# Find an executable accessing a URL — query reference

Inspect the Defender Advanced Hunting query that links a matching domain to the initiating executable and application details. Set the domain-search value for the investigation.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

**Link to KQL Query:** [Devices: Find App/EXE that accessed a given URL](https://security.microsoft.com/v2/advanced-hunting?query=H4sIAMf4xWkAA6VWbU_TUBS-n038D7Vf3HRA9KshAVEiERcUpx98IaUtgoyNtB0D44_3Oc-5t_e263SONGvvTs_rc966ZbbMB_PaHJlDs2v2cIpMZqbmyiTmwkzMsclxKkxqzvFmDlrFk9xzPM_MzIxxRZApcL8mdwW-hNQJnlfknILXy4U2hjXPHagz2klAr8g_pRXhy8ymeWgeQG_Od8v93MYvxlkoJU4vKPcKPDfgTvEcUsecXl8i6hv8F4slObdwjXAWzT-WenuKu9iYgTMPYhsB0UM8U0YRgZpQfwRbCeMQbRrbJe2WVjphXE6uBJq5RTexz5IeV5RQRDWGDBRF5zdoubkFT05bEeLu8n7belDiXthIezZ_Es8J4ipgs4docshMqXFEWh-23ljZfo2Ye4a5cAgmLRTDeCXbJXlS5qZcwGPK3Khkzpgc1qH3-k_QUB61Ey-tk5g2q0CbSF83avWCvrw175FRj--c_AVlutFt-iw6ekv98Ai-JBJSoRFz4Cv6rO4veU5YS1IbCbOSkf-CZ1_B63oa11biuq9Xl73F6RZXvFAX--Aa08fC1u-M6De7wtez6C-IgovxFBMiYg_Lr9lBm0vjXqzfyDzq9D2Dfp1YkoMTi0OFU0p9Kaxp1Whnra95DolT6k6pfQoO0b-e9jFoKWfECZERXdOWFdHczsghuARB1z-uyt7Ry4IdLr0gWdoFGtIbLvvNHpXauLMzMWLfZLVWoZ3bCR7R-_Y-cPNTcr8siweQu7CbpbK6j-ijmxlaX3lQnzoBeoj9ijYyyOQWFcFJzs9ROTIvc3ANiGbI69_18S6iZxGnhPgwZU7HjNHVcs4MXdGDCTORBcjqTBdaOxcS4T43pr53cr5nXP1nwR7zG3Z514dbzyFTsoJ0k_itHsNCymuxe8W_s5X8GyEvw3vkcZceyHSQOh8BscnSyt9hJDP6I--6_N7Fb0xZtyP8xlBN2jGr-LZnc6s9emg3UtckdDvliHvtEneppx5667jupn6QvzLo_PZs1xp83Oq5uc2_5sNvJ7_D7xORr4on-O0A2a-tWEpQ4oUI9-2UG6MWfL2pfExt3V8pQo3stYrGbWbvDFePW1pmpXTlHf7_W75ve33I-arfJ11T77j-ohAeyZlOidUshDF95tT5ZKeO5r8ZjeJRUHOFKASzDVzNebVhq2Gjrpxt8H4x34GvZiQ238xT2FdPn_G-bh30g6oS7p-cb4LMR3Bo3Vb04xp2wllzAC2DzukzWAG9wV_xGnTsxibtyG7uJvUA9AG3nm7L9n8v9f_bZhWZrsnm8HVf9m6Krqdt0JEXNwn3al7VrhwTq685vf0s6spgONtL6NS6kan6q56GaqnHGXe_iLo8-AODrHt7uA4AAA&timeRangeId=month)

Content of KQL Query

//REPLACE domainSearch with the full or partial name of the domainName you want to find.

let domainSearch = "cars";

DeviceNetworkEvents

//Using domainName because the URL can have random tokens that can spell all sorts of words.

\| extend DomainName = tostring(parse_url(RemoteUrl).Host)

//

//Searching a domain that was access that contained the string stored in "domainSearch" at the top of this KQL.

\| where DomainName contains (domainSearch)

//Basic search for porn related sites

//\| where DomainName contains "porn" or DomainName contains "xnxx"

//

//Filters out random words created by vivi tokens.

//\| where RemoteUrl !contains "dynamic_port_check" and RemoteUrl !contains "dynamic_webrtc_codec" and RemoteUrl !contains "local_video_webrtc"

//

//Looking for Microsoft App Names that may be hiding behind one of these two

//\| where InitiatingProcessFileName in ("msedgewebview2.exe", "msedge.exe")  // optional but recommended for speed

//

// IF needed filter by device name

//\| where DeviceName startswith "bccc"

//

// If needed filter by UPN

//\| where InitiatingProcessAccountUpn !contains "@student"

//

// A long string inside InitiatingProcessCommandLine contains the Package(MS App) names and related exe's that we need.

\| parse InitiatingProcessCommandLine with \* @"\Packages" PackageFamilyName @"" \*

\| extend

PackageFamilyName = iff(isempty(PackageFamilyName), "Not a Microsoft Store app", PackageFamilyName),

WebViewAppName = extract(@"--webview-exe-name=(\[^\s""\]+)", 1, InitiatingProcessCommandLine)

\| project Timestamp,DeviceId,DeviceName,PackageFamilyName,WebViewAppName,RemoteUrl,RemotePort,RemoteIP,LocalIP,LocalPort,InitiatingProcessFileName,InitiatingProcessAccountUpn

\| sort by InitiatingProcessAccountUpn,Timestamp

//Count Instances by UPN and DeviceName

//\| summarize count() by InitiatingProcessAccountUpn,DeviceName

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)