On Windows, following a phantom DLL hijack of the Print Spooler service, determine which system file was first copied from its original location before being renamed for persistence.

DeviceFileEvents
| where ActionType in~ ('FileCreated', 'FileRenamed')
| where FolderPath has 'System32' or FolderPath has 'spool'
| project TimeGenerated, FileName, PreviousFileName, FolderPath, PreviousFolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated asc
| take 5

let CopiedFiles =
    DeviceFileEvents
    | where ActionType == "FileCreated"
    | where tolower(FolderPath) has "c:\\windows\\system32" or tolower(FolderPath) has "c:\\windows\\syswow64"
    | extend CopyTime = TimeGenerated, MD5 = tostring(MD5), OriginalFileName = FileName, OriginalPath = FolderPath;

let RenamedFiles =
    DeviceFileEvents
    | where ActionType == "FileRenamed"
    | extend RenameTime = TimeGenerated, MD5 = tostring(MD5);

// Join the two events on MD5 and DeviceId to tie the copy to the rename; ensure the copy happened before rename
CopiedFiles
| join kind=inner (RenamedFiles) on MD5, DeviceId
| where CopyTime < RenameTime
| order by CopyTime asc
| limit 1
| project CopyTime, RenameTime, OriginalFileName, OriginalPath, RenamedFileName = FileName, FolderPath, InitiatingProcessCommandLine