let WebServers = dynamic(["beasvc.exe", "coldfusion.exe", "httpd.exe", "owstimer.exe", "visualsvnserver.exe", "w3wp.exe", "tomcat", "apache2", "nginx"]);
let ShellProcesses = dynamic(["powershell.exe", "powershell_ise.exe", "cmd.exe", "bash", "sh"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessParentFileName in~ (WebServers) or InitiatingProcessFileName in~ (WebServers)
| where FileName in~ (ShellProcesses) or InitiatingProcessFileName in~ (ShellProcesses)
| where FileName !in~ ("csc.exe", "php-cgi.exe", "conhost.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName, AccountName
| sort by Timestamp desc