WMI Spawning Suspicious Child Process (Living off the Land)

Requête originale, sans modification.

let Lookback = 1h;
let SuspiciousChildProcesses = dynamic([
  "powershell.exe", "pwsh.exe", "cmd.exe", "cscript.exe", "wscript.exe",
  "mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe",
  "rundll32.exe", "msiexec.exe", "installutil.exe", "cmstp.exe",
  "msbuild.exe", "wmic.exe", "net.exe", "net1.exe", "nltest.exe",
  "whoami.exe", "ipconfig.exe", "tasklist.exe", "schtasks.exe",
  "at.exe", "sc.exe", "reg.exe"
]);
let AllowlistedCmdPatterns = dynamic([
  "ccmexec", "SMSAgent", "MOMAgent", "nessus", "qualys"
]);
let NetworkIndicators = dynamic([
  "http://", "https://", "ftp://", "Net.WebClient",
  "DownloadString", "IEX", "Invoke-Expression", "/transfer", "-urlcache"
]);
let CredentialIndicators = dynamic([
  "lsass", "mimikatz", "sekurlsa", "dump", "sam", "ntds"
]);
let MDE_Results =
  DeviceProcessEvents
  | where Timestamp >= ago(Lookback)
  | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
  | where FileName in~ (SuspiciousChildProcesses)
  | where not(ProcessCommandLine has_any (AllowlistedCmdPatterns))
  | extend
      ChildProcess       = FileName,
      ChildCmdLine       = ProcessCommandLine,
      AccountName        = InitiatingProcessAccountName,
      AccountDomain      = InitiatingProcessAccountDomain,
      HostName           = DeviceName,
      EventTime          = Timestamp,
      NetworkActivity    = ProcessCommandLine has_any (NetworkIndicators),
      CredentialActivity = ProcessCommandLine has_any (CredentialIndicators)
  | project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
      ChildCmdLine, NetworkActivity, CredentialActivity;
let SecEvent_Results =
  SecurityEvent
  | where TimeGenerated >= ago(Lookback)
  | where EventID == 4688
  | where ParentProcessName endswith "\\WmiPrvSE.exe"
  | extend ChildProcess = tostring(split(NewProcessName, "\\")[-1])
  | where ChildProcess in~ (SuspiciousChildProcesses)
  | where not(CommandLine has_any (AllowlistedCmdPatterns))
  | extend
      ChildCmdLine       = CommandLine,
      AccountName        = SubjectUserName,
      AccountDomain      = SubjectDomainName,
      HostName           = Computer,
      EventTime          = TimeGenerated,
      NetworkActivity    = CommandLine has_any (NetworkIndicators),
      CredentialActivity = CommandLine has_any (CredentialIndicators)
  | project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
      ChildCmdLine, NetworkActivity, CredentialActivity;
union MDE_Results, SecEvent_Results
| extend RiskScore = iif(CredentialActivity == true, 3, iif(NetworkActivity == true, 2, 1))
| sort by RiskScore desc, EventTime desc