Find file hashes and network events — query reference
Review the two-stage Defender query example: find file hashes in DeviceFileEvents, then look for matching network events. The file name and hashes are captured examples.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
USE THIS KQL to get the SHA1/SHA256 of filename.
DeviceFileEvents
| where FileName contains "infatica"
| project Timestamp,ActionType,ProductName = InitiatingProcessVersionInfoProductName, ProcessDescription = InitiatingProcessVersionInfoFileDescription,ParentFileName = InitiatingProcessParentFileName,ParentProcessCreationTime = InitiatingProcessParentCreationTime,FileName,FolderPath,InitiatingProcessAccountUpn,InitiatingProcessSHA1
USE the following KQL to find all network related events that involved the SHA1 or SHA265 that you found in the above.
DeviceNetworkEvents
//| where DeviceName contains "gcc"
//| where InitiatingProcessFileName contains "infatica1140" or InitiatingProcessParentFileName contains "infatica1140"
| where InitiatingProcessSHA256 contains "4f966328f131988979eb1401e9ef512836b35e79502877e00566a261b58409cb" or InitiatingProcessSHA256 contains "821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431"
| sort by Timestamp