KQL Search

name : Lateral movement - hunting for PsExec activities
description : 
- Case1 - hunt for "psexec" activities with DeviceProcessEvents, DeviceEvents 
- Case2 - hunt for "psexec" activities with DeviceNetworkEvents 
KQL : 
- InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event
- ProcessCommandLine         	 | string | Command line used to create the new process
reference : 
- PsExec - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
table : 
- DeviceProcessEvents, DeviceEvents, DeviceFileEvents, DeviceNetworkEvents
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceevents-table?view=o365-worldwide
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicefileevents-table?view=o365-worldwide
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicenetworkevents-table?view=o365-worldwide
query : |
   //Case1 - hunt for "psexec" activities with DeviceProcessEvents, DeviceEvents 
   union DeviceProcessEvents, DeviceEvents      
   | where Timestamp > ago(30d)    
   | where InitiatingProcessFileName =~ "PsExec.exe" or FileName =~ "PsExec.exe"    
   | where InitiatingProcessCommandLine has "psexec" or ProcessCommandLine has "psexec"    
   | summarize make_set(ProcessCommandLine) by DeviceId, DeviceName


   //Case2 - hunt for "psexec" activities with DeviceNetworkEvents
   DeviceNetworkEvents      
   | where Timestamp > ago(30d)    
   | where InitiatingProcessFileName =~ "PsExec.exe"
   | where InitiatingProcessCommandLine has "psexec"
   | summarize make_set(InitiatingProcessCommandLine) by DeviceId, DeviceName