KQL Search

This query is looking for specific file events on devices. Here's a simple breakdown:

1. DeviceFileEvents: It starts by examining events related to files on devices.
2. isnotempty(FileOriginUrl): It filters to include only those events where the file's origin URL is not empty.
3. FileOriginUrl contains "cdn.discordapp.com/attachments/" or FileOriginReferrerUrl contains "cdn.discordapp.com/attachments/": It further narrows down to events where the file's origin URL or the referrer URL contains the specific string "cdn.discordapp.com/attachments/". This indicates that the file came from or was referred by a Discord attachment link.
4. FileName contains "pass": Finally, it filters the results to include only those files whose names contain the word "pass".

In summary, this query is searching for files that originated from Discord attachments and have "pass" in their filenames.