Investigate Windows file creation logs to uncover any new executable added directly to the System32 directory, which may indicate a UEFI persistence implant. What was the name of the file created?

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath startswith "C:\\Windows\\System32\\"
| where FileName endswith ".exe" or
        FileName endswith ".dll" or
        FileName endswith ".sys" or
        FileName endswith ".scr" or
        FileName endswith ".cpl" or
        FileName endswith ".efi"
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine
| order by Timestamp desc

DeviceFileEvents
| where ActionType == 'FileCreated'
| where FolderPath has '\\System32'
| where FileName endswith '.exe'
| project DeviceName, FileName, FolderPath, TimeGenerated

DeviceFileEvents
| where ActionType == "FileCreated"
| where tolower(FolderPath) startswith "c:\\windows\\system32"
| where FileName matches regex @"\.(exe|dll|sys)$"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath startswith @"C:\Windows\System32"
| where FileName endswith ".exe"
| project TimeGenerated, DeviceName, FileName
| sort by TimeGenerated desc

DeviceFileEvents
| where FolderPath has "System32" and FileName endswith ".exe"
| project FileName, FolderPath, TimeGenerated
| order by TimeGenerated desc

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath has "\\System32"
| where FileName has_any (".exe", ".dll", ".sys")
| project TimeGenerated, FolderPath, FileName

// New executables created directly in System32 root (no subfolders)
DeviceFileEvents
| where ActionType == "FileCreated"
| extend PathLower = tolower(FolderPath)
| where PathLower matches regex @"^[a-z]:\\windows\\system32\\[^\\]+$"
| where tolower(FileName) endswith ".exe"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=dcount(DeviceId) by FileName
| order by LastSeen desc

let _timerange = 1d;  // adjust as needed for the investigation
let _start = ago(_timerange);
let _end = now();
let sys32_exe_creations_DeviceFileEvents = (
    DeviceFileEvents
    | where TimeGenerated between (_start .. _end)
    | where FolderPath contains @"System32" // direct System32 path
    | where FileName endswith @".exe"
    | where ActionType in ("Created","FileCreated","Added","Create","New")
    | project TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
);
let sys32_exe_creations_DeviceEvents = (
    DeviceEvents
    | where TimeGenerated between (_start .. _end)
    | where FolderPath contains @"System32"
    | where FileName endswith @".exe"
    | where ActionType in ("Created","FileCreated","Added","Create","New")
    | project TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
);
(sys32_exe_creations_DeviceFileEvents
    | union sys32_exe_creations_DeviceEvents)
| sort by TimeGenerated desc
| take 1
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine

let TimeWindow = 1d;
let StartTime = now() - TimeWindow;
union DeviceEvents, DeviceFileEvents
| where TimeGenerated between (StartTime .. now())
| where tolower(FolderPath) endswith "system32"
| where tolower(FileName) endswith ".exe"
| summarize arg_max(TimeGenerated, *) by FileName, FolderPath
| project TimeGenerated, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCreationTime, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, InitiatingProcessAccountDomain, SourceSystem, _ResourceId
| take 1

DeviceFileEvents
| where ActionType == 'FileCreated'
| where FolderPath contains 'System32'
| where FileName endswith '.exe'
| project Timestamp, FileName, FolderPath, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

DeviceFileEvents
| where ActionType == 'FileCreated'
| where FolderPath contains 'System32'
| where FileName endswith '.exe' or FileName endswith '.dll'  // Assuming common executables
| distinct FileName
| project FileName

DeviceFileEvents
| where ActionType hasprefix "FileCreated"      // keep only create events
| where FolderPath matches regex @"(?i)^.:\\Windows\\System32\\[^\\]+$"  // file sits directly in System32 root
| where FileName endswith ".exe"               // PE executables only
// optional: exclude known legitimate installers/updaters, e.g.
//| where InitiatingProcessSignerType !in ("Microsoft", "Windows")
| project TimeGenerated,
          DeviceName,
          FileName,
          FolderPath,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessSHA256,
          SHA256
| summarize FirstSeen = min(TimeGenerated),
            LastSeen  = max(TimeGenerated),
            Devices   = make_set(DeviceName)           by FileName, SHA256
| sort by LastSeen desc

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath contains "System32"
| where FileName endswith ".exe"
| project TimeGenerated, FolderPath, FileName
| sort by TimeGenerated desc

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath has @"Windows\System32"
| where FileName endswith ".exe"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

DeviceFileEvents
| where ActionType == "FileCreated"
| extend FullPath = strcat(tolower(FolderPath), "\\", tolower(FileName))
| where FullPath startswith "c:\\windows\\system32\\"
| where FileName endswith ".exe"
| summarize FirstCreated = min(Timestamp) by FileName
| project FileName, FirstCreated
| order by FirstCreated asc