Question Analysis

let window = 1h; // Optional: restrict to known core Windows CLI utilities to reduce noise let core_utils = dynamic([ 'cmd.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','bitsadmin.exe', 'whoami.exe','findstr.exe','net.exe','net1.exe','sc.exe','schtasks.exe','tasklist.exe','wevtutil.exe','wmic.exe','ftp.exe','tftp.exe','at.exe' ]); // Candidate copies into user profile, appearing to come from System32/SysWOW64 (via Previous* or initiating cmdline) let candidate_copies = DeviceFileEvents | where ActionType in~ ('FileCreated','FileCopied','FileRenamed') | where FolderPath has '\\Users\\' and FileName endswith '.exe' // Uncomment next line to limit to core utilities //| where set_has_element(core_utils, tolower(FileName)) | extend PrevPath = iff(isnotempty(PreviousFolderPath) and isnotempty(PreviousFileName), strcat(PreviousFolderPath, '\\', PreviousFileName), '') | where PrevPath has_any ('\\Windows\\System32\\','\\Windows\\SysWOW64\\') or InitiatingProcessCommandLine has_any ('\\Windows\\System32\\','\\Windows\\SysWOW64\\','%windir%\\system32','%windir%\\syswow64') | project DeviceId, DeviceName, CopiedExe=tolower(FileName), DstPath=tolower(FolderPath), CopyTime=TimeGenerated, SHA1, InitiatingProcessAccountDomain, InitiatingProcessAccountName; // Executions from a user profile path let executions = DeviceProcessEvents | where FolderPath has '\\Users\\' | project DeviceId, ExecTime=TimeGenerated, RanExe=tolower(FileName), RanPath=tolower(FolderPath), RanCmd=ProcessCommandLine, ExecSHA1=SHA1; // Strong correlation: join by SHA1 and device, then ensure execution shortly after copy let joined_sha = candidate_copies | where isnotempty(SHA1) | join kind=innerunique (executions | where isnotempty(ExecSHA1)) on $left.DeviceId == $right.DeviceId and $left.SHA1 == $right.ExecSHA1 | where ExecTime between (CopyTime .. CopyTime + window) | project DeviceId, DeviceName, CopiedExe, DstPath, CopyTime, ExecTime, RanPath; // Fallback correlation: exact path match (same device and same full path), within time window let joined_path = candidate_copies | join kind=innerunique (executions) on $left.DeviceId == $right.DeviceId | where RanPath == DstPath and ExecTime between (CopyTime .. CopyTime + window) | project DeviceId, DeviceName, CopiedExe, DstPath, CopyTime, ExecTime, RanPath; union joined_sha, joined_path | summarize FirstCopyTime=min(CopyTime), FirstExecTime=min(ExecTime), ExecutedFrom=any(RanPath) by DeviceId, DeviceName, CopiedExecutable=CopiedExe | order by FirstCopyTime asc

let CopyEvents = DeviceFileEvents | where TimeGenerated >= ago(24h) | where ActionType in ('FileCopied','FileCreated') | where InitiatingProcessFolderPath contains 'System32' | where FolderPath contains 'C:\\Users\\' | extend CopiedTime = TimeGenerated, CopiedFileName = FileName, CopiedToFolder = FolderPath, CopyingProcess = InitiatingProcessFileName, CopiedSource = InitiatingProcessFolderPath | project CopiedTime, CopiedFileName, CopiedToFolder, CopyingProcess, CopiedSource; let RunEvents = DeviceProcessEvents | where TimeGenerated >= ago(24h) | extend RunTime = TimeGenerated, RunFileName = FileName, RunFolder = FolderPath | project RunTime, RunFileName, RunFolder; CopyEvents | join kind=inner (RunEvents) on $left.CopiedFileName == $right.RunFileName | where RunTime >= CopiedTime | where RunFolder == CopiedToFolder | summarize FirstRun=min(RunTime) by CopiedFileName, CopiedTime, CopiedToFolder, CopyingProcess, CopiedSource | project CopiedFileName, DestinationFolder = CopiedToFolder, CopyingProcess, SourceProcessFolder = CopiedSource, CopyTime = CopiedTime, FirstRun

DeviceFileEvents | where ActionType in ('Copied','Created','FileCreated','FileCopied') | where InitiatingProcessFolderPath contains 'System32' or InitiatingProcessFolderPath endswith '\\System32' | where FolderPath contains 'Users' | summarize MinTime = min(TimeGenerated) by CopiedExecutableName = FileName, SourceFolder = InitiatingProcessFolderPath, DestinationFolder = FolderPath | order by MinTime asc | take 1 | project MinTime, CopiedExecutableName, SourceFolder, DestinationFolder

let CopiedExecutables = DeviceFileEvents | where ActionType == "FileCreated" // File copied into a user profile folder | where FolderPath startswith @"C:\Users\" // Copying process came from System32 | where InitiatingProcessFolderPath has @"\System32\" | extend FullPath = strcat(FolderPath, "\\", FileName) | project FileName, FullPath, CopyTime = TimeGenerated; DeviceProcessEvents | where ActionType == "ProcessCreated" // Process started from a user profile folder (the copied executable) | where FolderPath startswith @"C:\Users\" | extend ProcessPath = strcat(FolderPath, "\\", FileName) // Join on the exact path to ensure we only see processes launched from our copied file | join kind=inner CopiedExecutables on $left.ProcessPath == $right.FullPath | project ExecutableName = FileName, CopiedAt = CopyTime, LaunchedAt = TimeGenerated