ACSC Logo
© GEMXIT
GEMXIT Logo
Friday Cyber Briefing • Microsoft Defender XDR • ProcessCommandLine • KQL Threat Hunting

The Command Line Told A Different Story

The process name looked normal.

The file was signed. The path was expected. The alert severity was not even high.

Then someone expanded ProcessCommandLine.

Hidden switches appeared. An encoded command appeared. A remote download appeared.

The executable looked ordinary.

The command line did not.

Discuss Microsoft security Back to briefings
Agent Foskett Microsoft Defender XDR suspicious command line investigation
Command-Line Investigation

The alert named the process. The command line explained what the process was actually instructed to do.

Review ProcessCommandLine
Inspect hidden and encoded switches
Correlate process, network and file activity

The process looked ordinary. The arguments did not.

The investigation did not begin with an obviously malicious executable. It began with a command line that contained more intent than the filename ever could.
08:41 — Process startedPowerShell launched from an expected Windows path. Nothing about the filename alone looked unusual.
08:41 — Hidden switches appearedThe command line included NoProfile, WindowStyle Hidden and ExecutionPolicy Bypass.
08:42 — Remote content followedThe same command line reached out to an external URL and downloaded additional content.

Why command lines matter

Executable names identify the tool. Command-line arguments reveal how the tool was used.
Trusted tools can be abusedPowerShell, rundll32.exe, mshta.exe, certutil.exe and regsvr32.exe can all appear in legitimate administration.
Arguments expose intentEncodedCommand, remote URLs, user-writable paths and hidden execution switches often change the meaning of an event.
Context prevents false conclusionsThe same command may be legitimate during software deployment and suspicious when launched by a browser or Office document.

Find suspicious PowerShell command lines

Start by looking for common switches and functions frequently seen in suspicious PowerShell activity.
suspicious-powershell-command-lines.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "-windowstyle hidden", "-executionpolicy bypass", "downloadstring", "invoke-webrequest")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| order by Timestamp desc

Hunt for unusually long command lines

Long command lines can indicate obfuscation, embedded scripts, Base64 content or a chain of commands designed to avoid simple detection.
long-process-command-lines.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
DeviceProcessEvents
| where Timestamp > ago(7d)
| extend CommandLineLength = strlen(ProcessCommandLine)
| where CommandLineLength > 300
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, CommandLineLength, ProcessCommandLine
| order by CommandLineLength desc

Find suspicious parent-child context

The command line becomes even more important when a trusted application launches a script interpreter or LOLBin.
suspicious-parent-command-line-context.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "chrome.exe", "msedge.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Correlate the command with network activity

A suspicious command line becomes stronger evidence when the same process connects to a remote URL or IP shortly afterwards.
command-line-network-correlation.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe")
| where InitiatingProcessCommandLine has_any ("-enc", "downloadstring", "invoke-webrequest", "http://", "https://")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc

What the investigation revealed

The alert identified the process. The command line revealed the behaviour.
The process name was incomplete evidencePowerShell alone was not enough to determine intent. The full arguments changed the assessment.
The command reached outwardThe process connected to external infrastructure after the suspicious switches appeared.
The parent process added contextA browser or Office application launching the command made the same executable far more suspicious.

Investigation lessons

Command-line analysis turns a process event into an explanation of intent.
Do not stop at FileNameFileName tells you what executable started. ProcessCommandLine tells you how it was used.
Decode before concludingEncoded or obfuscated arguments should be safely decoded and compared with process, file and network telemetry.
Build the full timelineParent process, command line, network connection, file creation and persistence should be reviewed together.

Related Agent Foskett investigations

This briefing connects naturally to PowerShell, encoded commands, LOLBins, browser-spawned processes and endpoint process-tree investigations.
The PowerShell Command Was Base64 EncodedEncoded arguments can hide attacker intent inside trusted tools.
The EncodedCommand Was Buried In NoiseOne suspicious command hidden among thousands of normal events.
The Browser Spawned PowerShellParent-child context can completely change a process investigation.
The User Closed The Browser... The Process Didn'tThe child process continued after the visible application disappeared.
Rundll32.exe Was Only Following OrdersThe binary was trusted. The instructions were not.
The Process Tree Told The Real StoryUse process ancestry to reconstruct how execution really began.
The alert named the process. The command line explained the intent.
Inspect the arguments, parent process, network activity and the rest of the endpoint timeline.
Visit the Academy

Final thought

The filename was familiar. The command line was not.
The Logs Already Knew.The evidence was not hidden from Defender. It was sitting inside ProcessCommandLine, waiting for someone to read the whole instruction.
The filename was only the beginningTrusted executables can carry untrusted instructions. Investigate behaviour, not just names.
The command line changed the caseHidden switches, encoded content and remote URLs turned an ordinary process event into a complete investigation path.
Develop IT. Protect IT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The Command Line Told A Different Story

This Agent Foskett Friday Cyber Briefing explains how a normal-looking Windows process can become suspicious once ProcessCommandLine reveals hidden switches, encoded commands, remote downloads and attacker intent.

Microsoft Defender XDR ProcessCommandLine Investigation

Security analysts can use KQL across DeviceProcessEvents and DeviceNetworkEvents to investigate PowerShell command lines, EncodedCommand activity, hidden execution, suspicious parent-child relationships, remote URLs and long command-line arguments.

GEMXIT KQL Threat Hunting And Command-Line Analysis

GEMXIT helps organisations understand Microsoft Defender XDR, Microsoft Sentinel, endpoint telemetry, process trees, PowerShell investigations, LOLBins, command-line analysis and practical KQL threat hunting.