Hunting — Suspicious PowerShell Execution
The prompt
In Microsoft Defender XDR advanced hunting, write and run a KQL query to find PowerShell executions in the last 7 days where: - The process was launched by a non-standard parent (not explorer.exe, svchost.exe, or scheduled tasks) - The command line contains encoded commands (-EncodedCommand or -enc) or downloads (Invoke-WebRequest, IEX, DownloadString) Return results as a table with columns: device name, initiating process, PowerShell command line (truncated to 200 chars), timestamp, and logged-in user. Sort by timestamp descending. Limit to 50 results.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Threat Hunter, SOC Analyst L3
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.