KQL Search

SecurityAlert
| where AlertName has "Rare SVCHOST service group executed" and ProviderName != "ASI Scheduled Alerts"
| extend ExtendedProperties = todynamic(ExtendedProperties)
| extend
    Account = tostring(ExtendedProperties["user name"]),
    AccountSID = tostring(ExtendedProperties["User SID"]),
    AccountLogonId = tostring(ExtendedProperties["account logon id"]),
    ProcessName = tostring(ExtendedProperties["process name"]),
    CommandLine = tostring(ExtendedProperties["command line"]),
    ProcessId = tostring(ExtendedProperties["process id"]),
    ParentProcess = tostring(ExtendedProperties["parent process"]),
    ParentProcessId = tostring(ExtendedProperties["parent process id"]),
    ResourceType = tostring(ExtendedProperties["resourceType"]),
    Computer = CompromisedEntity
// Clean Entities
| extend Entities = replace_regex(Entities, @'(\,\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}|\,{\"\$ref\"\:\"\d+\"\})|\"\$id\"\:\"\d+\"\,', '')
| summarize
    TimeGenerated = min(TimeGenerated),
    StartTime = min(StartTime),
    EndTime = max(EndTime),
    AccountLogonIds = make_set(AccountLogonId, 250),
    ProcessNames = make_set(ProcessName, 250),
    CommandLines = make_set(CommandLine, 250),
    ProcessIds = make_set(ProcessId, 250),
    ParentProcesses = make_set(ParentProcess, 250),
    ParentProcessIds = make_set(ParentProcessId, 250),
    AlertLinks = make_set(AlertLink, 250),
    Entities = make_set(todynamic(Entities)),
    take_any(RemediationSteps, Tactics, Techniques)
    by AlertName, AlertSeverity, Description, ResourceId = tolower(ResourceId), Computer, Account, AccountSID, ResourceType
| project
    TimeGenerated,
    AlertName,
    AlertSeverity,
    Description,
    RemediationSteps,
    ResourceId,
    ResourceType,
    StartTime,
    EndTime,
    Computer,
    Account,
    AccountSID,
    AccountLogonIds,
    ProcessNames,
    CommandLines,
    ProcessIds,
    ParentProcesses,
    ParentProcessIds,
    AlertLinks,
    Tactics,
    Techniques,
    Entities