-- 01_T1059.005_vbs_msiexec.spl
-- WScript launching msiexec with UEMS payload (MSUpdate_Dropper)
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_lower=lower(ParentImage)
| where match(parent_lower, "(?i)\\\(wscript|cscript)\.exe$")
| eval image_lower=lower(Image)
| where match(image_lower, "(?i)\\msiexec\.exe$")
| eval cmd_lower=lower(CommandLine)
| where like(cmd_lower, "%uemsagent.msi%")
   OR like(cmd_lower, "%server_root_crt=%")
   OR like(cmd_lower, "%ds_root_crt=%")
   OR like(cmd_lower, "%enablesilent=yes%")
| stats count
  min(_time) as firstTime
  max(_time) as lastTime
  values(CommandLine) as cmdlines
  values(ParentImage) as parents
  by Computer, User, Image
| where count > 0
| `ctime(firstTime)` | `ctime(lastTime)`
| sort - count