Potentially Unsanctioned Application Usage
Query
// This query looks for application names that may be unwanted using Process Name in DeviceProcessEvents. Searching by name is limited but can be fast for a quick check
let DisallowedProcessNames = externaldata (DisallowedProcess: string) [@'https://raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/Intune/DisallowedProcessList.txt'] with (format=txt);
DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where FileName in~(DisallowedProcessNames) or InitiatingProcessFileName has_any(DisallowedProcessNames)// or InitiatingProcessCommandLine has_any(DisallowedProcessNames)
| extend VT_hash = iff(isnotempty(SHA1),strcat(@"https://www.virustotal.com/gui/file/",SHA1),SHA1)
| summarize count() by FileName, InitiatingProcessFileName,ProcessVersionInfoCompanyName//VT_hash, ProcessCommandLineExplanation
This query is designed to identify potentially unwanted application names by examining process names in the DeviceProcessEvents data. Here's a breakdown of what it does:
-
Load Disallowed Process Names: It retrieves a list of disallowed process names from an external source, specifically a text file hosted on GitHub.
-
Filter Events: It looks at process events from the last 90 days (
TimeGenerated > ago(90d)) and filters them based on whether the process name (FileName) or the initiating process name (InitiatingProcessFileName) matches any of the disallowed names from the list. There's also a commented-out option to filter by command line arguments. -
VirusTotal Link: For processes with a SHA1 hash, it creates a link to VirusTotal for further investigation, although this part is not included in the final output.
-
Summarize Results: It summarizes the data by counting occurrences of each file name and initiating process file name, along with the company name associated with the process version.
In simple terms, this query checks for known unwanted applications running on devices by comparing process names against a predefined list and summarizes the findings.
Details
Jay Kerai
Released: November 25, 2024
Tables
Keywords
Operators