Monitoring Explorer Initiated External Traffic
Query
//Sergio Albea
DeviceNetworkEvents
| where Timestamp >= ago(1d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where RemoteIPType == "Public"
| where not(RemoteUrl has_any (dynamic(['bing.com','assets.msn.com'])))
| extend geo_ip = tostring(geo_info_from_ip_address(RemoteIP).country)
//| where geo_ip !in ('','')
| summarize Connections=count(),make_set(RemoteUrl),make_set(RemoteIP) by DeviceName,DeviceId,InitiatingProcessFileName, geo_ip, Timestamp, ReportIdAbout this query
Explanation
This query is designed to monitor and identify suspicious external network connections initiated by Windows File Explorer (explorer.exe), which could indicate a potential security threat. Here's a simple breakdown of what the query does:
-
Data Source: It looks at network events from devices, specifically focusing on connections made in the last day (
Timestamp >= ago(1d)). -
Process Filtering: It filters for events where the initiating process is
explorer.exe, which is the Windows File Explorer. -
Public IP Check: It ensures that the connections are made to public IP addresses (
RemoteIPType == "Public"), which are outside the local network. -
Exclusion of Known Safe URLs: It excludes connections to known safe URLs like
bing.comandassets.msn.comto reduce false positives. -
Geolocation: It extends the data with geolocation information to identify the country of the remote IP address.
-
Optional Country Filtering: There is an option to exclude connections to specific countries, although this part is commented out in the query.
-
Summarization: Finally, it summarizes the data by counting the number of connections and listing the unique remote URLs and IPs for each device, along with other details like the device name and timestamp.
Overall, this query helps in detecting unusual network activity initiated by File Explorer, which could be indicative of an attacker using it to transfer tools or malware from an external source.
