Detect Executable Files in C:\Users\Public

// The start of the folderpath in the Public directory. let PublicFolder = @'C:\Users\Public'; // List with Executable File Extensions, can be adjusted or changed. let ExecutableFileExtensions = dynamic(['bat', 'cmd', 'com', 'cpl', 'ex', 'exe', 'jse', 'msc','ps1', 'reg', 'vb', 'vbe', 'ws', 'wsf', 'hta', 'js']); // Prevalence Threshold, if the file exceeds this threshold it is likely to be benign. let FilePrevalenceThreshold = 250; DeviceFileEvents | where FolderPath contains PublicFolder // Extract File Extension from the filename. | extend FileExtension = tostring(extract(@'.*\.(.*)', 1, FileName)) // Only list Files that are executable | where FileExtension in~ (ExecutableFileExtensions) | invoke FileProfile('SHA256', 10000) // Filter based on FilePrevalenceThreshold | where GlobalPrevalence <= FilePrevalenceThreshold | project Timestamp, DeviceName, FileExtension, FolderPath, GlobalPrevalence, Signer, Publisher, ReportId, DeviceId

Explanation

This query is designed to identify unusual executable files that are created in the C:\Users\Public directory and its subdirectories. This location is not typically used for storing executable files, so any files found here should be investigated as they might indicate malicious activity.

Key Points:

Purpose: To detect potentially malicious executable files in a common public directory on Windows systems.
Risk: Attackers might use this directory to hide their payloads and avoid detection.
Approach:
- The query checks for files with specific executable extensions (like .exe, .bat, .cmd, etc.).
- It filters out files that are commonly found (based on a prevalence threshold) to focus on rare and potentially suspicious files.
- The query is tailored for use with Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel, with slight differences due to feature support.

Differences in Queries:

Defender XDR: Uses the FileProfile function to assess the global prevalence of files, filtering out those that are common (prevalence above 250).
Sentinel: Does not use the FileProfile function, so it lists all executable files found in the directory without filtering by prevalence.

Actionable Steps:

Investigate any rare executable files found in C:\Users\Public to determine if they are legitimate or part of a malicious activity.
Adjust the list of executable file extensions if needed to include other potentially suspicious file types.
Use the Defender XDR query for more comprehensive results due to its ability to filter based on file prevalence.

KQL Search