KQL Search

Query Details

Device Network Events Suspicious Process Connection To Cloudfront Domain

Query

DeviceNetworkEvents
| where RemoteUrl matches regex @"d\d[a-z0-9]{12}\.cloudfront\.net" and (InitiatingProcessParentFileName has "msiexec.exe" or InitiatingProcessCommandLine has "/Install")
| project
    TimeGenerated,
    DeviceName,
    LocalIP,
    ActionType,
    InitiatingProcessParentCreationTime,
    InitiatingProcessParentFileName,
    InitiatingProcessCreationTime,
    InitiatingProcessAccountUpn,
    InitiatingProcessFolderPath,
    InitiatingProcessCommandLine,
    Protocol,
    RemoteUrl,
    RemoteIP,
    RemotePort

Explanation

This query is searching through network event logs to identify specific activities related to suspicious URLs and installation processes. Here's a simplified breakdown:

  1. Data Source: It looks at the DeviceNetworkEvents table, which contains records of network-related activities on devices.

  2. Filter Criteria:

    • It checks if the RemoteUrl matches a specific pattern: a URL that starts with 'd' followed by a digit, then 12 alphanumeric characters, and ends with '.cloudfront.net'. This pattern is typical for certain Amazon CloudFront URLs.
    • It further filters the results to include only those events where either:
      • The parent process that initiated the network event is msiexec.exe, which is a Windows Installer process.
      • The command line of the initiating process includes the term "/Install", indicating an installation action.

  3. Output:

    • The query selects and displays specific columns for the filtered events:
      • TimeGenerated: When the event was logged.
      • DeviceName: The name of the device where the event occurred.
      • LocalIP: The local IP address involved in the event.
      • ActionType: The type of network action performed.
      • InitiatingProcessParentCreationTime: When the parent process was created.
      • InitiatingProcessParentFileName: The name of the parent process file.
      • InitiatingProcessCreationTime: When the initiating process was created.
      • InitiatingProcessAccountUpn: The user principal name associated with the initiating process.
      • InitiatingProcessFolderPath: The folder path of the initiating process.
      • InitiatingProcessCommandLine: The command line used to start the initiating process.
      • Protocol: The network protocol used.
      • RemoteUrl: The remote URL accessed.
      • RemoteIP: The remote IP address involved.
      • RemotePort: The remote port used.

In summary, this query is designed to identify network events that involve accessing specific CloudFront URLs and are associated with installation processes, potentially indicating suspicious or unauthorized software installations.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: July 13, 2026

Tables

DeviceNetworkEvents

Keywords

DeviceNetworkEventsRemoteUrlInitiatingProcessParentFileNameCommandLineTimeGeneratedLocalIPActionTypeCreationAccountUpnFolderPathProtocolPort

Operators

DeviceNetworkEvents|wherematches regex@"d\d[a-z0-9]{12}\.cloudfront\.net"andhasorprojectTimeGeneratedDeviceNameLocalIPActionTypeInitiatingProcessParentCreationTimeInitiatingProcessParentFileNameInitiatingProcessCreationTimeInitiatingProcessAccountUpnInitiatingProcessFolderPathInitiatingProcessCommandLineProtocolRemoteUrlRemoteIPRemotePort

Actions

GitHub