A Windows host shows a core command-line utility being duplicated from its System32 location to a user-profile folder and subsequently run. Identify the name of the executable that was copied.

let window = 1h;
// Optional: restrict to known core Windows CLI utilities to reduce noise
let core_utils = dynamic([
  'cmd.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','bitsadmin.exe',
  'whoami.exe','findstr.exe','net.exe','net1.exe','sc.exe','schtasks.exe','tasklist.exe','wevtutil.exe','wmic.exe','ftp.exe','tftp.exe','at.exe'
]);
// Candidate copies into user profile, appearing to come from System32/SysWOW64 (via Previous* or initiating cmdline)
let candidate_copies =
    DeviceFileEvents
    | where ActionType in~ ('FileCreated','FileCopied','FileRenamed')
    | where FolderPath has '\\Users\\' and FileName endswith '.exe'
    // Uncomment next line to limit to core utilities
    //| where set_has_element(core_utils, tolower(FileName))
    | extend PrevPath = iff(isnotempty(PreviousFolderPath) and isnotempty(PreviousFileName), strcat(PreviousFolderPath, '\\', PreviousFileName), '')
    | where PrevPath has_any ('\\Windows\\System32\\','\\Windows\\SysWOW64\\')
        or InitiatingProcessCommandLine has_any ('\\Windows\\System32\\','\\Windows\\SysWOW64\\','%windir%\\system32','%windir%\\syswow64')
    | project DeviceId, DeviceName, CopiedExe=tolower(FileName), DstPath=tolower(FolderPath), CopyTime=TimeGenerated, SHA1,
              InitiatingProcessAccountDomain, InitiatingProcessAccountName;
// Executions from a user profile path
let executions =
    DeviceProcessEvents
    | where FolderPath has '\\Users\\'
    | project DeviceId, ExecTime=TimeGenerated, RanExe=tolower(FileName), RanPath=tolower(FolderPath), RanCmd=ProcessCommandLine, ExecSHA1=SHA1;
// Strong correlation: join by SHA1 and device, then ensure execution shortly after copy
let joined_sha =
    candidate_copies
    | where isnotempty(SHA1)
    | join kind=innerunique (executions | where isnotempty(ExecSHA1))
        on $left.DeviceId == $right.DeviceId and $left.SHA1 == $right.ExecSHA1
    | where ExecTime between (CopyTime .. CopyTime + window)
    | project DeviceId, DeviceName, CopiedExe, DstPath, CopyTime, ExecTime, RanPath;
// Fallback correlation: exact path match (same device and same full path), within time window
let joined_path =
    candidate_copies
    | join kind=innerunique (executions)
        on $left.DeviceId == $right.DeviceId
    | where RanPath == DstPath and ExecTime between (CopyTime .. CopyTime + window)
    | project DeviceId, DeviceName, CopiedExe, DstPath, CopyTime, ExecTime, RanPath;
union joined_sha, joined_path
| summarize FirstCopyTime=min(CopyTime), FirstExecTime=min(ExecTime), ExecutedFrom=any(RanPath)
    by DeviceId, DeviceName, CopiedExecutable=CopiedExe
| order by FirstCopyTime asc

let CopyEvents = DeviceFileEvents
| where TimeGenerated >= ago(24h)
| where ActionType in ('FileCopied','FileCreated')
| where InitiatingProcessFolderPath contains 'System32'
| where FolderPath contains 'C:\\Users\\'
| extend CopiedTime = TimeGenerated, CopiedFileName = FileName, CopiedToFolder = FolderPath, CopyingProcess = InitiatingProcessFileName, CopiedSource = InitiatingProcessFolderPath
| project CopiedTime, CopiedFileName, CopiedToFolder, CopyingProcess, CopiedSource;
let RunEvents = DeviceProcessEvents
| where TimeGenerated >= ago(24h)
| extend RunTime = TimeGenerated, RunFileName = FileName, RunFolder = FolderPath
| project RunTime, RunFileName, RunFolder;
CopyEvents
| join kind=inner (RunEvents) on $left.CopiedFileName == $right.RunFileName
| where RunTime >= CopiedTime
| where RunFolder == CopiedToFolder
| summarize FirstRun=min(RunTime) by CopiedFileName, CopiedTime, CopiedToFolder, CopyingProcess, CopiedSource
| project CopiedFileName, DestinationFolder = CopiedToFolder, CopyingProcess, SourceProcessFolder = CopiedSource, CopyTime = CopiedTime, FirstRun

DeviceFileEvents
| where ActionType in ('Copied','Created','FileCreated','FileCopied')
| where InitiatingProcessFolderPath contains 'System32' or InitiatingProcessFolderPath endswith '\\System32' 
| where FolderPath contains 'Users' 
| summarize MinTime = min(TimeGenerated) by CopiedExecutableName = FileName, SourceFolder = InitiatingProcessFolderPath, DestinationFolder = FolderPath
| order by MinTime asc
| take 1
| project MinTime, CopiedExecutableName, SourceFolder, DestinationFolder

let CopiedExecutables = DeviceFileEvents
| where ActionType == "FileCreated"
// File copied into a user profile folder
| where FolderPath startswith @"C:\Users\"
// Copying process came from System32
| where InitiatingProcessFolderPath has @"\System32\"
| extend FullPath = strcat(FolderPath, "\\", FileName)
| project FileName, FullPath, CopyTime = TimeGenerated;

DeviceProcessEvents
| where ActionType == "ProcessCreated"
// Process started from a user profile folder (the copied executable)
| where FolderPath startswith @"C:\Users\"
| extend ProcessPath = strcat(FolderPath, "\\", FileName)
// Join on the exact path to ensure we only see processes launched from our copied file
| join kind=inner CopiedExecutables on $left.ProcessPath == $right.FullPath
| project ExecutableName = FileName, CopiedAt = CopyTime, LaunchedAt = TimeGenerated