↳ GitHub sourceAnalytics ruleMedium

Process Creation with Suspicious CommandLine Arguments

Description

This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed.

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CrowdStrikeFalconEndpointProtection MicrosoftThreatProtection SentinelOne VMwareCarbonBlack CiscoSecureEndpoint TrendMicroApexOne TrendMicroApexOneAma

Data types

CommonSecurityLog SecurityAlert SentinelOne_CL CarbonBlackEvents_CL CiscoSecureEndpoint_CL TMApexOneEvent

KQL query

Original query, unchanged.

_ASim_ProcessEvent
| where EventType == 'ProcessCreated'
| extend CommandLineArgs = strcat_array(array_slice(split(CommandLine, " "), 1, -1), " ")
| where strlen(CommandLineArgs) > 0
| where CommandLineArgs contains "base64"
| project
TimeGenerated,
DvcHostname,
DvcIpAddr,
DvcDomain,
TargetUsername,
TargetUsernameType,
TargetProcessName,
TargetProcessId,
CommandLine
| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername)
| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername)
| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)
| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')

Declared entities

HostIPAccountProcess

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Malware Protection Essentials/Analytic Rules/SuspiciousProcessCreation.yaml ↗
Commit: 9800e51 ↗
Source identifier: fdbcc0eb-44fb-467e-a51d-a91df0780a81

Additional source files 2

Solutions/Malware Protection Essentials/Analytic Rules/SuspiciousProcessCreation.yamlsource ↗Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.