KQL Search

Query Details

HomeAI ToolsDevice Query

Anomalies Anomalous Process Path Used By A User Account

Query

Anomalies
| where RuleName endswith "Anomalous Process Path used by a user account" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| mv-expand AnomalyReasons
| extend FilePath = AnomalyReasons["Value"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserName,
    FilePath,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query is searching for anomalies related to a user account using an anomalous process path. It filters out any anomalies that are in a "Flighting" status. It then extends the query to include the detail blade inputs. It expands the anomaly reasons and extends the file path. Finally, it projects various fields including the time generated, rule name, description, query, user name, file path, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

Anomalies,RuleName,RuleStatus,Query,ExtendedLinks,AnomalyReasons,FilePath,TimeGenerated,Description,UserName,Score,AnomalyDetails,Entities,Tactics,Techniques

Operators

whereendswith!=extendQuerymv-expandextendFilePathproject

Actions