KQL Search

This query is designed to detect potentially suspicious activity related to the creation of Windows shortcut files (also known as Shell Links) within the last hour. Here's a breakdown of what it does:

1. Monitored Commands: It defines a list of commands to monitor, specifically "cmd" and "powershell", which are common command-line interfaces in Windows.

2. Data Source: It examines data from DeviceEvents, which likely contains logs of various events on devices.

3. Time Filter: It filters the events to only include those that have occurred within the last hour (Timestamp > ago(1h)).

4. Event Type: It looks for events where a Shell Link (shortcut) file was created (ActionType == "ShellLinkCreateFileEvent").

5. Additional Fields: It checks that the AdditionalFields contain information about a Shell Link and that the ShellLinkShowCommand is not set to 'SW_SHOWNORMAL', which is the normal display mode for shortcuts.

6. Extract Information: It extracts the command line and icon path associated with the Shell Link from the AdditionalFields.

7. Command Line Check: It ensures that the ShellLinkCommandLine is not empty and contains any of the monitored commands ("cmd" or "powershell").

In summary, this query is looking for shortcut files created in the last hour that execute command-line operations using "cmd" or "powershell", which might indicate a potential security threat or exploitation attempt.