Defender-DeviceFileEvents

ActionType	Title	Sample	Rule
any	File activity	Y	Y
FileCreated	File created	Y	Y
FileModified	File modified	Y	Y
FileDeleted	File deleted	Y	N
FileRenamed	File renamed	Y	Y

any: File activity

Table: DeviceFileEvents

Fields #

Name	Description	Rules
`DeviceId`
`Timestamp`
`ActionType`
`FileName`		1 detection rule
`FolderPath`		1 detection rule
`SHA256`
`FileSize`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`
`InitiatingProcessAccountName`

Example Event #

{
  "ActionType": "FileCreated",
  "AdditionalFields": {
    "FileType": "Error"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileName": "jc1g5z2k.dll",
  "FolderPath": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\jc1g5z2k.dll",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "local service",
  "InitiatingProcessAccountSid": "S-1-5-19",
  "InitiatingProcessCommandLine": "\"csc.exe\" /noconfig /fullpaths @\"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\jc1g5z2k.cmdline\"",
  "InitiatingProcessCreationTime": "2026-08-01T09:08:03.0496525Z",
  "InitiatingProcessFileName": "csc.exe",
  "InitiatingProcessFileSize": 2759024,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\csc.exe",
  "InitiatingProcessId": 5452,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "c7e54b9571f63873fe3539f4aa13fd9a",
  "InitiatingProcessParentCreationTime": "2026-08-01T09:07:58.3560941Z",
  "InitiatingProcessParentFileName": "powershell.exe",
  "InitiatingProcessParentId": 12916,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "6265d085ee5fc65bc123f503970e7eeadde3e032",
  "InitiatingProcessSHA256": "adeda78a951529462f9411e016c1a1b87ddfd94c55912cbd2957817f39929af1",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394480649",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Visual C# Command Line Compiler",
  "InitiatingProcessVersionInfoInternalFileName": "csc.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "csc.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® .NET Framework",
  "InitiatingProcessVersionInfoProductVersion": "4.8.4161.0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1058403,
  "ReportId@odata.type": "#Int64",
  "RequestAccountDomain": "NT AUTHORITY",
  "RequestAccountName": "LOCAL SERVICE",
  "RequestAccountSid": "S-1-5-19",
  "RequestProtocol": "Local",
  "Timestamp": "2026-08-01T09:08:03.2198162Z"
}

Detection Patterns #

Defender-DeviceFileEvents any: File activityORFileCreated: File created

2 rules

Kusto

PE file dropped in Color Profile Folder (source)

Pete Bryan

Detect executable drops via Azure custom script extension (source)

Robbe Van den Daele

Defender-DeviceFileEvents any: File activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Ingress Tool Transfer - Certutil (source)

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileRenamed: File renamedORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious MSC File Launched (source)

FalconForce

Defender-DeviceEvents any: Defender eventORDefender-DeviceFileEvents any: File activity

1 rule

Kusto

Azure VM Run Command operations executing a unique PowerShell script (source)

Microsoft Security Research

Persistence: Windows Service

Defender-DeviceFileEvents any: File activityORDefender-DeviceImageLoadEvents any: Image loadORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Rare Process as a Service (source)

Show All Detection Patterns

Persistence: Compromise Host Software Binary

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileModified: File modifiedORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Potential Build Process Compromise - MDE (source)

Privilege Escalation: Exploitation for Privilege Escalation

Defender-DeviceEvents any: Defender eventORDefender-DeviceFileEvents any: File activityORFileCreated: File created

1 rule

Kusto

Detect LolDriver drop or load from unknown or unsigned process (source)

Robbe Van den Daele

Exfiltration: Exfiltration Over Physical Medium

Defender-DeviceEvents UsbDriveMounted: USB drive mountedORDefender-DeviceFileEvents any: File activityORDefender-DeviceInfo any: Device information

