Detect Supply Chain Compromise in Microsoft Sentinel

let TrustedInstallerProcesses = dynamic([
    "msiexec.exe", "setup.exe", "install.exe", "installer.exe",
    "update.exe", "updater.exe", "autoupdate.exe", "squirrel.exe",
    "appinstaller.exe", "packageinstaller.exe", "softwareupdate.exe",
    "uninst.exe", "uninstall.exe", "patchinstaller.exe"
]);
let LOLBins = dynamic([
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "wmic.exe", "msbuild.exe", "csc.exe", "odbcconf.exe", "xwizard.exe",
    "installutil.exe", "regasm.exe", "regsvcs.exe", "schtasks.exe", "at.exe"
]);
// Part 1: Installer/updater processes spawning suspicious child processes
let InstallerSpawnsLOLBin = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (TrustedInstallerProcesses)
| where FileName in~ (LOLBins)
| extend DetectionSource = "InstallerSpawnedLOLBin"
| project Timestamp, DeviceName, AccountName,
         DetectionSource,
         ParentProcess = InitiatingProcessFileName,
         ParentCommandLine = InitiatingProcessCommandLine,
         ParentSHA1 = InitiatingProcessSHA1,
         ChildProcess = FileName,
         ChildCommandLine = ProcessCommandLine,
         ChildFolderPath = FolderPath;
// Part 2: Legitimate signed software spawning shells after a recent file write to its install directory
let SignedSoftwareSpawnsShell = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where InitiatingProcessFolderPath has_any ("Program Files", "Program Files (x86)", "ProgramData")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "setup.exe")
| where InitiatingProcessVersionInfoCompanyName != ""
// Exclude common known-good parent patterns
| where not (InitiatingProcessFileName in~ ("explorer.exe", "svchost.exe", "services.exe", "taskhostw.exe"))
| extend DetectionSource = "TrustedSoftwareSpawnedShell"
| project Timestamp, DeviceName, AccountName,
         DetectionSource,
         ParentProcess = InitiatingProcessFileName,
         ParentCommandLine = InitiatingProcessCommandLine,
         ParentSHA1 = InitiatingProcessSHA1,
         ParentFolderPath = InitiatingProcessFolderPath,
         ParentCompany = InitiatingProcessVersionInfoCompanyName,
         ChildProcess = FileName,
         ChildCommandLine = ProcessCommandLine,
         ChildFolderPath = FolderPath;
// Combine both detection paths
InstallerSpawnsLOLBin
| project Timestamp, DeviceName, AccountName, DetectionSource, ParentProcess, ParentCommandLine, ParentSHA1, ChildProcess, ChildCommandLine
| union (
    SignedSoftwareSpawnsShell
    | project Timestamp, DeviceName, AccountName, DetectionSource, ParentProcess, ParentCommandLine, ParentSHA1, ChildProcess, ChildCommandLine
)
| sort by Timestamp desc