Detect Launch Agent in Microsoft Sentinel

let SuspiciousParentProcesses = dynamic(["bash", "sh", "zsh", "python3", "python", "ruby", "perl", "curl", "wget", "osascript", "node", "npm", "installer", "pkgutil", "xattr", "mktemp"]);
// Part 1: .plist file creation or modification in LaunchAgent directories
let PlistFileEvents = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "/Library/LaunchAgents/"
| where FileName endswith ".plist"
| where ActionType in ("FileCreated", "FileModified")
| extend AgentScope = case(
    FolderPath startswith "/System/Library/LaunchAgents/", "System",
    FolderPath startswith "/Library/LaunchAgents/", "Global",
    "User"
)
| extend SuspiciousWriter = InitiatingProcessFileName in~ (SuspiciousParentProcesses)
| extend AppleNameSpoof = FileName matches regex @"com\.apple\.[a-z]+\.[a-z]+\.plist"
| extend RandomName = FileName matches regex @"com\.[a-z0-9]{4,10}\.[a-z0-9]{4,10}\.plist" and not (FileName startswith "com.apple." or FileName startswith "com.microsoft." or FileName startswith "com.adobe." or FileName startswith "com.google.")
| project Timestamp, DeviceName, AccountName, DetectionType="PlistWritten",
    TargetFile=FileName, TargetPath=FolderPath, AgentScope, SuspiciousWriter, AppleNameSpoof, RandomName,
    WriterProcess=InitiatingProcessFileName, WriterCommandLine=InitiatingProcessCommandLine,
    WriterFolderPath=InitiatingProcessFolderPath;
// Part 2: launchctl load or bootstrap commands targeting LaunchAgent paths
let LaunchctlEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "launchctl"
| where ProcessCommandLine has_any ("load", "bootstrap")
| where ProcessCommandLine has "LaunchAgents" or ProcessCommandLine has ".plist"
| extend AgentScope = case(
    ProcessCommandLine has "/System/Library/LaunchAgents", "System",
    ProcessCommandLine has "/Library/LaunchAgents", "Global",
    "User"
)
| extend SuspiciousWriter = InitiatingProcessFileName in~ (SuspiciousParentProcesses)
| extend AppleNameSpoof = ProcessCommandLine matches regex @"com\.apple\.[a-z]+\.[a-z]+\.plist"
| extend RandomName = ProcessCommandLine matches regex @"com\.[a-z0-9]{4,10}\.[a-z0-9]{4,10}\.plist" and not (ProcessCommandLine has "com.apple." or ProcessCommandLine has "com.microsoft." or ProcessCommandLine has "com.adobe." or ProcessCommandLine has "com.google.")
| project Timestamp, DeviceName, AccountName, DetectionType="LaunchctlLoad",
    TargetFile=ProcessCommandLine, TargetPath=ProcessCommandLine, AgentScope, SuspiciousWriter, AppleNameSpoof, RandomName,
    WriterProcess=InitiatingProcessFileName, WriterCommandLine=InitiatingProcessCommandLine,
    WriterFolderPath=InitiatingProcessFolderPath;
PlistFileEvents
| union LaunchctlEvents
| sort by Timestamp desc