Question Analysis

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has "Get-WmiObject" or ProcessCommandLine has "Get-CimInstance" | extend WmiClassName = extract("(?i)-(Class|ClassName)\\s+[\\\"\']?([^\\\"\']+)[\\\"\']?", 2, ProcessCommandLine) | where isnotempty(WmiClassName) | project Timestamp, DeviceName, ProcessCommandLine, WmiClassName

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("Get-WmiObject", "Get-CimInstance", "wmic") | extend WMIClass = extract(@'(?i)(Win32_[a-zA-Z0-9_]+)', 1, ProcessCommandLine) | where isnotempty(WMIClass) | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, WMIClass | summarize count() by WMIClass

let wmi_cmdlets = dynamic(["get-wmiobject","gwmi","get-ciminstance","gcim"]); DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName in~ ("powershell.exe","pwsh.exe","powershell_ise.exe") | where ProcessCommandLine has_any (wmi_cmdlets) // Extract class from -Class / -ClassName | extend class_from_param = extract(@"(?i)-(?:class|classname)\s*(?::|=|\s)\s*['""]?((?:[A-Za-z]+\\[\w\\]+:)?[A-Za-z_][\w\.]+)", 1, ProcessCommandLine) // Extract class from a WQL -Query '... from <Class>' | extend class_from_query = extract(@"(?i)-query\s+.*?\bfrom\s+((?:[A-Za-z]+\\[\w\\]+:)?[A-Za-z_][\w\.]+)", 1, ProcessCommandLine) // Extract class when passed positionally right after the cmdlet (e.g., gwmi Win32_Process) | extend class_from_pos = extract(@"(?i)\b(?:get-wmiobject|gwmi|get-ciminstance|gcim)\s+['""]?((?:[A-Za-z]+\\[\w\\]+:)?[A-Za-z_][\w\.]+)\b", 1, ProcessCommandLine) // Capture -Namespace if present to qualify class when needed | extend ns = extract(@"(?i)-namespace\s*(?::|=|\s)\s*['""]?([A-Za-z]+\\[\w\\]+)", 1, ProcessCommandLine) | extend WmiClassRaw = coalesce(class_from_param, class_from_query, class_from_pos) | extend WmiClass = iff(isnotempty(ns) and isnotempty(WmiClassRaw) and not(WmiClassRaw contains ":"), strcat(ns, ":", WmiClassRaw), WmiClassRaw) | where isnotempty(WmiClass) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine, WmiClass | summarize EventCount = count(), Examples = make_set(ProcessCommandLine, 3) by WmiClass | order by EventCount desc

DeviceProcessEvents | where tolower(FileName) in ("powershell.exe","pwsh.exe") | where tostring(ProcessCommandLine) has_any ("get-wmiobject","get-ciminstance","get-cimclass","gwmi","managementobjectsearcher","select","-class","-classname","-query") | extend cmdline = tostring(ProcessCommandLine) // Try multiple case-insensitive regex patterns to extract the WMI class name | extend WmiClass = coalesce( extract(@"(?i)-ClassName\s+([A-Za-z0-9_:\.\-]+)", 1, cmdline), extract(@"(?i)-Class\s+([A-Za-z0-9_:\.\-]+)", 1, cmdline), extract(@"(?i)gwmi\s+([A-Za-z0-9_:\.\-]+)\b", 1, cmdline), extract(@"(?i)get-wmiobject\s+([A-Za-z0-9_:\.\-]+)\b", 1, cmdline), extract(@"(?i)\bfrom\s+([A-Za-z0-9_:\.\-]+)\b", 1, cmdline), extract(@"(?i)-Query\s+select\b.*?\bfrom\s+([A-Za-z0-9_:\.\-]+)\b", 1, cmdline) ) | extend WmiClass = trim('\"\' ', tostring(WmiClass)) | where isnotempty(WmiClass) | summarize Count = count(), ExampleCommand = any(cmdline), Devices = make_set(DeviceName, 10) by WmiClass | order by Count desc | project WmiClass, Count, ExampleCommand, Devices

// Find PowerShell processes invoking WMI cmdlets and extract the WMI class name union DeviceProcessEvents, DeviceEvents | where ProcessCommandLine has_any ("powershell","pwsh") | where ProcessCommandLine has_any ("Get-WmiObject","Get-CimInstance","Get-CimClass","gwmi","get-wmiobject","get-ciminstance") | extend CommandLine = ProcessCommandLine // Try -Class, then -Query SELECT ... FROM, then generic FROM | extend WMI_Class = coalesce( extract(@"(?i)-Class\s+([A-Za-z0-9_\.]+)", 1, CommandLine), extract(@"(?i)-Query\s+SELECT\b.*?\bFROM\s+([A-Za-z0-9_\.]+)", 1, CommandLine), extract(@"(?i)\bFROM\s+([A-Za-z0-9_\.]+)", 1, CommandLine) ) // Normalize: remove any surrounding/embedded chars that aren't part of a class name | extend WMI_Class = replace_regex(WMI_Class, "[^A-Za-z0-9_\\.]", "") | where isnotempty(WMI_Class) | project TimeGenerated, DeviceName, ProcessId, FileName, AccountName, InitiatingProcessAccountName, CommandLine, WMI_Class | order by TimeGenerated desc | distinct DeviceName, ProcessId, CommandLine, WMI_Class, TimeGenerated, AccountName | take 200

DeviceProcessEvents | where FileName has "powershell.exe" | where ProcessCommandLine matches regex "(?i)(Get-WmiObject|Invoke-WmiMethod).*?-Class\\s+[^\\s;]+" | extend WMIClass = extract("(?i)-Class\\s+([^\\s;]+)", 1, ProcessCommandLine) | where isnotempty(WMIClass) | summarize Count = count() by WMIClass | project WMIClass, Count

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("Get-WmiObject", "gwmi", "Get-CimInstance") | extend WmiClassName=extract(@"-Class\s+(\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, WmiClassName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("Get-WmiObject", "Get-CimInstance", "Invoke-WmiMethod", "win32_") | extend WmiClassQueried = extract(@"(?i)(win32_\S+)", 0, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, WmiClassQueried | order by TimeGenerated desc

DeviceProcessEvents | where FileName has_any ('powershell.exe', 'pwsh.exe') | where ProcessCommandLine has_any ('get-wmiobject', 'gwmi', 'get-ciminstance') // Extract the WMI class either passed via -Class or referenced directly (Win32_*/MSFT_*) | extend WmiClass = coalesce( extract('-class\\s+[\'\"]?([A-Za-z0-9_]+)', 1, tolower(ProcessCommandLine)), extract('(win32_[a-z0-9_]+|msft_[a-z0-9_]+)', 1, tolower(ProcessCommandLine)) ) | where isnotempty(WmiClass) | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ExecCount = count() by WmiClass, DeviceName, AccountName | order by ExecCount desc, LastSeen desc

DeviceProcessEvents | where FileName has_cs "powershell.exe" | where ProcessCommandLine has_any ("Get-WmiObject", "Get-CimInstance", "gwmi") | extend WmiClass1 = extract("(?i)-Class\\s+['\\\"]?(Win32_[^\\s'\\\"]+)", 1, ProcessCommandLine) | extend WmiClass2 = extract("(?i)FROM\\s+(Win32_[^\\s'\\\";,]+)", 1, ProcessCommandLine) | extend WmiClass = coalesce(WmiClass1, WmiClass2) | where isnotempty(WmiClass) | summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by WmiClass | project WmiClass, EventCount, FirstSeen, LastSeen | order by EventCount desc

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("Get-WmiObject", "gwmi", "Get-CimInstance", "Invoke-WmiMethod") | extend WmiClass = extract(@"(?i)(?:-ClassName|-Class)\s+([A-Za-z0-9_:.]+)", 1, ProcessCommandLine) | where isnotempty(WmiClass) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, WmiClass, ProcessCommandLine | sort by TimeGenerated desc