Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has "Clear-RecycleBin" or ProcessCommandLine has "$Recycle.Bin" | project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents | union DeviceLogonEvents | where (ProcessCommandLine contains "cmd.exe" or ProcessCommandLine contains "powershell") and (ProcessCommandLine contains "/c" and ProcessCommandLine contains "rd /s /q" and ProcessCommandLine contains "$Recycle.Bin" or ProcessCommandLine contains "Clear-RecycleBin") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has_any ("$Recycle.Bin", "Recycler", "Clear-RecycleBin", "Remove-Item $", "shell:RecycleBinFolder", "rd /s /q", "del /s /q", "empty Recycle Bin") | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine matches regex @'(?i)\b(rd|del)\b.*(\/s|\/q).*(\$Recycle\.Bin|RecycleBin)' | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has 'rd' or ProcessCommandLine has 'rmdir' | where ProcessCommandLine contains '$Recycle.Bin' or ProcessCommandLine contains 'Recycler' | project Timestamp, DeviceName, AccountName, AccountDomain, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc

DeviceProcessEvents | where ProcessCommandLine contains "Clear-RecycleBin" or (ProcessCommandLine contains "rd" and ProcessCommandLine contains "$Recycle.Bin") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc

// Look for process creation events that reference 'Clear-RecycleBin', '$Recycle.Bin', // or typical 'rd' and other deletion commands targeting the Recycle Bin. DeviceProcessEvents | where ActionType == "ProcessCreated" | where isnotempty(ProcessCommandLine) | where ProcessCommandLine has_any ("Clear-RecycleBin", "recycle", "$Recycle.Bin", "rd", "rmdir", "del", "erase", "sdelete") // Filter further to include typical switches or environment variables | where ProcessCommandLine matches regex @"(?i)(clear-recyclebin|\$recycle\.bin|rd(\s+.*?\/s\s+.*?\/q)?|rmdir(\s+.*?\/s\s+.*?\/q)?|del|erase|sdelete)" | project TimeGenerated, DeviceName, AccountDomain, InitiatingProcessAccountName, ProcessCommandLine, FolderPath, MachineGroup | order by TimeGenerated desc

DeviceProcessEvents | where Timestamp >= ago(30d) | where tolower(ProcessCommandLine) has "$recycle.bin" or tolower(ProcessCommandLine) has "clear-recyclebin" or tolower(ProcessCommandLine) has "rd /s /q" | project Timestamp, DeviceName, AccountDomain, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath, MD5, SHA256 | order by Timestamp desc

DeviceProcessEvents | where isnotempty(InitiatingProcessCommandLine) and ( InitiatingProcessCommandLine contains "$Recycle.Bin" or InitiatingProcessCommandLine contains "Clear-RecycleBin" or (InitiatingProcessCommandLine has "rd" and InitiatingProcessCommandLine contains "$Recycle.Bin") or (ProcessCommandLine contains "$Recycle.Bin") or (ProcessCommandLine contains "Clear-RecycleBin") ) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, ProcessCommandLine, ProcessId | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "$Recycle.Bin" or ProcessCommandLine has "Clear-RecycleBin" or (ProcessCommandLine has "Remove-Item" and ProcessCommandLine has "Recycle.Bin") or (ProcessCommandLine has "rd " and ProcessCommandLine has "Recycle.Bin") or (ProcessCommandLine has "%SystemDrive%" and ProcessCommandLine has "Recycle.Bin") or (ProcessCommandLine has "$env:SystemDrive" and ProcessCommandLine has "Recycle.Bin") | project Timestamp=TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, ProcessCommandLine | sort by Timestamp desc

let clearPattern = @"(?i)(?:\b(?:rd|rmdir)\b.*\$Recycle\.Bin|\bClear-RecycleBin\b)"; DeviceProcessEvents | where ProcessCommandLine matches regex clearPattern | project TimeGenerated, DeviceName, AccountDomain, AccountName, ParentProcess = InitiatingProcessFileName, Executable = FileName, ProcessId, CommandLine = ProcessCommandLine | sort by TimeGenerated desc