Personal Messaging Domains Device Network Events
Query
//This Query looks for the usage of chat websites. Once you have hunted considering downloading the list from https://github.com/jkerai1/SoftwareCertificates/blob/main/Bulk-IOC-CSVs/ChatSites.csv and uploading to Indicators in MDE
let ChatIOCs = externaldata(type: string, IndicatorValue: string)[@"https://raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/ChatSites.csv"] with (format="csv", ignoreFirstRecord=True);
let DomainList = ChatIOCs
| project IndicatorValue;
DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl in~(DomainList)
| extend VT_domain = iff(isnotempty(RemoteUrl),strcat(@"https://www.virustotal.com/gui/domain/",RemoteUrl),RemoteUrl)
| summarize count() by RemoteUrl,VT_domain //,DeviceName, InitiatingProcessAccountUpnExplanation
This query is designed to identify the usage of chat websites by analyzing network events. Here's a simple breakdown of what it does:
-
Load Chat Website Indicators: It starts by loading a list of chat website indicators from an external CSV file hosted on GitHub. This file contains domain names of chat websites.
-
Extract Domain List: From the loaded data, it extracts the domain names (indicators) into a list called
DomainList. -
Filter Network Events: It then looks at network events from devices over the past 90 days (
DeviceNetworkEvents) and filters these events to find any where theRemoteUrl(the URL being accessed) matches one of the domains in theDomainList. -
Add VirusTotal Links: For each matching event, it creates a link to VirusTotal for the domain, which can be used for further investigation.
-
Summarize Results: Finally, it summarizes the results by counting the number of times each chat website domain was accessed, along with the corresponding VirusTotal link.
In essence, this query helps identify and count instances of access to known chat websites from device network events, providing links for further investigation into each domain.
Details
Jay Kerai
Released: November 25, 2024
Tables
Keywords
Operators