Win32_LocalTime.*|Get-CimInstance\s+Win32_UTCTime.*|Get-CimInstance\s+Win32_LocalTime.*|\[DateTime\]::Now.*|w32tm\s+/query.*|Get-Culture.*|Get-TimeZone.*)", 0, ProcessCommandLine) | where isnotempty(MatchedCommand) | summarize count(), AnyCommandLines = make_set(ProcessCommandLine, 50) by DeviceName, AccountName, FileName, ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine | order by count_ desc | project DeviceName, AccountName, FileName, ProcessId, count_, AnyCommandLines, InitiatingProcessFileName, InitiatingProcessCommandLine | take 100

DeviceProcessEvents | where (InitiatingProcessFileName has_cs "powershell.exe" or InitiatingProcessFileName has_cs "pwsh.exe" or ProcessCommandLine has_cs "powershell" or ProcessCommandLine has_cs "pwsh") | where (InitiatingProcessCommandLine has_cs "Get-Date" or InitiatingProcessCommandLine has_cs "[DateTime]::Now" or InitiatingProcessCommandLine has_cs "GetSystemTime" or InitiatingProcessCommandLine has_cs "GetSystemTimeAsFileTime" or ProcessCommandLine has_cs "Get-Date" or ProcessCommandLine has_cs "[DateTime]::Now" or ProcessCommandLine has_cs "GetSystemTime") | extend CommandLineExecuted = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessFileName, CommandLineExecuted | sort by TimeGenerated desc | take 100

DeviceProcessEvents | where FileName contains "powershell" or InitiatingProcessFileName contains "powershell" | where ProcessCommandLine has_any ("Get-Date", "System.DateTime", "date", "time") or InitiatingProcessCommandLine has_any ("Get-Date", "System.DateTime", "date", "time") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCreationTime | order by Timestamp desc

DeviceProcessEvents | where FileName =~ 'powershell.exe' | where ProcessCommandLine contains 'Get-Date' or ProcessCommandLine contains '[DateTime]::Now' or ProcessCommandLine contains '[System.DateTime]::Now' | project TimeGenerated, DeviceName, ProcessCommandLine | order by TimeGenerated desc | limit 100

DeviceProcessEvents | where FileName =~ "powershell.exe" or ProcessCommandLine contains "powershell" | where ProcessCommandLine contains "Get-Date" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") | where ProcessCommandLine has_any ("Get-Date", "Win32_LocalTime") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc

// ================================ // PowerShell activity that queries the system clock // ================================ let date_time_terms = dynamic([ "get-date", // Native cmdlet "get-wmiobject", "get-ciminstance", // WMI / CIM cmdlets "win32_localtime", "win32_utctime", // WMI classes "wmic path win32_localtime", "wmic path win32_utctime" ]); DeviceProcessEvents // --- portal will inject the time filter --- | where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") | where ProcessCommandLine has_any (date_time_terms) // try to capture the first PS statement after -Command / -c | extend _cmd = tostring(extract(@"(?i)(?:-command|-c)\s+['"" ]?([^'"" ]+.*)", 1, ProcessCommandLine)) | extend ExecutedCommand = case( isnotempty(_cmd), _cmd, ProcessCommandLine matches regex @"(?i)-encoded(command)?\b", "<encoded payload – decode manually>", ProcessCommandLine ) | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ExecutedCommand, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where (FileName has "powershell.exe" or InitiatingProcessFileName has "powershell.exe") | where ProcessCommandLine has "Get-Date" | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents | where tolower(InitiatingProcessFileName) contains "powershell" | where tolower(InitiatingProcessCommandLine) contains "get-date" | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName in ("powershell.exe", "pwsh.exe", "powershell_ise.exe") // look for commands that retrieve or query the system time | where ProcessCommandLine has "get-date" or ProcessCommandLine matches regex @"(?i)\[datetime\]::(Now|UtcNow)" or ProcessCommandLine matches regex @"(?i)\bw32tm\b" or ProcessCommandLine matches regex @"(?i)\bnet\s+time\b" or ProcessCommandLine matches regex @"(?i)get-wmiobject.*time" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents // Restrict to PowerShell executables | where FileName in~ ("powershell.exe", "pwsh.exe") // Look for the Get-Date cmdlet which retrieves the system clock | where ProcessCommandLine has "Get-Date" // Project the fields of interest | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine | sort by TimeGenerated desc