Data copied to other location than C drive

Description

Check all created files. That does not have extension ps1, bat or cmd to avoid IT Pro scripts. That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc. This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.

Query · kql

DeviceFileEvents
| where ActionType == "FileCreated"
| extend extension= extract(@".*(\..*)$",1,FileName)
| where extension !in (".ps1",".bat",".cmd")
| extend DriveLetterOrShare=split(FolderPath,':')[0]
| where DriveLetterOrShare != 'C'
| project tostring(DriveLetterOrShare), FolderPath, FileName, DeviceId, DeviceName, ReportId, Timestamp, ShareName, IsAzureInfoProtectionApplied, SensitivityLabel, SensitivitySubLabel, InitiatingProcessFileName, InitiatingProcessAccountUpn, InitiatingProcessCommandLine
Raw source Data copied to other location than C drive · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8899867b-0fd8-4cfd-b6f0-0f04ef37142c
name: Data copied to other location than C drive
description: |
  Check all created files.
  That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
  That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
  This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
query: |
  DeviceFileEvents
  | where ActionType == "FileCreated"
  | extend extension= extract(@".*(\..*)$",1,FileName)
  | where extension !in (".ps1",".bat",".cmd")
  | extend DriveLetterOrShare=split(FolderPath,':')[0]
  | where DriveLetterOrShare != 'C'
  | project tostring(DriveLetterOrShare), FolderPath, FileName, DeviceId, DeviceName, ReportId, Timestamp, ShareName, IsAzureInfoProtectionApplied, SensitivityLabel, SensitivitySubLabel, InitiatingProcessFileName, InitiatingProcessAccountUpn, InitiatingProcessCommandLine

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.