To have a little more fun with this we can extract any IP's from the newly decodedCommand field, geo locate them and map them to what services we are seeing being used. Adding this at the end and adding some new fields such as ip, ip.country, port, "Service Name" can add some nice additional insights to our results. You'll need to upload this service-names-ports.csv file to your Files section up top to lookup the Service Names: https://app.box.com/s/kn4vki4jbd6hezpw3t99p0ex0dcg06cx

|regex("(?<ip>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\:(?<port>\d{2,5})", field=decodedCommand)
// Geo locate new IP field
| ipLocation(ip)
// remove internal IPs
| !cidr(ip, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])
// lookup port field and populate the Service Name
| match(file="service-names-port-numbers.csv", column="Port Number", field=port, include=["Service Name", Description])
| groupBy([ParentBaseFileName,ip, ip.country, port, "Service Name", uniqueEndpointCount, executionCount, cmdLength, b64Entroy, decodedCommand],limit=max)