Multiple Suspicious Device Name
Query
let suspicious_device_name = dynamic([
"kali",
"parrot"
]);
union isfuzzy=true
IdentityLogonEvents,
IdentityQueryEvents,
IdentityDirectoryEvents,
SecurityEvent
| where DeviceName has_any (suspicious_device_name) or WorkstationName has_any (suspicious_device_name)
| extend
SourceAccount = coalesce(AccountUpn, Account),
SourceIPAddress = coalesce(IPAddress, IpAddress),
SuspiciousDeviceName = coalesce(DeviceName, WorkstationName)Explanation
This query is designed to identify potentially suspicious activities involving specific devices. Here's a simplified breakdown:
-
Define Suspicious Device Names: It starts by listing device names that are considered suspicious, specifically "kali" and "parrot".
-
Combine Data from Multiple Sources: It merges data from four different event logs: IdentityLogonEvents, IdentityQueryEvents, IdentityDirectoryEvents, and SecurityEvent. The
isfuzzy=trueoption allows for a more flexible combination of these data sources. -
Filter for Suspicious Devices: It filters the combined data to find any records where the device name or workstation name matches any of the suspicious device names ("kali" or "parrot").
-
Extract Relevant Information: For each matching record, it extracts and standardizes key information:
SourceAccount: The user account involved, using eitherAccountUpnorAccount.SourceIPAddress: The IP address involved, using eitherIPAddressorIpAddress.SuspiciousDeviceName: The name of the suspicious device, using eitherDeviceNameorWorkstationName.
In summary, this query searches through various logs to find and highlight events involving devices with names that are typically associated with security testing or hacking tools, and it organizes the relevant details for further analysis.
Details
Jose Sebastián Canós
Released: June 26, 2024
Tables
Keywords
Operators