Question Analysis

let ps_bins = dynamic(["powershell.exe","pwsh.exe","powershell_ise.exe"]); let dl_tokens = dynamic(["system.net.webclient","invoke-webrequest","iwr","wget","curl","start-bitstransfer","bitstransfer","downloadfile","downloadstring","invoke-restmethod","irm","new-object net.webclient"]); let survey_tokens = dynamic(["seatbelt","jaws","winpeas","powerview","powerup","privesc","recon","survey","enum","discovery","inventory","audit","hostrecon","hostenum"]); // 1) PowerShell saves a .ps1 from the web and later executes it let saved = DeviceFileEvents | where ActionType == 'FileCreated' | where FileName endswith '.ps1' or tostring(FileOriginUrl) contains '.ps1' | extend ipfn = tolower(tostring(InitiatingProcessFileName)), ipcl = tolower(tostring(InitiatingProcessCommandLine)), fromUrl = iif(isnotempty(FileOriginUrl) and ((tolower(FileOriginUrl) startswith 'http://') or (tolower(FileOriginUrl) startswith 'https://')), FileOriginUrl, '') | where ipfn in~ (ps_bins) or ipcl contains 'powershell' or ipcl contains 'pwsh' | where ipcl has_any (dl_tokens) or isnotempty(fromUrl) | project DeviceId, DeviceName, DownloadTime=TimeGenerated, ScriptFileName=FileName, ScriptPath=FolderPath, SourceUrl=fromUrl, DownloaderPid=InitiatingProcessId, DownloaderCmd=InitiatingProcessCommandLine; let exec = DeviceProcessEvents | where FileName in~ (ps_bins) | extend lc = tolower(tostring(ProcessCommandLine)) | project DeviceId, ExecTime=TimeGenerated, ExecCmd=ProcessCommandLine, lc, ExecPid=ProcessId; let saved_and_run = saved | join kind=inner (exec) on DeviceId | where ExecTime between (DownloadTime .. DownloadTime + 1d) | where lc contains tolower(ScriptFileName) or (isnotempty(ScriptPath) and lc contains tolower(ScriptPath)) | extend MatchType = 'SavedThenExecuted' | project DeviceName, DeviceId, FirstDownloadTime=DownloadTime, FirstExecTime=ExecTime, ScriptFileName, ScriptPath, SourceUrl, ExecCmd, DownloaderCmd, MatchType; // 2) In-memory fetch + execute (URL with .ps1 in the PowerShell cmdline + IEX) let inmem = DeviceProcessEvents | where FileName in~ (ps_bins) | extend ec = tostring(ProcessCommandLine), lc = tolower(tostring(ProcessCommandLine)) | where lc has_any (dl_tokens) | where lc contains '.ps1' | extend SourceUrl = tostring(extract('https?://[^\\s\'"<>]+\\.ps1', 0, ec)) | extend ScriptFileName = tostring(extract('([^/?#\\\\]+\\.ps1)', 1, SourceUrl)) | where isnotempty(ScriptFileName) | where lc has_any (dynamic(['iex','invoke-expression'])) or lc contains '|iex' or lc contains '| iex' | extend FirstDownloadTime=TimeGenerated, FirstExecTime=TimeGenerated, ScriptPath='', MatchType = 'InMemoryFetchExec' | project DeviceName, DeviceId, FirstDownloadTime, FirstExecTime, ScriptFileName, ScriptPath, SourceUrl, ExecCmd=ec, DownloaderCmd=ec, MatchType; union saved_and_run, inmem | extend IsHostSurvey = iif(tolower(coalesce(ScriptFileName, '')) has_any (survey_tokens) or tolower(coalesce(ExecCmd, '')) has_any (survey_tokens) or tolower(coalesce(SourceUrl, '')) has_any (survey_tokens), true, false) | where IsHostSurvey | summarize FirstDownloadTime=min(FirstDownloadTime), FirstExecTime=min(FirstExecTime), SourceUrl=any(SourceUrl), ExecCmd=any(ExecCmd), DownloaderCmd=any(DownloaderCmd), MatchType=any(MatchType) by DeviceName, DeviceId, ScriptFileName | order by FirstExecTime asc

DeviceProcessEvents | where InitiatingProcessFileName =~ 'powershell.exe' | where ProcessCommandLine contains 'http' or ProcessCommandLine contains '.ps1' // Filter for potential external downloads or script executions | extend ScriptFile = extract(@'-File\s+([^\s]+)@', 1, ProcessCommandLine) // Extract the script file name from the command line | where isnotnull(ScriptFile) // Ensure only rows with a detected script file are kept | summarize arg_max(TimeGenerated, *) by ScriptFile // Summarize to get the most recent event per script file | project ScriptFile, TimeGenerated, DeviceName, ProcessCommandLine // Project key fields for review

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("Invoke-WebRequest", "WebClient", "DownloadString", "Invoke-Expression", "IEX") | extend DownloadedScript = extract(@'([^/]+\.(?:ps1|psm1|ps))', 1, tostring(ProcessCommandLine)) | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, DownloadedScript | order by TimeGenerated desc

// Investigate PowerShell-based downloads and execution of a script DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessFileName =~ "powershell.exe" or FileName =~ "powershell.exe" | where ProcessCommandLine has_any ("System.Net.WebClient", "Invoke-WebRequest", "iwr", "wget", "curl", "bitsadmin", "Start-BitsTransfer", "Invoke-WebClient", "iex") or InitiatingProcessCommandLine has_any ("System.Net.WebClient", "Invoke-WebRequest", "iwr", "wget", "curl", "bitsadmin", "Start-BitsTransfer", "Invoke-WebClient", "iex") | extend DownloadedScript = extract(@"([\w\-.]+\.ps1)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, DownloadedScript | order by TimeGenerated desc

DeviceProcessEvents | where tolower(InitiatingProcessFileName) has "powershell.exe" | where InitiatingProcessCommandLine contains "http" and InitiatingProcessCommandLine contains ".ps1" | extend ScriptURL = extract(@"(https?://\S+\.ps1)", 1, InitiatingProcessCommandLine) | extend ScriptFileName = extract(@"([^/\s]+\.ps1)", 1, ScriptURL) | where isnotempty(ScriptFileName) | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ScriptURL, ScriptFileName | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "powershell.exe" | where (ProcessCommandLine contains "http" or InitiatingProcessCommandLine contains "http") and (ProcessCommandLine contains ".ps1" or InitiatingProcessCommandLine contains ".ps1") | extend CombinedCmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | extend ScriptName = extract(@"([^/\\]+\.ps1)", 0, CombinedCmdLine) | where isnotempty(ScriptName) | project TimeGenerated, DeviceName, ScriptName, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents // (Time filter is applied externally) | where FileName endswith "powershell.exe" or FileName endswith "pwsh.exe" | where ProcessCommandLine has_any ("DownloadFile", "DownloadString", "Invoke-WebRequest", "WebClient", "-OutFile") | extend ScriptFromDownloadFile = extract(@"(?i)DownloadFile\(\s*'https?://[^/]+/([^']+)'", 1, ProcessCommandLine) | extend ScriptFromDownloadString = extract(@"(?i)DownloadString\(\s*'https?://[^/]+/([^']+\.ps1)'", 1, ProcessCommandLine) | extend ScriptFromOutFile = extract(@"(?i)-OutFile\s*'([^']+\.ps1)'", 1, ProcessCommandLine) | extend ScriptFile = coalesce(ScriptFromDownloadFile, ScriptFromDownloadString, ScriptFromOutFile) | where isnotempty(ScriptFile) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ScriptFile, ProcessCommandLine | sort by TimeGenerated desc