25 строки
871 B
Plaintext
25 строки
871 B
Plaintext
// Name: Alerts related to File
|
|
// Description: Any Alerts that fired related to a given File during the range of +6h and -3d
|
|
//
|
|
// Id: 82d58507-c4e6-4fae-9aa4-db58be3ef9a6
|
|
//
|
|
// Entity: #File
|
|
// Input: Filename
|
|
// Output: Host, Account
|
|
//
|
|
// QueryPeriod: +6h and -3d default, change as needed
|
|
//
|
|
// Data Source: SecurityAlert
|
|
//
|
|
// Tactics: #Persistence, #Discovery, #Lateral Movement, #Collection
|
|
//
|
|
let GetAllAlertsWithFile = (suspiciousEventTime:datetime, v_File:string){
|
|
let v_StartTime = suspiciousEventTime-1d;
|
|
let v_EndTime = suspiciousEventTime+1d;
|
|
SecurityAlert
|
|
| where TimeGenerated between (v_StartTime .. v_EndTime)
|
|
| extend Computer = toupper(parse_json(ExtendedProperties).["Compromised Host"])
|
|
| where ExtendedProperties has v_File
|
|
};
|
|
// change datetime value and <filename> value below
|
|
GetAllAlertsWithFile(datetime('2019-01-18T10:36:07Z'), "<filename>") |