Find an executable accessing a URL — query reference
Inspect the Defender Advanced Hunting query that links a matching domain to the initiating executable and application details. Set the domain-search value for the investigation.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
Link to KQL Query: Devices: Find App/EXE that accessed a given URL
Content of KQL Query
//REPLACE domainSearch with the full or partial name of the domainName you want to find.
let domainSearch = "cars";
DeviceNetworkEvents
//Using domainName because the URL can have random tokens that can spell all sorts of words.
| extend DomainName = tostring(parse_url(RemoteUrl).Host)
//
//Searching a domain that was access that contained the string stored in "domainSearch" at the top of this KQL.
| where DomainName contains (domainSearch)
//Basic search for porn related sites
//| where DomainName contains "porn" or DomainName contains "xnxx"
//
//Filters out random words created by vivi tokens.
//| where RemoteUrl !contains "dynamic_port_check" and RemoteUrl !contains "dynamic_webrtc_codec" and RemoteUrl !contains "local_video_webrtc"
//
//Looking for Microsoft App Names that may be hiding behind one of these two
//| where InitiatingProcessFileName in ("msedgewebview2.exe", "msedge.exe") // optional but recommended for speed
//
// IF needed filter by device name
//| where DeviceName startswith "bccc"
//
// If needed filter by UPN
//| where InitiatingProcessAccountUpn !contains "@student"
//
// A long string inside InitiatingProcessCommandLine contains the Package(MS App) names and related exe's that we need.
| parse InitiatingProcessCommandLine with * @"\Packages" PackageFamilyName @"" *
| extend
PackageFamilyName = iff(isempty(PackageFamilyName), "Not a Microsoft Store app", PackageFamilyName),
WebViewAppName = extract(@"--webview-exe-name=([^\s""]+)", 1, InitiatingProcessCommandLine)
| project Timestamp,DeviceId,DeviceName,PackageFamilyName,WebViewAppName,RemoteUrl,RemotePort,RemoteIP,LocalIP,LocalPort,InitiatingProcessFileName,InitiatingProcessAccountUpn
| sort by InitiatingProcessAccountUpn,Timestamp
//Count Instances by UPN and DeviceName
//| summarize count() by InitiatingProcessAccountUpn,DeviceName