1 rule

Kusto

Dataverse - Terminated employee exfiltration to USB drive (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`FileCreated`	5 rules	kusto
`Hashes[0]` (kusto rule field)	eq	`sha256`	3 rules	kusto
`InitiatingProcessSHA256` (kusto rule field)	eq	`sha256hashes`	3 rules	kusto
`sha256` (kusto rule field)	contains	`sha256hashes`	3 rules	kusto
`ClientIP` (kusto rule field)	eq	`IPList`	2 rules	kusto
`DestinationHost` (kusto rule field)	contains	`domains`	2 rules	kusto
`DestinationHostName` (kusto rule field)	contains	`domains`	2 rules	kusto
`DestinationHostname` (kusto rule field)	contains	`domains`	2 rules	kusto
`DestinationIP` (kusto rule field)	eq	`IPList`	2 rules	kusto
`EventType` (kusto rule field)	eq	`FileCreated`	2 rules	kusto
`FileHashValue` (kusto rule field)	is_not_null		2 rules	kusto
`Hashes[1]` (kusto rule field)	contains	`sha256hashes`	2 rules	kusto
`IPAddresses` (kusto rule field)	eq	`IPList`	2 rules	kusto
`Message` (kusto rule field)	contains	`iplist`	2 rules	kusto
`Name` (kusto rule field)	eq	`domains`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Dev-0530 File Extension Rename source high: Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ransom note.T1486↳ also matches FileCreated: File created
Europium - Hash and IP IOCs - September 2022 source high: Identifies a match across various data feeds for hashes and IP IOC related to Europium Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-governmentT1003, T1071
Mercury - Domain, Hash and IP IOCs - August 2022 source high: Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/T1071

Show 11 more (14 total) on the rules page

FileCreated: File created

Table: DeviceFileEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA256`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "FileCreated",
  "AdditionalFields": {
    "FileType": "Error"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileName": "jc1g5z2k.dll",
  "FolderPath": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\jc1g5z2k.dll",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "local service",
  "InitiatingProcessAccountSid": "S-1-5-19",
  "InitiatingProcessCommandLine": "\"csc.exe\" /noconfig /fullpaths @\"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\jc1g5z2k.cmdline\"",
  "InitiatingProcessCreationTime": "2026-08-01T09:08:03.0496525Z",
  "InitiatingProcessFileName": "csc.exe",
  "InitiatingProcessFileSize": 2759024,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\csc.exe",
  "InitiatingProcessId": 5452,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "c7e54b9571f63873fe3539f4aa13fd9a",
  "InitiatingProcessParentCreationTime": "2026-08-01T09:07:58.3560941Z",
  "InitiatingProcessParentFileName": "powershell.exe",
  "InitiatingProcessParentId": 12916,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "6265d085ee5fc65bc123f503970e7eeadde3e032",
  "InitiatingProcessSHA256": "adeda78a951529462f9411e016c1a1b87ddfd94c55912cbd2957817f39929af1",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394480649",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Visual C# Command Line Compiler",
  "InitiatingProcessVersionInfoInternalFileName": "csc.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "csc.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® .NET Framework",
  "InitiatingProcessVersionInfoProductVersion": "4.8.4161.0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1058403,
  "ReportId@odata.type": "#Int64",
  "RequestAccountDomain": "NT AUTHORITY",
  "RequestAccountName": "LOCAL SERVICE",
  "RequestAccountSid": "S-1-5-19",
  "RequestProtocol": "Local",
  "Timestamp": "2026-08-01T09:08:03.2198162Z"
}

Detection Patterns #

Defender-DeviceFileEvents any: File activityORFileCreated: File created

2 rules

Kusto

PE file dropped in Color Profile Folder (source)

Pete Bryan

Detect executable drops via Azure custom script extension (source)

Robbe Van den Daele

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileRenamed: File renamedORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious MSC File Launched (source)

FalconForce

Defender-DeviceFileEvents FileCreated: File createdORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORConnectionFailed: Connection failedORConnectionRequest: Connection requestORConnectionAttempt: Connection attempt

1 rule

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Execution: User Execution

Defender-DeviceFileEvents FileCreated: File createdORFileRenamed: File renamedORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious office child process created (source)

FalconForce

Persistence: Compromise Host Software Binary

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileModified: File modifiedORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Potential Build Process Compromise - MDE (source)

Show All Detection Patterns

Privilege Escalation: Exploitation for Privilege Escalation

Defender-DeviceEvents any: Defender eventORDefender-DeviceFileEvents any: File activityORFileCreated: File created

1 rule

Kusto

Detect LolDriver drop or load from unknown or unsigned process (source)

