File footprint

Description

Query #1 - Find the machines on which this file was seen. TODO - set file hash to be a SHA1 hash of your choice...

Query · kql

let fileHash = "e152f7ce2d3a4349ac583580c2caf8f72fac16ba";
find in (DeviceFileEvents, DeviceProcessEvents, DeviceEvents, DeviceRegistryEvents, DeviceNetworkEvents, DeviceImageLoadEvents)
where SHA1 == fileHash or InitiatingProcessSHA1 == fileHash
project DeviceName, ActionType, FileName, InitiatingProcessFileName, Timestamp, SHA1, InitiatingProcessSHA1
| project DeviceName, ActionType, Timestamp, 
          FileName = iff(SHA1 == fileHash, FileName, InitiatingProcessFileName),
          MatchedSide=iff(SHA1 == fileHash, iff(InitiatingProcessSHA1 == fileHash, "Both", "Child"), "Parent")
| summarize makeset(ActionType), FirstTimestamp=min(Timestamp), (LastTimestamp, LastActionType)=arg_max(Timestamp, ActionType) by FileName, MatchedSide, DeviceName
| top 1000 by LastTimestamp desc
| sort by DeviceName, LastTimestamp desc
Raw source File footprint · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 20f3eec2-63e5-459c-aa61-64996ee2971d
name: File footprint
description: |
  Query #1 - Find the machines on which this file was seen.
  TODO - set file hash to be a SHA1 hash of your choice...
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
  - DeviceProcessEvents
  - DeviceEvents
  - DeviceRegistryEvents
  - DeviceNetworkEvents
  - DeviceImageLoadEvents
query: |
  let fileHash = "e152f7ce2d3a4349ac583580c2caf8f72fac16ba";
  find in (DeviceFileEvents, DeviceProcessEvents, DeviceEvents, DeviceRegistryEvents, DeviceNetworkEvents, DeviceImageLoadEvents)
  where SHA1 == fileHash or InitiatingProcessSHA1 == fileHash
  project DeviceName, ActionType, FileName, InitiatingProcessFileName, Timestamp, SHA1, InitiatingProcessSHA1
  | project DeviceName, ActionType, Timestamp, 
            FileName = iff(SHA1 == fileHash, FileName, InitiatingProcessFileName),
            MatchedSide=iff(SHA1 == fileHash, iff(InitiatingProcessSHA1 == fileHash, "Both", "Child"), "Parent")
  | summarize makeset(ActionType), FirstTimestamp=min(Timestamp), (LastTimestamp, LastActionType)=arg_max(Timestamp, ActionType) by FileName, MatchedSide, DeviceName
  | top 1000 by LastTimestamp desc
  | sort by DeviceName, LastTimestamp desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.