Question

A SOC analyst in Microsoft Defender XDR Advanced Hunting is investigating a phishing campaign. They already identified a malicious attachment SHA256 in EmailAttachmentInfo and now need to determine which endpoints actually saved that same file to disk, so they can prioritize device remediation. Which single KQL approach most directly answers this question?

Accepted Answer

Query EmailAttachmentInfo for the SHA256, then join to DeviceFileEvents on the SHA256 to list DeviceName values where the file was written

Answer

Query EmailEvents for the RecipientEmailAddress, then join to DeviceLogonEvents on AccountName to find affected devices

Answer

Query DeviceProcessEvents for the SHA256 and count distinct InitiatingProcessFileName values

Answer

Query DeviceNetworkEvents for the SHA256 and summarize by RemoteUrl to trace where the file was downloaded