Getsystem
Query
DeviceProcessEvents
| where FileName ==@"cmd.exe" and ProcessCommandLine has_all ( "echo", "pipe")
References:About this query
Tags:
Query:
Explanation
The query is looking for DeviceProcessEvents where the FileName is "cmd.exe" and the ProcessCommandLine contains both "echo" and "pipe".