Cryptocurrency Domain Detection

//This query detects network connections to known cryptocurrency domains let Crypto = externaldata(type:string)[@"https://raw.githubusercontent.com/Ultimate-Hosts-Blacklist/ZeroDot1_CoinBlockerLists/master/domains.list"] with (format="csv", ignoreFirstRecord=True); let DomainList = Crypto | where type !startswith "#" | extend RemoteUrl = replace_string(replace_string(type, " ", ""),"0.0.0.0","") | project RemoteUrl; DeviceNetworkEvents | where RemoteUrl in~(DomainList) | summarize count() by RemoteUrl

Explanation

This query is designed to identify network connections to known cryptocurrency-related domains. Here's a simplified breakdown of what it does:

Data Import: It imports a list of cryptocurrency domains from an external source (a GitHub repository) and treats it as a CSV file, ignoring the first record which might be a header.
Data Cleaning: It filters out any lines in the imported data that start with a "#" (which are likely comments) and removes any spaces and the placeholder IP "0.0.0.0" from the domain entries.
Domain List Creation: It creates a list of cleaned domain names, referred to as DomainList.
Event Filtering: It checks network events (from DeviceNetworkEvents) to see if any of the remote URLs accessed match the domains in DomainList.
Counting Connections: It counts how many times each of these cryptocurrency domains was accessed and provides a summary of these counts, grouped by each domain (RemoteUrl).

KQL Search

Cryptocurrency Domain Detection

Query

Explanation

Details

Actions