Hunt for the 20 most unusual connections made by Office.
Rare Connections Made By Office
Query
let ConnectionsMadeByOfficeRegKey = @'\SOFTWARE\Microsoft\Office\16.0\Common\Internet\Server Cache';
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains ConnectionsMadeByOfficeRegKey
| extend Connection = split(RegistryKey, ConnectionsMadeByOfficeRegKey, 1)
| extend Domain = extract(@"([a-z0-9|-]+\.)*[a-z0-9|-]+\.[a-z]+", 0, RegistryKey)
| summarize count(), InitatingDevices = make_set(DeviceName) by Domain
| top 20 by count_ ascAbout this query
Hunt for the 20 most unusual connections made by Office.
Query Information
Description
Hunt for the 20 most unusual connections made by Office.
Defender XDR
Sentinel
let ConnectionsMadeByOfficeRegKey = @'\SOFTWARE\Microsoft\Office\16.0\Common\Internet\Server Cache';
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains ConnectionsMadeByOfficeRegKey
| extend Connection = split(RegistryKey, ConnectionsMadeByOfficeRegKey, 1)
| extend Domain = extract(@"([a-z0-9|-]+\.)*[a-z0-9|-]+\.[a-z]+", 0, RegistryKey)
| summarize count(), InitatingDevices = make_set(DeviceName) by Domain
| top 20 by count_ asc
Explanation
This query is designed to identify the 20 least common (or most unusual) internet connections made by Microsoft Office applications on devices. Here's a simplified breakdown of what the query does:
-
Define a Registry Key: It starts by defining a specific registry key path related to Office's internet server cache.
-
Filter Registry Events: It looks at device registry events to find instances where a registry value was set, specifically focusing on those that involve the defined Office registry key.
-
Extract Connection Information: For each relevant registry event, it extracts the connection information and the domain name from the registry key.
-
Summarize Data: It summarizes the data by counting how many times each domain appears and lists the devices that initiated connections to these domains.
-
Identify Unusual Connections: Finally, it sorts these domains by the count in ascending order and selects the top 20. This means it identifies the 20 domains with the fewest connections, which are considered the most unusual.
In essence, the query helps security analysts identify potentially suspicious or rare connections made by Office applications, which could indicate unusual or unauthorized activity.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators