Investigating with Microsoft Sentinel

Follow the alert into Sentinel

Pivoting means taking a clue from an alert and using it to search for related activity. For example, you can search Sentinel for the device and suspicious process identified in an EDR alert.

In this guided lab, wusvc.exe was the starting clue. The investigation searched for its activity in Sentinel, then followed the related process and network events.

Pivoting from an alert into Sentinel

01EDR alertIdentify the host and process
02Filter the logsDevice · time · indicator
03Follow related activityRelated activity and timeline

Begin with a focused search, then widen it when the evidence requires more context.

Narrow the search

Searching an entire table can return too much unrelated activity. Filter by the affected device, a relevant time range and the process or indicator you are investigating.

Expand the time range if you need to check what happened before or after.

This example filters logs for a device and process, then sorts the results in time order. Replace the example values with those from your investigation.

Example query

Event
| where TimeGenerated between (datetime(2026-01-01T10:00:00Z) .. datetime(2026-01-01T11:00:00Z))
| where Computer == "LAB-HOST"
| where EventData contains "wusvc.exe"
| order by TimeGenerated asc

Event — The log table being searched.
TimeGenerated — Filters events to the example time range.
Computer — Filters events to the specified device.
EventData contains "wusvc.exe" — Finds events containing that text in their raw event data.
order by TimeGenerated asc — Sorts events from earliest to latest.

Interpret the PowerShell activity

The walkthrough included two PowerShell commands worth examining:

-ExecutionPolicy Bypass: Allows scripts to run without the usual execution-policy restrictions for that session. Administrators may use it legitimately, so check which script ran, who launched it and what else happened.
Clear-History: Clears the current PowerShell session’s command history. It can suggest an attempt to hide activity, but it does not remove all recorded traces.

Execution policy is a script-execution safeguard. It should not be treated as a security boundary.

How attackers abuse legitimate tools

Tools such as PowerShell, AnyDesk, TeamViewer and Rclone have legitimate uses. Attackers can also abuse them to run commands, access devices remotely or transfer data.

Rclone: Copies and synchronises files with storage services. Attackers may use it to transfer stolen data. Check the command, destination and files involved, and whether the transfer was authorised.
Remote access tools: AnyDesk and TeamViewer can support normal IT work or help an attacker maintain unauthorised access. Check who installed the tool, who used it and whether its use was expected.

Persistence and exfiltration

Persistence: Maintaining access to a system. Examples include creating an unauthorised account or a startup task that runs an attacker’s program after a reboot.
Exfiltration: Transferring data out without authorisation. For example, an attacker may upload stolen files to cloud storage. Check what was transferred and where it went.

Build an investigation timeline

Put related alerts and log events in time order to understand how the activity developed. They may show execution, credential access, discovery and network communication as parts of the same sequence.

Record each event’s timestamp and evidence source. Be clear about what happened, what you suspect and what still needs checking. A command being attempted does not automatically mean it succeeded.

Know which logs are available

Collecting and storing logs has a cost. Organisations choose which systems and events to monitor based on their risks and needs, so some activity may not be recorded in the SIEM.

Check which logs are available and the time period they cover. Missing logs can leave gaps in an investigation. Finding no matching records does not necessarily mean the activity never happened.

Key takeaway

Start with the device and process identified in the alert. Filter the logs, follow related activity and build a timeline of what happened. Record what the evidence confirms and any gaps that still need investigation.