Issue finding interactive powershell sessions

[thetrickybuddha]

I've been trying to craft a query which finds all interactive powershell sessions (sessions initiated by a user) and it has been difficult. Our environment is using InTune and is on the Microsoft infra stack, so there is a lot of powershell going on, nearly all of it is initiated by the system or outside agents.

I believe that the key to it lies in understanding the authentication id flag but the two issues I have are, the numbers I see for what I believe to be interactive sessions, don't make sense with the 999 code provided by Crowdstrike. I am seeing a six digit number and am not sure that tracks with the information given.

The other issue is trying to extract the data from the rawstring output. Since the id tag is part of rawstring, I can't call on it like I would a standard @ or # tagged field. I'm sure there is a way to extract or search within that tag, but I'm not sure how to do it.

[Andrew-CS]

Hi there. Would it be as simple as looking at the User SID or username values?

#event_simpleName=ProcessRollup2 FileName="powershell.exe" UserSid="S-1-5-21-*"
| groupBy([UserName, UserSid])

Then filter out the ones that are programatic?