Share via

Using KQL in Microsoft Defender to Query files on user computers

APTOS 221 Reputation points
2024-02-19T13:58:57.79+00:00

Hello, can anyone help me with querying all computers (Windows 10 and 11) in our organization to find the location of files with a specific extension *.ref using KQL in Advanced Hunting? Is it possible to base this query on the Organizational Unit (OU) of the computers in Active Directory? Regards.

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,213 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
159 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
107 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 28,571 Reputation points Microsoft Employee
    2024-02-20T08:44:52.26+00:00

    @APTOS Thank you for reaching out to us, As I understand you are looking for KQL query to find location of files with a specific extension *.ref using advance hunting.

    As far i am aware, Microsoft Defender for Endpoint (MDE) collects events based on curated decisions, typically comprising signals deemed valuable by threat researchers.

    You can use the below KQL query - 

    let MyDevices =
    (
        DeviceInfo | where OnboardingStatus == "Onboarded" and OSPlatform in ("Windows10","Windows10") | distinct DeviceId
    );
DeviceFileEvents
| join MyDevices on DeviceId
| where Timestamp >= ago(7d)
| where FileName endswith ".csv"
| project Timestamp, DeviceName, FileName, FolderPath

    Not sure, if MDE collect insights for "ref" extension, but you can give it a try using the above query.

    We can't define OU path/as we don't have that info within MDE, you can set a device tag based on GPO. for example: GPO applied to "OU-A" ------> tag Devices-A

    Let me know if you have any further questions, feel free to post back.

    Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.