let CriticalServices = dynamic(["sqlservr", "sqlwriter", "mssqlserver", "mysql", "oracle", "veeam", "backup", "exchange", "msdtc", "iisadmin", "w3svc", "sophos", "symantec", "cylance"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where (FileName =~ "taskkill.exe" or FileName =~ "net.exe" or FileName =~ "net1.exe" or FileName =~ "sc.exe")
| where ProcessCommandLine has_any (CriticalServices)
| where ProcessCommandLine has_any ("stop", "/f", "kill", "delete")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc