KQL Search

This KQL (Kusto Query Language) query is designed to detect potential malicious activity on devices by analyzing file creation and network events. Here's a simplified explanation:

1. Time Frame: The query looks at events from the past hour (1h).

2. File Creation Check:

   • It examines DeviceFileEvents to find instances where a file was created (ActionType == "FileCreated").
   • It specifically looks for files created by processes with "tar" in their name, which might indicate file compression or archiving activity.
   • It collects a list of distinct device names where such file creation events occurred.

3. Network Activity Check:

   • It examines DeviceNetworkEvents to find HTTP connections that were inspected (ActionType == "HttpConnectionInspected").
   • It filters for outgoing connections ("direction" == 'Out') with a successful status code ("status_code" == '200').
   • It further filters these events to those where the connection was made to the United States (GeoCtry == "United States") and used port 1224 (RemotePort == "1224").
   • Finally, it checks if these network events are associated with any of the devices identified in the file creation check (DeviceName has_any(CompressData)).

In summary, this query is looking for devices that have created files using a "tar" process and have also made specific outgoing HTTP connections to the United States on port 1224, which could indicate suspicious behavior related to data exfiltration or malware activity.