KQL Search

This KQL query is designed to help analyze and triage incidents related to a tool called ClickFix. Here's a simple breakdown of what the query does:

1. Input Variables:

   • VictimDeviceId: The ID of the device that experienced the incident.
   • TopXEvents: The number of events to collect before and after a specific action.
   • TimeFrame: The time window around the action to consider for event collection.

2. Purpose:

   • The query is used to gather and analyze different types of events related to a potential security incident on a device. It focuses on events surrounding a suspicious registry change (specifically, the "RunMRU" registry key).

3. Data Collection:

   • Pre-Infection Network Events: Collects network events that occurred before the suspicious registry change, which might indicate the source of the infection.
   • RunMRU Event: Identifies the registry change event itself, which is a key indicator of compromise.
   • Post-Infection Network Events: Collects network events that occurred after the registry change, which might show further malicious activity.
   • Post-Infection Process Events: Collects process-related events that occurred after the registry change, indicating what processes might have been affected or initiated.
   • Post-Infection File Events: Collects file-related events that occurred after the registry change, showing any file modifications or creations.

4. Output:

   • The query outputs a sorted list of events, categorized by type (network, registry, process, file), to provide a comprehensive view of the incident timeline and help in understanding the scope and impact of the incident.

This query is useful for security analysts to quickly gather relevant information about a potential security incident and make informed decisions on how to respond.