KQL Search

This query is designed to detect the installation of a service associated with the "winexe" remote administration tool, which can be used for lateral movement within a network. Here's a breakdown of what the query does:

1. Source: It looks at DeviceEvents, which are records of various actions performed on devices.
2. Filter by ActionType: It filters these events to only include those where the ActionType is 'ServiceInstalled', indicating a new service has been installed.
3. Parse Additional Fields: It extracts additional information from the AdditionalFields column by parsing it as JSON.
4. Check for winexe Service: It then checks if the parsed ServiceName contains "winexesvc", which is the service name used by the winexe tool.

In summary, this query identifies instances where the winexe tool has been installed as a service on a device, which could indicate potential lateral movement activity within the network.