DetectTorrentUse

Description

Custom detection to find use of torrenting software or browsing related to torrents.

Query · kql

DeviceNetworkEvents 
| where Timestamp > ago(7d)
| where RemoteUrl has "torrent" or RemoteUrl has "vuze" or RemoteUrl has "azureus" or RemoteUrl endswith ".tor" or InitiatingProcessFileName has "torrent" or InitiatingProcessFileName has "vuze" or InitiatingProcessFileName contains "azureus" 
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl , RemoteIP , RemotePort
Raw source DetectTorrentUse · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4011047d-6a0b-4ef0-bf62-d3eda0784e15
name: DetectTorrentUse
description: |
  Custom detection to find use of torrenting software or browsing related to torrents.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
query: |
  DeviceNetworkEvents 
  | where Timestamp > ago(7d)
  | where RemoteUrl has "torrent" or RemoteUrl has "vuze" or RemoteUrl has "azureus" or RemoteUrl endswith ".tor" or InitiatingProcessFileName has "torrent" or InitiatingProcessFileName has "vuze" or InitiatingProcessFileName contains "azureus" 
  | project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl , RemoteIP , RemotePort

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.