File footprint (1)

Description

Query #1 - Find the machines on which this file was seen. TODO - set file hash to be a SHA1 hash of your choice...

Query · kql

// Query # 2 - Shows you a list of distinct IP addresses and DNS names the endpoint had network communication with through a specific file. 
// Use this list to whitelist/blacklist IP addresses or understand if there are communication with IP you are not aware of.
// Update the filename to the name you wish to investigate network communication.
let filename = "FILENAME GOES HERE";
// Builds table for distinct URLs based off filename
DeviceNetworkEvents 
| where InitiatingProcessFileName =~ filename and ( isnotempty(RemoteIP) or isnotempty(RemoteUrl) )
| project DNS=RemoteUrl, IP=RemoteIP
| distinct IP, DNS
Raw source File footprint (1) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1f80f1cf-97e1-4fb8-ad5a-e573fac7b9e3
name: File footprint (1)
description: |
  Query #1 - Find the machines on which this file was seen.
  TODO - set file hash to be a SHA1 hash of your choice...
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
query: |
  // Query # 2 - Shows you a list of distinct IP addresses and DNS names the endpoint had network communication with through a specific file. 
  // Use this list to whitelist/blacklist IP addresses or understand if there are communication with IP you are not aware of.
  // Update the filename to the name you wish to investigate network communication.
  let filename = "FILENAME GOES HERE";
  // Builds table for distinct URLs based off filename
  DeviceNetworkEvents 
  | where InitiatingProcessFileName =~ filename and ( isnotempty(RemoteIP) or isnotempty(RemoteUrl) )
  | project DNS=RemoteUrl, IP=RemoteIP
  | distinct IP, DNS

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.