Microsoft Sentinel medium experimental kql

SlackAudit - Suspicious file downloaded.

'Detects potentialy suspicious downloads.'

View Source

Detection Logic

SlackAudit
| where DvcAction =~ 'file_downloaded'
| extend FileName = tostring(EntityFileName)
| extend fe = split(FileName, '.')
| extend FileExtension = iff(array_length(fe) > 1, tostring(fe[-1]), '')
| where FileName contains '.'
| where FileExtension matches regex @"^[A-Za-z]{1,4}$"
| project EntityFileName = FileName, SrcUserName
| extend AccountCustomEntity = SrcUserName
| extend FileCustomEntity = EntityFileName

Field Validations

Loading…

Comments (0)

Loading comments...