Looking for processes executions in temp directories with random file names

[fdevera]

I'm trying to get results which show randomized filenames but it's giving me randomization in the path directory location. I just want to see randomized filenames. Here's what I have so far:

eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| lookup ut_shannon_lookup word as New_Process_Name 
| where ut_shannon > 4.5 
| stats  values(ut_shannon)  as "Shannon Entropy Score" by New_Process_Name,host 
| rename  New_Process_Name as Process,host as Endpoint | sort  -"Shannon Entropy Score"

 How do I limit randomization to filename and not the whole path?

[richgalloway · Accepted solution]

To check the randomization of the filename rather than the whole path, extract the name from the New_Process_Name field.

eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| rex field=New_Process_Name "\\\(?<filename>[^\\\]+)$"
| lookup ut_shannon_lookup word as filename
| where ut_shannon > 4.5 
| stats  values(ut_shannon)  as "Shannon Entropy Score" by New_Process_Name,host 
| rename  New_Process_Name as Process,host as Endpoint | sort  -"Shannon Entropy Score"