Find the DFE Antivirus events on compromised devices. FileInfo is stored in JSON format.
MDE Antivirus Detections By Compromised Device
Query
let CompromisedDevices = dynamic (["laptop1", "server2"]);
let SearchWindow = 48h; //Customizable h = hours, d = days
DeviceEvents
| where TimeGenerated > ago(SearchWindow)
| where DeviceName has_any (CompromisedDevices)
| where ActionType == "AntivirusDetection"
| extend FileInfo = pack_dictionary("FileName", FileName, "FileLocation", FolderPath, "SHA1", SHA1, "SHA256", SHA256, "MD5", MD5)
| summarize TotalDetections = count(), MaliciousFiles = make_set(FileInfo) by DeviceNameAbout this query
Find the DFE Antivirus events on compromised devices. FileInfo is stored in JSON format.
Defender XDR
let CompromisedDevices = dynamic (["laptop1", "server2"]);
let SearchWindow = 48h; //Customizable h = hours, d = days
DeviceEvents
| where Timestamp > ago(SearchWindow)
| where DeviceName has_any (CompromisedDevices)
| where ActionType == "AntivirusDetection"
| extend FileInfo = pack_dictionary("FileName", FileName, "FileLocation", FolderPath, "SHA1", SHA1, "SHA256", SHA256, "MD5", MD5)
| summarize TotalDetections = count(), MaliciousFiles = make_set(FileInfo) by DeviceName
Sentinel
Explanation
This query is designed to identify antivirus detection events on specific compromised devices within a specified time frame. Here's a simple breakdown:
-
Compromised Devices: The query focuses on two devices, "laptop1" and "server2", which are considered compromised.
-
Time Frame: It looks at events that occurred within the last 48 hours, but this duration can be adjusted as needed.
-
Data Source: The query searches through
DeviceEvents, which logs various activities on devices. -
Filter Criteria:
- It filters events to only include those from the compromised devices.
- It specifically looks for events where the action type is "AntivirusDetection", indicating that the antivirus software detected a threat.
-
File Information: For each detection event, it collects detailed information about the detected file, including its name, location, and various hash values (SHA1, SHA256, MD5). This information is stored in a JSON-like format.
-
Summary:
- It counts the total number of antivirus detections for each device.
- It compiles a list of all unique malicious files detected on each device.
The query is essentially used to monitor and report on antivirus detections for specific devices that are known to be compromised, providing insights into the types and frequency of threats encountered.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators