Enumeration Shortperiod

Query

DeviceProcessEvents
| where InitiatingProcessParentFileName =~ "cmd.exe" and FileName in ( "tasklist.exe","arp.exe", "at.exe", "attrib.exe", "dsquery.exe", "hostname.exe", "ipconfig.exe", "mimikatz.exe", "nbtstat.exe", "net.exe", "netsh.exe", "nslookup.exe", "ping.exe", "quser.exe", "qwinsta.exe", "reg.exe", "runas.exe", "schtasks.exe", "ssh.exe", "systeminfo.exe", "taskkill.exe", "telnet.exe", "tracert.exe", "wscript.exe", "xcopy.exe", "pscp.exe", "copy.exe", "robocopy.exe", "certutil.exe", "vssadmin.exe", "wevtutil.exe", "psexec.exe", "bcedit.exe", "wbadmin.exe", "icacls.exe", "diskpart.exe")
and InitiatingProcessParentFileName != @"services.exe" 
| summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId),DiscoveryCommands = dcount(ProcessCommandLine), make_set(InitiatingProcessFileName), make_set(FileName), make_set(ProcessCommandLine) by DeviceId, DeviceName, bin(Timestamp, 30m)  
| where DiscoveryCommands >= 3
References:

About this query

Tags: Query:

Explanation

This KQL (Kusto Query Language) query is designed to analyze process events on devices to identify potentially suspicious activity. Here's a simplified explanation of what the query does:

Data Source: It starts by looking at the DeviceProcessEvents table, which contains information about processes running on devices.
Filtering Criteria:
- It filters for events where the parent process is cmd.exe, which is the Windows Command Prompt.
- It further filters to include only those processes whose names are in a specified list of executable files. These files are commonly used for system administration or could be used for malicious purposes (e.g., tasklist.exe, ipconfig.exe, mimikatz.exe, etc.).
- It excludes any processes where the parent process is services.exe, which is a legitimate Windows service host process.
Data Aggregation:
- The query groups the data by DeviceId, DeviceName, and 30-minute time intervals.
- For each group, it summarizes the data to find the most recent event (arg_max function) and counts the number of distinct command lines executed (dcount).
- It also collects sets of unique initiating process file names, file names, and command lines executed.
Final Filtering:
- It only includes groups where there are three or more distinct command lines executed within the 30-minute interval, which could indicate a higher likelihood of suspicious activity.

In summary, this query is used to detect devices where multiple potentially suspicious command-line activities are initiated by cmd.exe within a short time frame, excluding those initiated by legitimate services. This could help in identifying unauthorized or malicious use of command-line tools on a network.

KQL Search