Executable Forensic Timeline Investigation
This rule generates a comprehensive forensic timeline for a specific executable file, analyzing its origin (file creation/drops), execution context (process creation and child processes), network communications (outbound connections), and persistence mechanisms (registry modifications for run keys/startup and scheduled task creation/updates). It correlates events across different data sources based on the executable's file name or SHA256 hash.
Microsoft Sentinel (KQL)
