CS Sacricial Processes

Query

DeviceProcessEvents
| where FileName has_any ("rundll32.exe","werfault.exe", "searchprotocolhost.exe", "gpupdate.exe", "regsvr32.exe", "svchost.exe", "msiexec.exe")
| where ProcessCommandLine matches regex "^$" 


References:

About this query

Tags:

Query:

Explanation

This KQL (Kusto Query Language) query is designed to search through device process events to find specific processes that have been executed without any command line arguments. Here's a simple breakdown:

Data Source: The query looks at DeviceProcessEvents, which contains information about processes that have run on devices.
Filter by FileName: It filters the events to include only those where the FileName is one of the following:
- rundll32.exe
- werfault.exe
- searchprotocolhost.exe
- gpupdate.exe
- regsvr32.exe
- svchost.exe
- msiexec.exe
Filter by Command Line: It further filters these events to include only those where the ProcessCommandLine is empty (i.e., there are no command line arguments). This is done using a regular expression (^$) that matches an empty string.

In summary, the query identifies instances where specific system processes have been executed without any command line arguments.