[IC] - Detection Response by tracing File Lineage with KQL Queries
This query groups all files by their originating file—such as a ZIP archive or from a Website—and includes all the files that were extracted from it. Among the benefits of Correlating File Events Using InitiatingProcessUniqueId field we can identify: - Provides full visibility into all files related to a single action (e.g., ZIP extraction). - Helps detect hidden or secondary malicious files that may not trigger alerts. - Traces the origin of files—whether downloaded or extracted from another source. - Strengthens root cause analysis and incident investigation. - Enhances detection of multi-stage payloads or complex delivery methods. - Builds context around suspicious activity for better decision-making. On the other hand, we can enhance this detection by adding additional checks — for example, identifying when one of the extracted or downloaded files has a high-risk file extension. | where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
Microsoft Sentinel (KQL)
