Question

You are threat hunting in Microsoft Defender XDR Advanced Hunting. Threat analytics reports that an active campaign begins with a malicious Office document that spawns a scripting host, which then downloads a payload roughly 30-90 seconds later. You want a single KQL query that surfaces devices where a Word or Excel process spawned a scripting host (wscript.exe, cscript.exe, or powershell.exe) and correlates it with an outbound network connection from that same scripting host within 2 minutes. Which approach best builds this hunt?

Accepted Answer

Query DeviceProcessEvents for the Office-to-script spawn, then join to DeviceNetworkEvents on DeviceId and InitiatingProcessId, filtering where the network Timestamp is within 2 minutes of the process creation Timestamp.

Answer

Query only DeviceProcessEvents and rely on InitiatingProcessRemoteIP to identify the outbound connection made by the scripting host.

Answer

Query DeviceNetworkEvents alone and filter InitiatingProcessParentFileName for winword.exe or excel.exe to capture both the spawn and the connection.

Answer

Query DeviceFileEvents for the downloaded payload, then join to DeviceImageLoadEvents to correlate the script execution with the network activity.