Rare windows shell parent process
This hunting query is designed to detect rare shell parent processes.
#event_simpleName=ProcessRollup2 event_platform=Win
| case { in(field=FileName, values=["powershell.exe", "cmd.exe", "pwsh.exe"]) | IsChild := "1"; * | IsChild := "0" }
| case { IsChild = "1" | ProcId := ParentProcessId | ChildProcess := FileName | ChildCommandLine := CommandLine;
IsChild = "0" | ProcId := TargetProcessId | ParentCommandLine := CommandLine | ParentFileName := FileName | ParentFilePath := FilePath | ParentSHA256HashData := SHA256HashData; }
| groupBy([ComputerName, ProcId], function=([count(ParentProcessId, distinct=true, as=EventCount), collect([ParentFileName, ParentSHA256HashData, ParentFilePath, ParentCommandLine, ChildProcess]), collect(ChildCommandLine, limit=4)]), limit=max)
| EventCount > 1
| groupBy([ParentSHA256HashData], function=([collect([aid, ParentFileName, ParentFilePath, ParentCommandLine, ChildProcess, ChildCommandLine]), count(ComputerName, as=HostCount)]))
| HostCount < 5
| sort([HostCount, ParentFileName], order=asc)This hunting query is designed to detect rare shell parent processes:
-
Filter for Windows Events:
#event_simpleName=ProcessRollup2``event_platform=Win -
Classify Processes:
(case { in(field=FileName, values=["powershell.exe", "cmd.exe", "pwsh.exe"]) | IsChild := "1";)- If the FileName matches a shell (powershell.exe, cmd.exe, pwsh.exe), the process is marked as a child process - Otherwise, it is marked as not a child process -
Assign Process Information:
ParentImageFileName!=/\\(powershell|cmd)\.exe$/i- For child processes (IsChild = "1"), theProcIdis set to theParentProcessId- For non-child processes (IsChild = "0"), theProcIdis set to theTargetProcessId -
Group by Computer and Process: - The query groups events by
ComputerNameandProcIdto analyze process relationships. - Calculation of the distinct count ofParentProcessIdasEventCount
