Detecting Text And CSV Data Dumps Via Command Line
Query
DeviceEvents
| where isnotempty(AdditionalFields)
| extend Command = tostring(parse_json(AdditionalFields).Command)
// search for commands exporting data into .txt or .csv format
| where Command endswith ".txt" or Command endswith ".csv"
// excluding known cases
| where Command !startswith "Start-Process"
| project Timestamp, DeviceName, ActionType, ProcessCommandLine, Command, InitiatingProcessAccountName, InitiatingProcessAccountUpn, ProcessRemoteSessionDeviceName, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1005 | Data from Local System |
Author: Sergio Albea (26/06/2025)
Detecting Text and CSV Data Dumps via Command Line
This KQL Query detects when a device exports data to commonly used file formats like .csv or .txt. This kind of behavior is often seen during the early stages of ransomware activity, where attackers collect internal information before exfiltrating it. If you want to detect specific commands, you can use filters like:
➡️ | 𝘸𝘩𝘦𝘳𝘦 𝘊𝘰𝘮𝘮𝘢𝘯𝘥 𝘴𝘵𝘢𝘳𝘵𝘴𝘸𝘪𝘵𝘩 "𝘎𝘦𝘵-𝘈𝘋𝘊𝘰𝘮𝘱𝘶𝘵𝘦𝘳 -𝘍𝘪𝘭𝘵𝘦𝘳 *"
➡️ | 𝘸𝘩𝘦𝘳𝘦 𝘊𝘰𝘮𝘮𝘢𝘯𝘥 𝘴𝘵𝘢𝘳𝘵𝘴𝘸𝘪𝘵𝘩 "𝘎𝘦𝘵-𝘈𝘋𝘜𝘴𝘦𝘳 -𝘍𝘪𝘭𝘵𝘦𝘳 *"
Explanation
This KQL query is designed to detect when a device exports data into text (.txt) or CSV (.csv) file formats via the command line. This activity is often associated with the early stages of ransomware attacks, where attackers gather internal data before moving it out of the network.
Here's a simple breakdown of what the query does:
- Data Source: It looks at device events that have additional fields filled out.
- Command Extraction: It extracts the command used from these additional fields.
- File Format Detection: It checks if the command ends with ".txt" or ".csv", indicating data export to these formats.
- Exclusion of Known Cases: It excludes commands that start with "Start-Process" to filter out known non-malicious activities.
- Output: It displays relevant information such as the timestamp, device name, action type, the full command line used, the command itself, the account name and UPN of the initiating process, the remote session device name, and a report ID.
This query helps in identifying potentially suspicious data export activities that could be part of a larger attack strategy.
