KQL Search

This query is designed to identify suspicious use of the MpCmdRun.exe program, which is part of Windows Defender, to potentially discover antivirus exclusion paths. Here's a breakdown of what it does:

1. Source of Data: It examines events related to device processes (DeviceProcessEvents).

2. Filter Criteria:

   • It specifically looks for processes where the file name is MpCmdRun.exe.
   • It checks if the command line used to run this process includes the -Scan option and a scan type of 3 (-Scantype 3), which indicates a custom scan.
   • It also looks for the presence of a wildcard pipe character (|*) in the command line, which might be used to manipulate or discover paths.

3. Data Projection: The query selects and displays the following details:

   • Timestamp: When the event occurred.
   • DeviceName: The name of the device where the event was logged.
   • InitiatingProcessAccountName: The account name that initiated the process.
   • ProcessCommandLine: The full command line that was used to run MpCmdRun.exe.

4. Ordering: The results are sorted by the timestamp in descending order, showing the most recent events first.

In simple terms, this query helps detect if someone is using MpCmdRun.exe in a potentially malicious way to find out which files or paths are excluded from antivirus scans, by looking for specific patterns in the command line arguments.