✄𐘗
text code block:
✄𐘗FROM logs-endpoint.events.process-* METADATA _id, _version, _index
| WHERE KQL("""event.category:process and event.type:start""")
  AND process.parent.name IN ("Code Helper (Plugin)", "Code Helper", "Code.exe", "code")
  AND process.name IN (
    "cmd.exe", "powershell.exe", "sh", "bash", "zsh",
    "dash", "nohup", "curl.exe", "curl", "wget",
    "wget.exe", "pwsh.exe"
  )
  AND TO_LOWER(process.command_line) RLIKE """.*(-ec |-enc|-encodedcommand|-nop |-w hidden|https|/dev/tcp|echo|irm |iwr |base64|nohup|http:|iex |invoke-expression|downloadstring|downloadfile|frombase64string|chmod \+|nc -e|ncat|certutil|bitsadmin|invoke-restmethod|curl.*\|.*sh|wget.*\|.*sh).*"""
  AND NOT TO_LOWER(process.command_line) RLIKE """.*(docker.internal|localhost|127.0.0.1|aka.ms/vscode-powershell).*"""
| KEEP
    _id,
    _version,
    _index,
    data_stream.namespace,
    @timestamp,
    host.name,
    host.id,
    agent.id,
    host.os.type,
    user.name,
    user.domain,
    process.name,
    process.parent.name,
    process.parent.executable,
    process.command_line,
    process.executable,
    process.parent.command_line,
    process.parent.args