Summary of the Query

Purpose: This query is designed to detect untrusted executable files within user directories. These files are flagged by Advanced Security Rules (ASR) and are considered suspicious because they are new and have very low global prevalence, which could indicate potential malware or unauthorized software.

Detection Logic:

1. Source of Data: The query looks at DeviceEvents.
2. Conditions:
   • The event's ActionType must be "AsrUntrustedExecutableAudited".
   • The FolderPath must contain the word "users".
   • The file must have been first seen globally within the last 3 days.
   • The file must have a global prevalence of 1 or less, indicating it is very rare.

Query Breakdown:

• Filter Events: The query filters events where the FolderPath contains "users" and the ActionType is "AsrUntrustedExecutableAudited".
• Select Fields: It selects relevant fields such as Timestamp, ReportId, DeviceId, ProcessCommandLine, FileName, FolderPath, InitiatingProcessSHA1, InitiatingProcessFileName, and SHA1.
• File Profiling: It uses the SHA1 hash to profile the file.
• Further Filtering: It further filters the results to include only files that were first seen globally within the last 3 days and have a global prevalence of 1 or less.

Tags:

• Untrusted Executables
• User Directories
• Malware
• Suspicious Activity
• Advanced Security Rules (ASR)

Notes:

• The query may need some adjustments before it can be fully enabled as a detection rule.

Simplified Explanation

This query helps identify potentially dangerous new executable files in user folders that are very rare globally. It focuses on files flagged by security rules and checks if they appeared in the last 3 days and are not commonly seen worldwide. This can help in spotting malware or unauthorized software early.