KQL Search

This query is designed to detect potential exploitation of a specific vulnerability (CVE-2025-24054) related to NTLM. Here's a simplified breakdown of what the query does:

1. Target Table: It starts by looking at the DeviceFileEvents table, which logs file-related activities on devices.

2. Filter for File Creation: It filters the events to only include those where a file was created (ActionType == "FileCreated").

3. File Type Check: It further narrows down the results to files with names ending in ".library-ms" and checks that the file type is indeed "library-ms" by examining additional fields.

4. Exclude System Processes: It excludes events where the initiating process has a unique ID of 0, which typically represents system processes, focusing on user-initiated actions.

5. Join with Network Events: Finally, it joins these filtered file creation events with the DeviceNetworkEvents table using the InitiatingProcessUniqueId. This step correlates file creation events with network activities initiated by the same process.

In summary, the query identifies instances where a ".library-ms" file is created by a non-system process and correlates these events with network activities, potentially indicating malicious exploitation of the NTLM vulnerability.