Dev-0056 Command Line Activity November 2021 (ASIM Version)

' This hunting query looks for process command line activity related to activity observed by Dev-0056.The command lines this query hunts for are used as part of the threat actor's post exploitation activity. This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'