KQL Search

This query is designed to detect potential NTLMv2 hash leaks via COM auto-execution. Here's a simplified explanation of what it does:

1. Define a Time Frame: The query looks at events that occurred within the last hour (QueryPeriod = 1h).

2. Identify Successful Local Logons:

   • It searches for logon events (DeviceLogonEvents) where the logon was successful (LogonSuccess) and was done interactively (LogonType == "Interactive").
   • It filters these events to include only those where the logon was local (IsLocalLogon is true).
   • It then creates a list of distinct device names where these logons occurred.

3. Detect Network Connections:

   • It examines network events (DeviceNetworkEvents) within the same time frame.
   • It looks for successful network connections (ConnectionSuccess) to port 445, which is commonly used for SMB (Server Message Block) protocol.
   • It filters these connections to include only those made to public IP addresses (RemoteIPType == "Public").
   • Finally, it checks if these connections are coming from any of the devices identified in the successful local logons list.

In essence, the query is trying to find devices that have had a successful local logon and then made a successful network connection to a public IP on port 445, which could indicate a potential NTLMv2 hash leak.