Network footprint (3)

Description

Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL. Ensure to update RemoteIP and RemoteURL variable. For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.

Query · kql

// Query 4 Search for specific network communication of a Remote IP or URL that also discovers related file creation events
// Ensure to update RemoteIP and RemoteURL variable.
DeviceFileEvents
| where FileOriginUrl == "IP ADDRESS GOES HERE" or FileOriginUrl contains "URL GOES HERE" or FileOriginReferrerUrl contains "URL GOES HERE"
| project DeviceName, Timestamp, FileName, FileOriginUrl, FileOriginIP, FileOriginReferrerUrl, SHA1
Raw source Network footprint (3) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 44b02f8c-d206-4e1a-9859-6aa06b80c346
name: Network footprint (3)
description: |
  Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
  Ensure to update RemoteIP and RemoteURL variable.
  For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
query: |
  // Query 4 Search for specific network communication of a Remote IP or URL that also discovers related file creation events
  // Ensure to update RemoteIP and RemoteURL variable.
  DeviceFileEvents
  | where FileOriginUrl == "IP ADDRESS GOES HERE" or FileOriginUrl contains "URL GOES HERE" or FileOriginReferrerUrl contains "URL GOES HERE"
  | project DeviceName, Timestamp, FileName, FileOriginUrl, FileOriginIP, FileOriginReferrerUrl, SHA1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.