KQL Search

This query is designed to detect potentially malicious PowerShell activity that might indicate an "Exif smuggling FileFix Technique" or similar obfuscated command execution. Here's a breakdown of what the query does in simple terms:

1. Target Process: It looks for instances where the process conhost.exe is running in a headless mode and is launching PowerShell-related processes (powershell.exe, pwsh.exe, or pwsh.dll).

2. Encoded Commands: It checks if these PowerShell commands include encoded commands, which are typically indicated by the flags -e or -EncodedCommand. This is a common technique used to obfuscate the true nature of the command being executed.

3. Whitespace Check: The query looks for commands that contain more than five spaces. This can be a sign of obfuscation, where extra spaces are used to make the command harder to read or analyze.

4. UNC Path Detection: It searches for the presence of a UNC (Universal Naming Convention) path in the command. A UNC path is a way to access network resources, and its presence might indicate that the command is trying to execute something from a remote source.

Overall, this query is designed to identify suspicious PowerShell activity that uses obfuscation techniques and potentially accesses remote resources, which could be indicative of a security threat.