Robbe Van den Daele

Stealth: DLL

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORDefender-DeviceImageLoadEvents any: Image load

1 rule

Kusto

Hijack Execution Flow - DLL Side-Loading (source)

Defense Impairment: Modify Authentication Process

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeeded

1 rule

Kusto

Rouge RDP: Suspicious File Creation (source)

Cyb3rMonk

Lateral Movement: Windows Remote Management

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORFileRenamed: File renamedORDefender-DeviceImageLoadEvents any: Image loadORImageLoaded: Image loaded

1 rule

Kusto

WinRM Plugin Lateral Movement (source)

FalconForce

Exfiltration: Exfiltration Over C2 Channel

Defender-DeviceEvents UsbDriveMounted: USB drive mountedORDefender-DeviceFileEvents FileCreated: File created

1 rule

Kusto

Files Copied to USB Drives (source)

Exfiltration: Exfiltration Over Physical Medium

Defender-CloudAppEvents any: Cloud app activityORDefender-DeviceEvents UsbDriveMounted: USB drive mountedORDefender-DeviceFileEvents FileCreated: File createdORFileRenamed: File renamed

1 rule

Kusto

Mass Download & copy to USB device by single user (source)

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`FileCreated`	7 rules	kusto
`ActionType` (kusto rule field)	eq	`UsbDriveMounted`	2 rules	kusto
`ActionType` (kusto rule field)	eq	`FileRenamed`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`ProcessCreated`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`processcreated`	1 rule	kusto
`ActionType` (kusto rule field)	in	`FileCreated`	3 rules	kusto
`ActionType` (kusto rule field)	in	`FileModified`	2 rules	kusto
`file_name` (kusto rule field)	contains	`.bat`	2 rules	kusto
`file_name` (kusto rule field)	contains	`.cmd`	2 rules	kusto
`file_name` (kusto rule field)	contains	`.com`	2 rules	kusto
`file_name` (kusto rule field)	contains	`.cpl`	2 rules	kusto
`file_name` (kusto rule field)	contains	`.dll`	2 rules	kusto
`file_name` (kusto rule field)	contains	`.exe`	2 rules	kusto
`file_name` (kusto rule field)	contains	`.vbs`	2 rules	kusto
`parent_process_name` (kusto rule field)	eq	`customscripthandler.exe`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Dev-0530 File Extension Rename source high: Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ransom note.T1486↳ also matches any: File activity

FileModified: File modified

Table: DeviceFileEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA256`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "FileModified",
  "AdditionalFields": {
    "FileType": "Unknown"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileName": "AdfsArtifactStore.mdf",
  "FileSize": 2293760,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\Windows\\WID\\Data\\AdfsArtifactStore.mdf",
  "InitiatingProcessAccountDomain": "nt service",
  "InitiatingProcessAccountName": "mssql$microsoft##wid",
  "InitiatingProcessAccountSid": "S-1-5-80-1184457765-4068085190-3456807688-2200952327-3769537534",
  "InitiatingProcessCommandLine": "sqlservr.exe -SMSWIN8.SQLWID -sMICROSOFT##WID",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:53.3625267Z",
  "InitiatingProcessFileName": "sqlservr.exe",
  "InitiatingProcessFileSize": 372400,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\wid\\binn\\sqlservr.exe",
  "InitiatingProcessId": 9228,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessMD5": "b1a18b8eb0de52bdf048ba06dd904e37",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:12.0633947Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1232,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "89d3da9803eb368480f4b9fe680e50bd9281a65e",
  "InitiatingProcessSHA256": "7e6e63a4568132cabaad56a670306d8547b2a4aa4914d2d7434071e094e74df6",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394477246",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "SQL Server Windows NT - 64 Bit",
  "InitiatingProcessVersionInfoInternalFileName": "SQLSERVR",
  "InitiatingProcessVersionInfoOriginalFileName": "SQLSERVR.EXE",
  "InitiatingProcessVersionInfoProductName": "Microsoft SQL Server",
  "InitiatingProcessVersionInfoProductVersion": "12.0.5214.6",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "MD5": "5659857ddd2e8f0a54fca5a6792ba03b",
  "ReportId": 1059621,
  "ReportId@odata.type": "#Int64",
  "RequestAccountDomain": "NT SERVICE",
  "RequestAccountName": "MSSQL$MICROSOFT##WID",
  "RequestAccountSid": "S-1-5-80-1184457765-4068085190-3456807688-2200952327-3769537534",
  "RequestProtocol": "Local",
  "SHA1": "3f7037454e39d3b35909a3a31617022cafe28d84",
  "SHA256": "09798315373185d63a099a4cd55c96c717b2582d089db173390d919e8a368c5b",
  "Timestamp": "2026-08-01T09:09:05.5085639Z"
}

