Detect Suspicious Files Dropped Into Public Folder
Query
DeviceEvents
| where FolderPath contains "Users\\Public" and FileName !endswith ".lnk"
| distinct DeviceName, ActionType, FileName, FolderPathAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1074.001 | Data Staged: Local Data Staging |
Author: Sergio Albea (28/05/2025)
Detect suspicious files dropped into Public Folder
One of the key behaviors often observed during ransomware attacks includes dropping ransom notes in the C:\Users\Public folder. These actions are designed to ensure that all users on the infected machine are made aware of the compromise. Fortunately, if your environment monitors for file creation events in these paths, you may be able to detect such activities promptly. This can enable quick response actions—such as alerting, isolating the device (using Detection Rules Actions), or initiating automated investigation. I recommend you to execute this KQL query to see if you have some false positive to whitelist them as I have with .lnk files ( basically browser shortcuts)
Explanation
This query is designed to detect suspicious files that are created in the "C:\Users\Public" folder on a Windows machine. This folder is often used by ransomware to drop ransom notes, making it a key indicator of a potential ransomware attack. The query specifically looks for files that are not shortcuts (files ending with ".lnk"), as these are common and typically not malicious.
Here's a simple breakdown of what the query does:
- Monitors File Creation: It checks for any new files created in the "C:\Users\Public" directory.
- Excludes Shortcuts: It filters out files that end with ".lnk" to avoid false positives from common browser shortcuts.
- Identifies Key Details: It lists the device name, action type, file name, and folder path for any suspicious files found.
- Facilitates Quick Response: By identifying these files, security teams can quickly respond to potential threats, such as by alerting, isolating the device, or starting an automated investigation.
The query is a proactive measure to detect and respond to ransomware attacks by monitoring a common tactic used by attackers.
