Detect Application Window Discovery in Sumo Logic CSE

(_sourceCategory=*Windows* OR _sourceCategory=*sysmon*) EventID=1
| parse "Image: *\n" as Image nodrop
| parse "CommandLine: *\n" as CommandLine nodrop
| parse "ParentImage: *\n" as ParentImage nodrop
| parse "User: *\n" as User nodrop
| toLowerCase(Image) as image_lower
| toLowerCase(CommandLine) as cmdline_lower
| toLowerCase(ParentImage) as parent_lower
| eval ScriptWindowAPI = if(
    (image_lower matches "*powershell.exe*" or image_lower matches "*pwsh.exe*" or
     image_lower matches "*wscript.exe*" or image_lower matches "*cscript.exe*" or
     image_lower matches "*mshta.exe*" or image_lower matches "*python.exe*" or
     image_lower matches "*python3.exe*" or image_lower matches "*ruby.exe*" or
     image_lower matches "*perl.exe*") and
    (cmdline_lower matches "*getforegroundwindow*" or cmdline_lower matches "*enumwindows*" or
     cmdline_lower matches "*findwindow*" or cmdline_lower matches "*getwindowtext*" or
     cmdline_lower matches "*getactivewindow*" or cmdline_lower matches "*enumchildwindows*" or
     cmdline_lower matches "*getwindowlong*" or cmdline_lower matches "*findwindowex*"),
    1, 0)
| eval PInvokePattern = if(
    (image_lower matches "*powershell.exe*" or image_lower matches "*pwsh.exe*") and
    cmdline_lower matches "*add-type*" and cmdline_lower matches "*dllimport*" and
    cmdline_lower matches "*user32*" and
    (cmdline_lower matches "*window*" or cmdline_lower matches "*hwnd*"),
    1, 0)
| eval COMShellEnum = if(
    (image_lower matches "*powershell.exe*" or image_lower matches "*wscript.exe*" or
     image_lower matches "*cscript.exe*" or image_lower matches "*mshta.exe*") and
    cmdline_lower matches "*shell.application*" and cmdline_lower matches "*windows()*",
    1, 0)
| eval AutomationToolEnum = if(
    (image_lower matches "*autoit3.exe*" or image_lower matches "*autohotkey.exe*" or
     image_lower matches "*ahk2exe.exe*" or image_lower matches "*autoit3_x64.exe*") and
    not (parent_lower matches "*explorer.exe*" or parent_lower matches "*devenv.exe*" or
         parent_lower matches "*code.exe*" or parent_lower matches "*sublime_text.exe*" or
         parent_lower matches "*atom.exe*" or parent_lower matches "*cursor.exe*"),
    1, 0)
| eval KnownWinEnumTool = if(
    image_lower matches "*winlister.exe*" or image_lower matches "*wintitles.exe*" or
    image_lower matches "*windowdetective.exe*" or image_lower matches "*spyxx.exe*" or
    image_lower matches "*spyxx_amd64.exe*" or image_lower matches "*winspector.exe*",
    1, 0)
| eval TotalScore = ScriptWindowAPI + PInvokePattern + COMShellEnum + AutomationToolEnum + KnownWinEnumTool
| where TotalScore > 0
| eval DetectionVector = if(KnownWinEnumTool=1, "Known Window Enumeration Utility",
    if(AutomationToolEnum=1, "Automation Tool Window Enumeration (Unusual Parent)",
    if(PInvokePattern=1, "PowerShell P/Invoke Window API",
    if(COMShellEnum=1, "COM Shell Window Enumeration",
    "Script Window Enumeration API"))))
| table _messageTime, _sourceHost, User, Image, CommandLine, ParentImage, DetectionVector, TotalScore
| sort by _messageTime desc