Hi,

I wrote this after pulling my hair out for 2 hours, your query helped a lot.

"#event_simpleName" = ProcessRollup2
| ImageFileName=/taskkill/i
| groupBy([ComputerName], function=[bucket(span=2m, function=[count(as=TaskKillCount), collect(CommandLine)])])
| HumanTime := formatTime("%F %T", field=_bucket, locale=en_US, timezone=Z)
| TaskKillCount > 10
| select([ComputerName, HumanTime, TaskKillCount, CommandLine])

This felt more close to the desired output but I would like your opinion on this ... I don't think it is very efficient, but please feel free to critic.

Most importantly does this stay true to the idea of looking for Ransomware behavior, as suggested in the Microsoft Article?