Multiple Uncommon Loaded Image Connection To Suspicious Domain

Query

let query_frequency = 1h;
let query_period = 14d;
let suspicious_domains = dynamic([
    @"d\d[a-z0-9]{12}\.cloudfront\.net",
    @"[\-\w]+\-[a-f0-9]{3,5}\.kxcdn\.com",
    @"[\-\w]+\-[a-z0-9]{16}\.\w\d\d\.azurefd\.net",
    @"[\-\w]+\.[a-z0-9]+\.cloudapp\.azure\.com",
    @"[a-z0-9]{10}\.execute\-api\.[a-z]{2}\-[a-z]+\-\d\.amazonaws\.com",
    @"portswigger\.net",
    @"oastify\.com",
    @"whatismyip\.com",
    @"whatismyip\.net",
    @"whatismyipaddress\.com"
]);
let excluded_urls = dynamic([
    "uhf-exp-fd-gbcrdgggfbggh0g3.b02.azurefd.net",
    "vs-exp-afd-prod-endpoint-e3b9a0c0h0e8d6fd.b02.azurefd.net"
]);
let excluded_company_names = dynamic([]);
let excluded_original_names = dynamic([]);
DeviceNetworkEvents
| where Timestamp > ago(query_period)
| where RemoteUrl matches regex strcat_array(suspicious_domains, "|") // and not(InitiatingProcessAccountSid in ("S-1-5-18", "S-1-5-20"))
//| where not(RemoteUrl has_any (excluded_urls))
| where not(InitiatingProcessUniqueId == 0)
| project DeviceId, DeviceName, LocalIP, ActionType, RemoteIP, RemotePort, RemoteUrl, Protocol, InitiatingProcessUniqueId
| as _AuxiliarEvents
| join kind=inner (
    DeviceImageLoadEvents
    | where Timestamp > ago(query_period)
    | where not(InitiatingProcessUniqueId == 0) and (isnotempty(SHA1) or isnotempty(SHA256) or isnotempty(MD5)) and DeviceId in (toscalar(_AuxiliarEvents | summarize make_set(DeviceId)))
    | project-away DeviceName, ActionType
    ) on DeviceId, InitiatingProcessUniqueId
| project-away DeviceId1, InitiatingProcessUniqueId1
| summarize
    StartTime = arg_min(Timestamp, *),
    EndTime = max(Timestamp),
    DeviceNamesSample = array_sort_asc(make_set(DeviceName, 100)),
    RemoteUrlsSample = array_sort_asc(make_set(RemoteUrl, 100))
    by SHA1, SHA256, MD5
| where StartTime > ago(query_frequency)
| invoke FileProfile("SHA1", 1000)
| where not(GlobalPrevalence > 10000)
| where not(GlobalPrevalence > 1000 and GlobalFirstSeen < ago(query_period))
| where not(GlobalPrevalence > 1000 and GlobalFirstSeen < ago(query_frequency) and SignatureState == "SignedValid")
| where not(GlobalPrevalence > 500 and InitiatingProcessVersionInfoCompanyName in (excluded_company_names) and InitiatingProcessVersionInfoOriginalFileName in (excluded_original_names))
| where not(GlobalFirstSeen < ago(5 * 365d))
| project
    StartTime,
    EndTime,
    DeviceNamesSample,
    RemoteUrlsSample,
    Timestamp = StartTime,
    DeviceId,
    DeviceName,
    LocalIP,
    ActionType,
    RemoteIP,
    RemotePort,
    RemoteUrl,
    Protocol,
    FileName,
    FolderPath,
    SHA1,
    SHA256,
    MD5,
    FileSize,
    GlobalPrevalence,
    GlobalFirstSeen,
    GlobalLastSeen,
    SignatureState,
    InitiatingProcessAccountName,
    InitiatingProcessAccountSid,
    InitiatingProcessAccountUpn,
    InitiatingProcessAccountObjectId,
    InitiatingProcessFileName,
    InitiatingProcessFolderPath,
    InitiatingProcessCommandLine,
    InitiatingProcessCreationTime,
    IsInitiatingProcessRemoteSession,
    InitiatingProcessParentFileName,
    InitiatingProcessVersionInfoCompanyName,
    InitiatingProcessVersionInfoProductName,
    InitiatingProcessVersionInfoOriginalFileName,
    InitiatingProcessVersionInfoInternalFileName,
    InitiatingProcessVersionInfoFileDescription,
    InitiatingProcessVersionInfoProductVersion,
    InitiatingProcessUniqueId,
    ReportId

Explanation

This KQL (Kusto Query Language) query is designed to identify potentially suspicious network activity on devices by analyzing network events and image load events over a specified period. Here's a simplified breakdown of what the query does:

Define Parameters:
- query_frequency: The frequency at which the query is run, set to 1 hour.
- query_period: The time period over which data is analyzed, set to 14 days.
- suspicious_domains: A list of regex patterns representing potentially suspicious domains.
- excluded_urls, excluded_company_names, excluded_original_names: Lists of URLs, company names, and original file names to exclude from the analysis.
Filter Network Events:
- From the DeviceNetworkEvents table, select events within the last 14 days (query_period).
- Filter events where the RemoteUrl matches any of the suspicious domain patterns.
- Exclude events where the InitiatingProcessUniqueId is 0 (indicating no initiating process).
Join with Image Load Events:
- Join the filtered network events with DeviceImageLoadEvents on DeviceId and InitiatingProcessUniqueId.
- Ensure the image load events have valid hash values (SHA1, SHA256, or MD5) and occurred within the last 14 days.
Summarize Events:
- Summarize the data by unique file hashes (SHA1, SHA256, MD5), capturing the start and end times of events, and samples of device names and remote URLs.
Filter by File Prevalence:
- Use the FileProfile function to get global prevalence data for the files.
- Exclude files with high global prevalence or those seen globally more than 5 years ago.
- Apply additional filters based on signature validity and company/original file name exclusions.
Project Final Results:
- Select and organize relevant fields for the final output, including timestamps, device and network details, file metadata, and initiating process information.

Overall, this query aims to detect and report on suspicious network activities by correlating network and file load events, focusing on rare or unusual files and domains.