Ingress Tool Transfer - Certutil abuse

// Set the timespan for the query.
let timeframe = 2*1h;
DeviceProcessEvents
| where ingestion_time() >= ago(timeframe)
| where ActionType =~ "ProcessCreated"
// Get all executions by processes with a SHA1 hash that is or was named certutil.
| where FileName =~ "certutil.exe" or ProcessVersionInfoOriginalFileName =~ "certutil.exe"
// Create a new field called CleanProcessCommandLine which gets populated with the value of ProcessCommandLine as Windows parses it for execution,
// removing any potential command line obfuscation.
| extend CleanProcessCommandLine=parse_command_line(ProcessCommandLine, "windows")
// Search for de-obfuscated commands used.
| where CleanProcessCommandLine has_any ("decode", "encode", "verify","url")
// Urlcache is the documented attribute, only url is also accepted.
// Verifyctl is the documented attribute, only verify is also accepted.
// Filter Defender deployment.
| where ProcessCommandLine !contains @"C:\Temp\MDATPDeploy\MDATPClientAnalyzer\Tools\winatp.cer"
| where not(ProcessCommandLine contains "-verify" and (ProcessCommandLine endswith ".cer" or ProcessCommandLine endswith ".cer\""))
// Begin environment-specific filter.
// End environment-specific filter.
| order by Timestamp
//
| project Timestamp, CleanProcessCommandLine, ProcessCommandLine, SHA1