Identify Unexpected Or Unknown Processes Running From Unusual Paths
Query
// Use Case: Filtering and sorting processes to identify and analyze non-system processes running on a Windows computer.
Process
| where not(Path contains 'C:\\Windows\\'
or Path contains 'C:\\Program Files\\'
or Path contains 'C:\\Program Files (x86)\\'
or Path contains 'C:\\Users\\')
| project ProcessId, ProcessName, Path
| order by ProcessNameExplanation
This query is designed to identify and analyze non-system processes running on a Windows computer. Here's a simple breakdown of what it does:
-
Filter Processes: It filters out processes that are located in common system directories such as:
C:\Windows\C:\Program Files\C:\Program Files (x86)\C:\Users\
This means it only includes processes that are not running from these standard system or user directories, potentially highlighting unusual or non-standard processes.
-
Select Specific Information: It selects (or "projects") only the following details about each process:
ProcessId: The unique identifier for the process.ProcessName: The name of the process.Path: The file path from which the process is running.
-
Sort the Results: Finally, it sorts the list of processes alphabetically by the
ProcessName.
In summary, this query helps in identifying and examining processes that are not running from typical system directories, which could be useful for security analysis or troubleshooting.
Details
Ugur Koc
Released: December 13, 2024
Tables
Keywords
Operators