CSC Suspicious Executions
Query
DeviceProcessEvents
| where ProcessVersionInfoFileDescription == @"Visual C# Command Line Compiler"
| where InitiatingProcessParentFileName == @"cmd.exe" | where InitiatingProcessCommandLine !contains @"google\mFit" | where InitiatingProcessCommandLine !contains @"[Elam]::InstallWdBoot"
Rerences:About this query
Tags Query:
Explanation
The query is filtering the DeviceProcessEvents data based on certain conditions. It is looking for events where the ProcessVersionInfoFileDescription is "Visual C# Command Line Compiler" and the InitiatingProcessParentFileName is "cmd.exe". It is also excluding events where the InitiatingProcessCommandLine contains "google\mFit" or "[Elam]::InstallWdBoot".