KQL Search

This query is designed to detect the presence of files associated with BloodHound or SharpHound within an environment. BloodHound is a tool used to map Active Directory environments, and it typically generates specific JSON files containing information about users, computers, groups, organizational units (OUs), domains, and group policies (GPOs).

Here's a simple breakdown of what the query does:

1. Data Source: The query looks at DeviceFileEvents, which likely logs file creation or modification events on devices.

2. File Detection: It searches for files with names containing specific keywords:

   • "users.json"
   • "computers.json"
   • "groups.json"
   • "ous.json"
   • "domains.json"
   • "bloodhound"
   • "gpos.json"

3. Exclusions: It excludes files named "bloodhound.js" and "bloodhoundDropdown.js" from the results.

4. Purpose: The goal is to identify potential indicators of BloodHound usage by detecting files that are typically generated by the tool during its data collection phase.

Overall, this query helps security teams identify potential unauthorized or suspicious activity related to Active Directory reconnaissance using BloodHound.