Detection Response By Tracing File Lineage
Query
DeviceFileEvents
| extend FileOriginReferrerUrl_ext = extract(@"[^\\]+$", 0, FileOriginReferrerUrl)
| where isnotempty( FileOriginReferrerUrl)
| join kind=inner ( DeviceEvents) on $left.InitiatingProcessUniqueId == $right.InitiatingProcessUniqueId
| extend FileExtension = extract(@"\.([a-zA-Z0-9]+)$", 1, FileName)
| extend Source_Type = case(FileOriginReferrerUrl startswith "https://", "🌎 Web","📂 File")
| summarize total_Files= dcount(FileName), Files_after_execution= strcat("🗂️ ",make_set(FileName)),make_set(FileExtension),make_set(ActionType),make_set(FolderPath),SHA256_Group=make_set(SHA2561) by InitiatingProcessUniqueId,AccountUpn = strcat("👩🏻💻🧑🏾💻",InitiatingProcessAccountUpn), Device = strcat("💻 ",DeviceName), FileOriginReferrerUrl,Source_Type, OriginalFile=strcat("🚩 ",FileOriginReferrerUrl_ext)About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1105 | Ingress Tool Transfer |
Author: Sergio Albea (21/04/2025)
Detection Response by tracing File Lineage
Description: This query groups all files by their originating file—such as a ZIP archive or from a Website—and includes all the files that were extracted from it. Among the benefits of Correlating File Events Using InitiatingProcessUniqueId field we can identify:
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of files—whether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Reduces the risk of overlooking related threats during response.
- Builds context around suspicious activity for better decision-making.
- Improves threat hunting efficiency by revealing attack chains clearly.
Explanation
This query is designed to track and analyze the lineage of files on a device, focusing on their origins and any subsequent files that are extracted or created from them. Here's a simplified breakdown:
-
Purpose: The query aims to group files based on their source, such as a ZIP archive or a website, and track all files that originate from these sources. This helps in understanding the complete chain of file events related to a single action.
-
Key Benefits:
- Visibility: It provides a comprehensive view of all files associated with a particular action, like extracting a ZIP file.
- Detection: Helps in identifying hidden or secondary malicious files that might not trigger immediate alerts.
- Tracing: Allows tracing the origin of files, whether they were downloaded from the web or extracted from another file.
- Analysis: Enhances root cause analysis and incident investigation by providing context and clarity.
- Efficiency: Improves threat hunting by clearly revealing attack chains and reducing the risk of missing related threats.
-
Query Mechanics:
- File Origin: It extracts the origin of files from URLs or file paths.
- Joining Data: Combines file events with device events using a unique process identifier to correlate actions.
- File Details: Extracts file extensions and categorizes the source as either web or file-based.
- Summarization: Groups and summarizes data by counting files, listing file names, extensions, actions, and paths, and associating them with their originating process and device.
Overall, this query is a powerful tool for security analysts to trace and understand the flow of files within a system, aiding in the detection and investigation of potential security incidents.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques