Question

During a threat hunt in Microsoft Defender XDR Advanced Hunting, you suspect that a malicious executable named 'update_svc.exe' was staged across multiple endpoints before execution. You need a KQL query that returns each distinct device where the file was created, along with the earliest creation time per device, so you can prioritize the first-affected hosts. Which query best meets this requirement?

Accepted Answer

DeviceFileEvents | where FileName == "update_svc.exe" and ActionType == "FileCreated" | summarize FirstSeen = min(Timestamp) by DeviceName | sort by FirstSeen asc

Answer

DeviceFileEvents | where FileName == "update_svc.exe" | count

Answer

DeviceProcessEvents | where FileName == "update_svc.exe" | summarize by DeviceName

Answer

DeviceFileEvents | where FileName == "update_svc.exe" and ActionType == "FileCreated" | distinct Timestamp, DeviceName