KQL Search

This query is designed to identify instances where a command line utility, specifically "sc.exe," is used to create a service on a device. Here's a breakdown of what the query does:

1. DeviceProcessEvents: This is the data source being queried, which contains events related to processes on devices.

2. where ActionType has "ProcessCreated": This filters the events to only include those where a new process has been created.

3. and FileName has "sc.exe": This further narrows down the results to processes where the executable file is "sc.exe." This is a command line utility used for managing Windows services.

4. and ProcessCommandLine contains "creat": This checks if the command line used to start the process includes the word "creat," which is likely a part of the command "create" used in service creation.

In summary, the query is looking for instances where the "sc.exe" utility is used to create a service, which could be indicative of a threat actor attempting to establish persistence or perform other malicious activities on a system.