Multiple Uncommon Loaded Image Connection To Suspicious Domain

Query

let query_frequency = 1h;
let query_period = 14d;
let suspicious_domains = dynamic([
	@"d\d[a-z0-9]{12}\.cloudfront\.net",
	@"[\-\w]+\-[a-f0-9]{3,5}\.kxcdn\.com",
	@"[\-\w]+\-[a-z0-9]{16}\.\w\d\d\.azurefd\.net",
    @"[\-\w]+\.[a-z0-9]+\.cloudapp\.azure\.com",
	@"portswigger\.net",
	@"oastify\.com",
	@"whatismyip\.com",
	@"whatismyip\.net",
	@"whatismyipaddress\.com"
]);
//let excluded_urls = dynamic(["uhf-exp-fd-gbcrdgggfbggh0g3.b02.azurefd.net"]);
let excluded_company_names = dynamic([""]);
let excluded_original_names = dynamic([""]);
DeviceNetworkEvents
| where Timestamp > ago(query_period)
| where RemoteUrl matches regex strcat_array(suspicious_domains, "|") // and not(InitiatingProcessAccountSid in ("S-1-5-18", "S-1-5-20"))
//| where not(RemoteUrl has_any (excluded_urls))
| where not(InitiatingProcessUniqueId == 0)
| project DeviceId, DeviceName, LocalIP, ActionType, RemoteIP, RemotePort, RemoteUrl, Protocol, InitiatingProcessUniqueId
| as _AuxiliarEvents
| join kind=inner (
    DeviceImageLoadEvents
    | where Timestamp > ago(query_period)
    | where not(InitiatingProcessUniqueId == 0) and (isnotempty(SHA1) or isnotempty(SHA256) or isnotempty(MD5)) and DeviceId in (toscalar(_AuxiliarEvents | summarize make_set(DeviceId)))
    | project-away DeviceName, ActionType
    ) on DeviceId, InitiatingProcessUniqueId
| project-away DeviceId1, InitiatingProcessUniqueId1
| summarize
    StartTime = arg_min(Timestamp, *),
    EndTime = max(Timestamp),
    DeviceNamesSample = array_sort_asc(make_set(DeviceName, 100)),
    RemoteUrlsSample = array_sort_asc(make_set(RemoteUrl, 100))
    by SHA1, SHA256, MD5
| where StartTime > ago(query_frequency)
| invoke FileProfile("SHA1", 1000)
| where not(GlobalPrevalence > 10000)
| where not(GlobalPrevalence > 1000 and GlobalFirstSeen < ago(query_period))
| where not(GlobalPrevalence > 1000 and GlobalFirstSeen < ago(query_frequency) and SignatureState == "SignedValid")
| where not(GlobalPrevalence > 500 and InitiatingProcessVersionInfoCompanyName in (excluded_company_names) and InitiatingProcessVersionInfoOriginalFileName in (excluded_original_names))
| project
    StartTime,
    EndTime,
    DeviceNamesSample,
    RemoteUrlsSample,
    Timestamp = StartTime,
    DeviceId,
    DeviceName,
    LocalIP,
    ActionType,
    RemoteIP,
    RemotePort,
    RemoteUrl,
    Protocol,
    FileName,
    FolderPath,
    SHA1,
    SHA256,
    MD5,
    FileSize,
    GlobalPrevalence,
    GlobalFirstSeen,
    GlobalLastSeen,
    SignatureState,
    InitiatingProcessAccountName,
    InitiatingProcessAccountSid,
    InitiatingProcessAccountUpn,
    InitiatingProcessAccountObjectId,
    InitiatingProcessFileName,
    InitiatingProcessFolderPath,
    InitiatingProcessCommandLine,
    InitiatingProcessCreationTime,
    IsInitiatingProcessRemoteSession,
    InitiatingProcessParentFileName,
    InitiatingProcessVersionInfoCompanyName,
    InitiatingProcessVersionInfoProductName,
    InitiatingProcessVersionInfoOriginalFileName,
    InitiatingProcessVersionInfoInternalFileName,
    InitiatingProcessVersionInfoFileDescription,
    InitiatingProcessVersionInfoProductVersion,
    InitiatingProcessUniqueId,
    ReportId

Explanation

This KQL query is designed to identify potentially suspicious network activity on devices by analyzing network events and file loads. Here's a simplified breakdown of what the query does:

Define Parameters:
- query_frequency: The frequency of the query execution, set to 1 hour.
- query_period: The time period over which data is analyzed, set to 14 days.
- suspicious_domains: A list of domain patterns considered suspicious, including specific domains and regex patterns for dynamic domains.
Filter Network Events:
- The query looks at DeviceNetworkEvents from the last 14 days.
- It filters events where the RemoteUrl matches any of the suspicious domain patterns.
- It excludes events where the InitiatingProcessUniqueId is 0 (indicating no initiating process).
Join with File Load Events:
- The query joins these network events with DeviceImageLoadEvents to find corresponding file load events on the same device and process.
- It ensures that the file load events have valid hash values (SHA1, SHA256, or MD5).
Summarize Data:
- The query summarizes the data by file hashes (SHA1, SHA256, MD5), capturing the start and end times of the events, and samples of device names and remote URLs involved.
Filter by File Prevalence:
- It invokes a FileProfile function to get global prevalence data for the files.
- It filters out files that are too prevalent globally, as these are less likely to be suspicious.
- Additional filters exclude files based on their prevalence and signature state.
Project Relevant Information:
- Finally, the query projects a wide range of information about the events, including timestamps, device details, network details, file details, and initiating process information.

In essence, this query is designed to detect and analyze potentially suspicious network activity and file loads on devices, focusing on specific domain patterns and filtering out common or benign files based on global prevalence data.

Details

Jose Sebastián Canós

Released: July 13, 2026

Tables

DeviceNetworkEventsDeviceImageLoadEvents

Keywords

DeviceNetworkEventsImageLoadFileProfile

Operators

letdynamicagomatches regexstrcat_arraynotinisnotemptytoscalarsummarizemake_setarray_sort_ascarg_minmaxbyinvokewhereprojectproject-awayjoinonkindinner

Actions

GitHub

KQL Search