This query will search the Data Lake for all encoded PowerShell that has been run
WITH encoded_data AS (
SELECT
calendar_time,
name,
username,
meta_hostname,
sophos_pid,
cmdline,
parent_name,
parent_sophos_pid,
query_name,
replace(substr...
SELECT
meta_hostname AS "RDP Destination",
calendar_time,
cmdline,
remote_address AS "Connected From",
local_address AS "Connected To"
FROM xdr_data
WHERE query_name = 'open_sockets'
AND cmdline LIKE '%TermService%'
ORDER BY calendar_time...
-- Software list temp table WITH software_temp AS ( SELECT DISTINCT name, MAX(version) AS version, meta_hostname FROM xdr_data WHERE query_name = 'windows_programs' Group BY name, meta_hostname ) select name AS Software_Title, version ,COUNT(version)...
