Detect Suspicious Commands Initiated by Webserver Processes

Requête originale, sans modification.

// Suspicious commands launched by web server processes
DeviceProcessEvents 
| where (((InitiatingProcessParentFileName in("w3wp.exe", "beasvc.exe",
    "httpd.exe") or InitiatingProcessParentFileName startswith "tomcat")
    or InitiatingProcessFileName in("w3wp.exe", "beasvc.exe", "httpd.exe") or
    InitiatingProcessFileName startswith "tomcat"))
    and FileName in~('cmd.exe', 'powershell.exe')
| where ProcessCommandLine contains '%temp%'
    or ProcessCommandLine has 'wget'
    or ProcessCommandLine has 'whoami'
    or ProcessCommandLine has 'certutil'
    or ProcessCommandLine has 'systeminfo'
    or ProcessCommandLine has 'ping'
    or ProcessCommandLine has 'ipconfig'
    or ProcessCommandLine has 'timeout'
| summarize
    take_any(FileName),
    make_set(ProcessCommandLine, 100000),
    take_any(InitiatingProcessFileName),
    take_any(InitiatingProcessParentFileName)
    by DeviceId, DeviceName
| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")