Question Analysis

let CopiedExecutables = DeviceFileEvents | where ActionType == "FileCreated" // File copied into a user profile folder | where FolderPath startswith @"C:\Users\" // Copying process came from System32 | where InitiatingProcessFolderPath has @"\System32\" | extend FullPath = strcat(FolderPath, "\\", FileName) | project FileName, FullPath, CopyTime = TimeGenerated; DeviceProcessEvents | where ActionType == "ProcessCreated" // Process started from a user profile folder (the copied executable) | where FolderPath startswith @"C:\Users\" | extend ProcessPath = strcat(FolderPath, "\\", FileName) // Join on the exact path to ensure we only see processes launched from our copied file | join kind=inner CopiedExecutables on $left.ProcessPath == $right.FullPath | project ExecutableName = FileName, CopiedAt = CopyTime, LaunchedAt = TimeGenerated