Question

You are threat hunting in Microsoft Defender XDR Advanced Hunting. A recent threat analytics report indicates attackers are launching PowerShell with Base64-encoded commands to evade detection. You want a KQL query that surfaces processes where PowerShell was invoked with an encoded command argument across all onboarded devices in the last 7 days. Which table should you query and what filter approach is most appropriate?

Accepted Answer

Query DeviceProcessEvents and filter where FileName is powershell.exe and ProcessCommandLine contains an encoded-command indicator such as '-enc' or '-EncodedCommand'

Answer

Query DeviceNetworkEvents and filter where InitiatingProcessFileName is powershell.exe and RemotePort equals 443

Answer

Query DeviceFileEvents and filter where FileName is powershell.exe and ActionType equals FileCreated

Answer

Query DeviceImageLoadEvents and filter where FileName contains System.Management.Automation.dll