KQL Search

Query Details

Security Event New EX Edeployedvia Default Domainor Default Domain Controller Policies

Query

let query_frequency = 1h;
let query_period = 14d;
SecurityEvent
| where TimeGenerated > ago(query_period)
| where EventID == 4688
| where NewProcessName has_any (@"Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}", @"Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}")
| summarize
    StartTime = arg_min(TimeGenerated, *),
    EndTime = max(TimeGenerated),
    Computers = make_set(Computer),
    Accounts = make_set(Account)
    by Process
| where StartTime > ago(query_frequency)
| project
    StartTime,
    EndTime,
    Computers,
    Accounts,
    Activity,
    CommandLine,
    Process,
    NewProcessName,
    ParentProcessName

Explanation

This KQL (Kusto Query Language) query is designed to analyze security events related to specific processes over a defined period. Here's a simple breakdown of what it does:

  1. Define Timeframes:

    • query_frequency is set to 1 hour, meaning the query will focus on events that started within the last hour.
    • query_period is set to 14 days, meaning the query will look back over the last 14 days for relevant events.

  2. Filter Security Events:

    • The query searches the SecurityEvent table for events generated within the last 14 days.
    • It specifically looks for events with EventID 4688, which indicates a new process creation.

  3. Identify Specific Processes:

    • It filters for processes where the NewProcessName contains certain policy identifiers, indicating they are related to specific Windows policies.

  4. Summarize Data:

    • For each unique process, it summarizes the data by:
      • Finding the earliest (StartTime) and latest (EndTime) times the process was generated.
      • Collecting a set of unique computers (Computers) and accounts (Accounts) associated with the process.

  5. Filter Recent Activity:

    • It further filters the summarized data to include only those processes that started within the last hour.

  6. Project Relevant Information:

    • Finally, it selects and displays specific columns: StartTime, EndTime, Computers, Accounts, Activity, CommandLine, Process, NewProcessName, and ParentProcessName.

In summary, this query identifies and summarizes recent activity of specific processes related to certain Windows policies, focusing on events that started within the last hour but considering data from the past 14 days.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: May 30, 2024

Tables

SecurityEvent

Keywords

SecurityEvent

Operators

letagohas_anysummarizearg_minmaxmake_setbyproject

Actions

GitHub