// Curl dowloading a script file.
let ScriptRegex = @"\.(?i)(PS[DM]?1|BAT|CMD|VB[ES]|JSE?|WS[FH]|HTA|PY|RB|P1|(BA|K|Z)?SH|PHP)(\W|$)";
union(SecurityEvent
| where EventID == 4688 and (NewProcessName endswith @"\curl.exe" or CommandLine has "curl ") and CommandLine matches regex ScriptRegex
| project TimeGenerated, Device = Computer, Account = SubjectUserName, ParentProcess = ParentProcessName, Process = NewProcessName, CommandLine = CommandLine, Source = "SecurityEvent"),
(DeviceProcessEvents
| where (FileName == "curl.exe" or ProcessCommandLine has "curl ") and ProcessCommandLine matches regex ScriptRegex
| project TimeGenerated, Device = DeviceName, Account = AccountName, ParentProcess = InitiatingProcessParentFileName, Process = FileName, CommandLine = ProcessCommandLine, Source = "DeviceProcessEvents")
| order by TimeGenerated desc

// Detect multiple network discovery commands run on a single host, by a single user, within a short period of time; excludes common legitimate patterns and system account activity.
let TimeWindow = 10m;
let DiscoveryTools = dynamic(["net.exe", "net1.exe", "ipconfig.exe", "hostname.exe", "whoami.exe", "nltest.exe", "nbtstat.exe", "arp.exe", "route.exe", "quser.exe", "query.exe", "qwinsta.exe", "ping.exe", "tracert.exe", "netsh.exe", "dsquery.exe", "dsget.exe", "wmic.exe", "nslookup.exe", "whois.exe"]);
let PowerShellDiscoveryTerms = dynamic(["get-netipconfiguration", "get-netipaddress", "get-netroute", "get-nettcpconnection", "get-netneighbor", "get-netadapter", "get-dnsclientserveraddress", "resolve-dnsname", "test-connection", "get-adcomputer", "get-aduser", "get-addomain", "get-adforest", "get-smbconnection", "get-smbshare", "get-localgroup", "get-localuser", "get-ciminstance win32_networkadapterconfiguration"]);
let Security4688 = SecurityEvent
| where EventID == 4688
| extend ProcessName = tolower(tostring(NewProcessName)), CommandLine = tolower(tostring(CommandLine)), Account = strcat(SubjectDomainName, "\\", SubjectUserName), Device = Computer;
let MDEProcess = DeviceProcessEvents
| extend ProcessName = tolower(tostring(FileName)), CommandLine = tolower(tostring(ProcessCommandLine)), Account = tostring(InitiatingProcessAccountName), Device = DeviceName;
let AllProcesses = union isfuzzy=true Security4688, MDEProcess
| extend NormalizedProcess = case(ProcessName endswith "net1.exe", "net.exe", ProcessName)
| project TimeGenerated, Device, Account, NormalizedProcess, CommandLine;
let DiscoveryEvents = AllProcesses
| where NormalizedProcess in (DiscoveryTools) or (NormalizedProcess in ("powershell.exe","powershell_ise.exe", "pwsh.exe") and CommandLine has_any (PowerShellDiscoveryTerms))
| extend DiscoveryTechnique = case(NormalizedProcess in ("powershell.exe","powershell_ise.exe", "pwsh.exe"), "PowerShell", NormalizedProcess);
DiscoveryEvents
| summarize DiscoveryCount = dcount(DiscoveryTechnique), ToolsUsed = array_sort_asc(make_set(DiscoveryTechnique)), Commands = make_set(CommandLine) by Device, Account, bin(TimeGenerated, TimeWindow)
| where not (set_has_element(ToolsUsed, "net.exe") and set_has_element(ToolsUsed, "ipconfig.exe") and set_has_element(ToolsUsed, "netsh.exe") and array_length(ToolsUsed) == 3) // Not necessary if DiscoveryCount set to 4 or higher.
| where DiscoveryCount > 3 and not (Account == "system" or Account endswith "$")
| sort by TimeGenerated desc

let RemoteAccessExecutables = dynamic(["aeroadmin.exe", "agent.exe", "agentmon.exe", "ammyy.exe", "anyconnect.exe", "anydesk.exe", "assist.exe", "ateraagent.exe", "beyondtrust.exe", "bomgar.exe", "chrome-remote-desktop.exe", 
"citrix.exe", "client.exe", "connectwise.exe", "control.exe", "deskreen.exe", "dwagent.exe", "dwrcc.exe", "dwrcs.exe", "forticlient.exe", "getsupport.exe", "globalprotect.exe", "go2assist.exe", "isllight.exe", "kaseya.exe", 
"liteviewer.exe", "logmein.exe", "meshagent.exe", "msra.exe", "ncentral.exe", "nomachine.exe", "nxplayer.exe", "openvpn.exe", "parsec.exe", "pcvisit.exe", "pulse.exe", "pulseway.exe", "quickassist.exe", "rdclient.exe", 
"rdpclip.exe", "realvnc.exe", "receiver.exe", "remoteassist.exe", "remotedesktopmanager.exe", "remotepc.exe", "remoteutilities.exe", "remoteviewer.exe", "rmmagent.exe", "rustdesk.exe", "rutserv.exe", "rutview.exe", 
"screenconnect.exe", "showmypc.exe", "softether.exe", "splashtop.exe", "supremo.exe", "syncro.exe", "teamviewer.exe", "teamviewer_service.exe", "termsrv.exe", "tscon.exe", "tvnserver.exe", "ultravnc.exe", "viewer.exe", 
"vmconnect.exe", "vncviewer.exe", "wg.exe", "winvnc.exe", "wireguard.exe", "workspacesapp.exe", "zohoassist.exe"]);
let CommonRemoteAccessTools = dynamic (["msrdc.exe", "mstsc.exe", "powershell.exe", "psexec.exe", "putty.exe", "pwsh.exe", "scp.exe", "sftp.exe", "ssh.exe", "sshd.exe", "telnet.exe", "winrm.cmd", "winrs.exe", "winrshost.exe", 
"winscp.exe", "wmic.exe", "msra.exe", "plink.exe"]);
let PrivilegedAccounts = _GetWatchlist('Privileged_Accounts') | project Account = tolower(SearchKey);
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess" and isnotempty(RemotePort) and (InitiatingProcessFileName in (RemoteAccessExecutables) or (InitiatingProcessFileName in (CommonRemoteAccessTools) and not(InitiatingProcessAccountName in ("system", "local service", "network service") or InitiatingProcessAccountName endswith "$")))
| where InitiatingProcessAccountName !in (PrivilegedAccounts)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, InitiatingProcessAccountName