Detect Remote System Discovery in Microsoft Sentinel

let NetworkDiscoveryProcesses = dynamic(["net.exe", "net1.exe", "ping.exe", "arp.exe", "nbtstat.exe", "nltest.exe", "nmap", "masscan", "nbtscan", "ipscan"]);
let SuspiciousCommandPatterns = dynamic(["net view", "net1 view", "/domain", "net group", "nltest /dclist", "nltest /dsgetdc", "nltest /domain_trusts", "arp -a", "nbtstat -A", "nbtstat -a"]);
let PingSweepPattern = dynamic(["-n 1", "/c ping", "for /l", "1..254", "Test-Connection", "Test-NetConnection", "System.Net.NetworkInformation.Ping"]);
// Branch 1: Known network discovery tools and commands
let Branch1 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (NetworkDiscoveryProcesses)
    or ProcessCommandLine has_any (SuspiciousCommandPatterns)
| extend DiscoveryType = case(
    ProcessCommandLine has "net view" or ProcessCommandLine has "net1 view", "NetView",
    ProcessCommandLine has "nltest", "DomainDiscovery",
    ProcessCommandLine has "arp -a" or ProcessCommandLine has "arp /a", "ARPCache",
    ProcessCommandLine has "nbtstat", "NetBIOS",
    FileName =~ "ping.exe" and ProcessCommandLine has_any ("-n 1", "/c"), "PingSweep",
    FileName =~ "nmap" or FileName =~ "masscan" or FileName =~ "nbtscan", "ExternalScanner",
    "Other"
  );
// Branch 2: PowerShell-based ping sweeps and AD computer enumeration
let Branch2 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PingSweepPattern)
    or ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer", "Invoke-Portscan", "netscan", "NetworkInformation.Ping", "Resolve-DnsName", "[Net.Dns]::GetHostEntry", "ping -n 1")
| extend DiscoveryType = case(
    ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer"), "ADComputerEnum",
    ProcessCommandLine has_any ("NetworkInformation.Ping", "Test-Connection", "Test-NetConnection"), "PSPingSweep",
    ProcessCommandLine has_any ("Invoke-Portscan", "netscan"), "PSPortScan",
    "PSNetworkDiscovery"
  );
// Branch 3: hosts file access (passive discovery)
let Branch3 = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ @"C:\Windows\System32\drivers\etc"
| where FileName =~ "hosts"
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "csrss.exe")
| extend DiscoveryType = "HostsFileAccess";
union Branch1, Branch2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DiscoveryType
| sort by Timestamp desc