Detection Patterns #

Persistence: Compromise Host Software Binary

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileModified: File modifiedORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Potential Build Process Compromise - MDE (source)

Stealth: DLL

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORDefender-DeviceImageLoadEvents any: Image load

1 rule

Kusto

Hijack Execution Flow - DLL Side-Loading (source)

Defense Impairment: Modify Authentication Process

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeeded

1 rule

Kusto

Rouge RDP: Suspicious File Creation (source)

Cyb3rMonk

Lateral Movement: Windows Remote Management

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORFileRenamed: File renamedORDefender-DeviceImageLoadEvents any: Image loadORImageLoaded: Image loaded

1 rule

Kusto

WinRM Plugin Lateral Movement (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`FileCreated`	1 rule	kusto
`ActionType` (kusto rule field)	in	`FileCreated`	2 rules	kusto
`ActionType` (kusto rule field)	in	`FileModified`	2 rules	kusto
`BuildProcessTime` (kusto rule field)	cross_field_compare	`FileEditTime`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	1 rule	kusto
`IntegrityLevel` (kusto rule field)	in	`High`	1 rule	kusto
`IntegrityLevel` (kusto rule field)	in	`System`	1 rule	kusto
`RemoteIPType` (kusto rule field)	eq	`Public`	1 rule	kusto
`file_name` (kusto rule field)	contains	`.bat`	1 rule	kusto
`file_name` (kusto rule field)	contains	`.cmd`	1 rule	kusto
`file_name` (kusto rule field)	contains	`.com`	1 rule	kusto
`file_name` (kusto rule field)	contains	`.cpl`	1 rule	kusto
`file_name` (kusto rule field)	contains	`.dll`	1 rule	kusto
`file_name` (kusto rule field)	contains	`.exe`	1 rule	kusto
`file_name` (kusto rule field)	contains	`.vbs`	1 rule	kusto

FileDeleted: File deleted

Table: DeviceFileEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "FileDeleted",
  "AdditionalFields": {
    "FileType": "Error"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "MicrosoftEdge_X64_150.0.4078.83_150.0.4078.65.exe",
  "FolderPath": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\150.0.4078.83\\MicrosoftEdge_X64_150.0.4078.83_150.0.4078.65.exe",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"MicrosoftEdgeUpdate.exe\" /svc",
  "InitiatingProcessCreationTime": "2026-08-01T08:02:43.3235416Z",
  "InitiatingProcessFileName": "microsoftedgeupdate.exe",
  "InitiatingProcessFileSize": 206944,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files (x86)\\microsoft\\edgeupdate\\microsoftedgeupdate.exe",
  "InitiatingProcessId": 7044,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "352c33641cbbd193af127d306cb960c8",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "a3281440828de514b0fc7bebfef3cfd37a418dc6",
  "InitiatingProcessSHA256": "f56701783d22d0e17e126d09aca62b1969259d4b7b00dedd9a0001c6d1abead2",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873381",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft Edge Update",
  "InitiatingProcessVersionInfoInternalFileName": "Microsoft Edge Update",
  "InitiatingProcessVersionInfoOriginalFileName": "MicrosoftEdgeUpdate.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft Edge Update",
  "InitiatingProcessVersionInfoProductVersion": "203.0.113.10",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5407,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:07:58.2339827Z"
}

