Device Network Events Uncommon Process Connection To Suspicious Domain

Query

let query_frequency = 1h;
let query_period = 14d;
let suspicious_domains = dynamic([
    @"d\d[a-z0-9]{12}\.cloudfront\.net",
    @"[\-\w]+\-[a-f0-9]{3,5}\.kxcdn\.com",
    @"[\-\w]+\-[a-z0-9]{16}\.\w\d\d\.azurefd\.net",
    @"[\-\w]+\.[a-z0-9]+\.cloudapp\.azure\.com",
    @"[a-z0-9]{10}\.execute\-api\.[a-z]{2}\-[a-z]+\-\d\.amazonaws\.com",
    @"portswigger\.net",
    @"oastify\.com",
    @"whatismyip\.com",
    @"whatismyip\.net",
    @"whatismyipaddress\.com"
]);
let excluded_company_names = dynamic([]);
let excluded_original_names = dynamic([]);
DeviceNetworkEvents
| where Timestamp > ago(query_period)
| where RemoteUrl matches regex strcat_array(suspicious_domains, "|") // and not(InitiatingProcessAccountSid in ("S-1-5-18", "S-1-5-20"))
| where isnotempty(InitiatingProcessFileName)
| summarize
    StartTime = arg_min(Timestamp, *),
    EndTime = max(Timestamp),
    DeviceNamesSample = array_sort_asc(make_set(DeviceName, 100)),
    RemoteUrlsSample = array_sort_asc(make_set(RemoteUrl, 100))
    by InitiatingProcessVersionInfoCompanyName, InitiatingProcessVersionInfoProductName, InitiatingProcessVersionInfoOriginalFileName, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessVersionInfoFileDescription
| where StartTime > ago(query_frequency)
| invoke FileProfile("InitiatingProcessSHA1", 1000)
| where not(GlobalPrevalence > 10000)
| where not(GlobalPrevalence > 1000 and GlobalFirstSeen < ago(query_frequency) and SignatureState == "SignedValid")
| where not(GlobalPrevalence > 500 and InitiatingProcessVersionInfoCompanyName in (excluded_company_names) and InitiatingProcessVersionInfoOriginalFileName in (excluded_original_names))
| project
    StartTime,
    EndTime,
    DeviceNamesSample,
    RemoteUrlsSample,
    Timestamp = StartTime,
    DeviceId,
    DeviceName,
    LocalIP,
    ActionType,
    RemoteIP,
    RemotePort,
    RemoteUrl,
    Protocol,
    InitiatingProcessAccountName,
    InitiatingProcessAccountSid,
    InitiatingProcessAccountUpn,
    InitiatingProcessAccountObjectId,
    InitiatingProcessSHA1,
    InitiatingProcessSHA256,
    InitiatingProcessMD5,
    InitiatingProcessFileName,
    InitiatingProcessFolderPath,
    InitiatingProcessCommandLine,
    InitiatingProcessCreationTime,
    IsInitiatingProcessRemoteSession,
    InitiatingProcessParentFileName,
    InitiatingProcessVersionInfoCompanyName,
    InitiatingProcessVersionInfoProductName,
    InitiatingProcessVersionInfoOriginalFileName,
    InitiatingProcessVersionInfoInternalFileName,
    InitiatingProcessVersionInfoFileDescription,
    InitiatingProcessVersionInfoProductVersion,
    GlobalPrevalence,
    GlobalFirstSeen,
    GlobalLastSeen,
    SignatureState,
    ReportId

Explanation

This KQL query is designed to identify and analyze suspicious network activities on devices over a specified period. Here's a simplified breakdown of what the query does:

Time Frame and Frequency: The query looks at network events from the past 14 days (query_period) and is intended to be run every hour (query_frequency).
Suspicious Domains: It checks for network events where the RemoteUrl matches a list of predefined suspicious domain patterns, such as certain cloud service URLs and known suspicious sites like portswigger.net and whatismyip.com.
Filtering Criteria:
- It only considers events where the InitiatingProcessFileName is not empty.
- It excludes events based on certain conditions related to the prevalence and signature state of the initiating process.
Data Aggregation:
- It summarizes the data by grouping events based on the initiating process's version information (like company name, product name, etc.).
- It captures the earliest (StartTime) and latest (EndTime) timestamps of these events.
- It collects a sample of device names and remote URLs involved in these events.
Further Filtering:
- It filters out events that have a high global prevalence or are signed and have been seen before the query frequency period.
- It excludes events based on certain company names and original file names if specified.
Output:
- The query projects a detailed set of fields for each event, including timestamps, device information, network details, and process information.
- It also includes file hash values and signature states to help assess the legitimacy of the processes involved.

Overall, this query is used to detect potentially malicious network activities by identifying unusual or suspicious domain access patterns and filtering out known benign activities based on prevalence and signature validation.