KQL Search

// Detects when a user downgrades a label on a file and that file is then copied to USB

//Data connector required for this query - Azure Information Protection
//Data connector required for this query - M365 Defender - Device* tables

// Timeframe = the time between the label downgrade and file copy event
let timeframe=4h;
InformationProtectionEvents
| where Time > ago(1d)
| where Activity == "DowngradeLabel"
| project LabelChangeTime=Time, User, FileDowngraded=ItemName
| join kind=inner (
    DeviceEvents
    | where TimeGenerated > ago(1d)
    | where ActionType == "UsbDriveMounted"
    | extend DriveLetter = tostring(todynamic(AdditionalFields).DriveLetter)
    | join kind=inner (DeviceFileEvents
        | where TimeGenerated > ago(1d)
        | project TimeGenerated, ActionType, FileName, FolderPath, DeviceId, DeviceName
        | extend FileCopyTime = TimeGenerated
        | where ActionType == "FileCreated"
        | extend FileCopyName = FileName
        | parse FolderPath with DriveLetter '\\' *
        | extend DriveLetter = tostring(DriveLetter)
        )
        on DeviceId, DriveLetter) 
    on $left.FileDowngraded == $right.FileCopyName
| project LabelChangeTime, FileCopyTime, FileDowngraded, DeviceName, AccountName
| where (FileCopyTime - LabelChangeTime) between (0min .. timeframe)