FileRenamed: File renamed

Table: DeviceFileEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`PreviousFileName`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "FileRenamed",
  "AdditionalFields": {
    "FileType": "Unknown"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "DefaultAppPool.config",
  "FileSize": 67514,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\inetpub\\temp\\appPools\\DefaultAppPool\\DefaultAppPool.config",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "svchost.exe -k iissvcs",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:40.6137049Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 4404,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873049",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "MD5": "e71b3498e9ce88144d452a45925d1a14",
  "PreviousFileName": "DefaultAppPool.config.tmp",
  "PreviousFolderPath": "C:\\inetpub\\temp\\appPools\\DefaultAppPool",
  "ReportId": 5847,
  "ReportId@odata.type": "#Int64",
  "RequestAccountDomain": "NT AUTHORITY",
  "RequestAccountName": "SYSTEM",
  "RequestAccountSid": "S-1-5-18",
  "RequestProtocol": "Local",
  "SHA1": "a50286859d6b05f93450f417825a0f150b59717a",
  "SHA256": "50b6d4e6a1163c255d7b3981aa9844a4b770b88968e760e30095b6fe33b34e4a",
  "Timestamp": "2026-08-01T08:19:27.0944193Z"
}

Detection Patterns #

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileRenamed: File renamedORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious MSC File Launched (source)

FalconForce

Execution: User Execution

1 rule

Kusto

Suspicious office child process created (source)

FalconForce

Lateral Movement: Windows Remote Management

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORFileRenamed: File renamedORDefender-DeviceImageLoadEvents any: Image loadORImageLoaded: Image loaded

1 rule

Kusto

WinRM Plugin Lateral Movement (source)

FalconForce

Exfiltration: Exfiltration Over Physical Medium

Defender-CloudAppEvents any: Cloud app activityORDefender-DeviceEvents UsbDriveMounted: USB drive mountedORDefender-DeviceFileEvents FileCreated: File createdORFileRenamed: File renamed

1 rule

Kusto

Mass Download & copy to USB device by single user (source)

Microsoft Security Research

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`FileRenamed`	2 rules	kusto
`ActionType` (kusto rule field)	eq	`UsbDriveMounted`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`processcreated`	1 rule	kusto
`ActionType` (kusto rule field)	in	`FileCreated`	1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`wsmprovhost.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`excel.exe`	2 rules	kusto
`parent_process_name` (kusto rule field)	in	`powerpnt.exe`	2 rules	kusto
`parent_process_name` (kusto rule field)	in	`winword.exe`	2 rules	kusto
`parent_process_name` (kusto rule field)	in	`7zfm.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`brave.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`chrome.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`firefox.exe`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	1 rule	kusto
`Type` (kusto rule field)	eq	`account`	1 rule	kusto
`Type` (kusto rule field)	eq	`ip`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

ASR Bypassing Writing Executable Content source medium: The query checks for any file which has been created/written by an Office application and shortly after renamed to one of the deny-listed "executable extensions" which are text files. (e.g. ps1, .js, .vbs).T1211

Defender-DeviceFileEvents

any: File activity

Fields #

Example Event #

Detection Patterns #

Kusto

Kusto

Kusto

Kusto

Persistence: Windows Service

Kusto

Persistence: Compromise Host Software Binary

Kusto

Privilege Escalation: Exploitation for Privilege Escalation

Kusto

Exfiltration: Exfiltration Over Physical Medium

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

FileCreated: File created

Fields #

Example Event #

Detection Patterns #

Kusto

Kusto

Kusto

Execution: User Execution

Kusto

Persistence: Compromise Host Software Binary

Kusto

Privilege Escalation: Exploitation for Privilege Escalation

Kusto

Stealth: DLL

Kusto

Defense Impairment: Modify Authentication Process

Kusto

Lateral Movement: Windows Remote Management

Kusto

Exfiltration: Exfiltration Over C2 Channel

Kusto

Exfiltration: Exfiltration Over Physical Medium

Kusto

Common Indicators #

Detection Rules #

Kusto #

FileModified: File modified

Fields #

Example Event #

Detection Patterns #

Persistence: Compromise Host Software Binary

Kusto

Stealth: DLL

Kusto

Defense Impairment: Modify Authentication Process

Kusto

Lateral Movement: Windows Remote Management

Kusto

Common Indicators #

FileDeleted: File deleted

Fields #

Example Event #

FileRenamed: File renamed

Fields #

Example Event #

Detection Patterns #

Kusto

Execution: User Execution

Kusto

Lateral Movement: Windows Remote Management

Kusto

Exfiltration: Exfiltration Over Physical Medium

Kusto

Common Indicators #

Detection Rules #

Kusto #

References #