A Defender KQL query for rare parent–child process pairs

Most malicious execution shows up as an unusual parent–child relationship — winword.exe spawning powershell.exe, say. Rather than hard-coding pairs, score each pair against how often it’s been seen in the last fortnight:

let lookback = 14d;
let baseline =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | summarize Seen = count() by InitiatingProcessFileName, FileName;
DeviceProcessEvents
| where Timestamp > ago(1d)
| join kind=leftouter baseline on InitiatingProcessFileName, FileName
| where isnull(Seen) or Seen < 5
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Tune the Seen < 5 threshold to your environment. Pairs that never appear in the baseline (isnull) are the most interesting.