ClickFix Triage Query
This KQL query is designed to help analyze and triage incidents related to a tool called ClickFix. Here's a simple breakdown of what the query does: Input Variables: VictimDeviceId: The ID of the device that experienced the incident. TopXEvents: The number of events to collect before and after a specific action. TimeFrame: The time window around the action to consider for event collection. Purpose: The query is used to gather and analyze different types of events related to a potential security incident on a device. It focuses on events surrounding a suspicious registry change (specifically, the "RunMRU" registry key). Data Collection: Pre-Infection Network Events: Collects network events that occurred before the suspicious registry change, which might indicate the source of the infection. RunMRU Event: Identifies the registry change event itself, which is a key indicator of compromise. Post-Infection Network Events: Collects network events that occurred after the registry change, which might show further malicious activity. Post-Infection Process Events: Collects process-related events that occurred after the registry change, indicating what processes might have been affected or initiated. Post-Infection File Events: Collects file-related events that occurred after the registry change, showing any file modifications or creations. Output: The query outputs a sorted list of events, categorized by type (network, registry, process, file), to provide a comprehensive view of the incident timeline and help in understanding the scope and impact of the incident. This query is useful for security analysts to quickly gather relevant information about a potential security incident and make informed decisions on how to respond.
Microsoft Sentinel (KQL)
