How to gain holistic visibility into attacks with Defender for Endpoint timeline logs

**1. What is a Timeline Log? **

Defender for Endpoint collects various events that occur on the device in a KQL-searchable format.
By piecing together this information in chronological order , stories such as "how the attacker broke in, deployed, and extracted information" You can see it.

Tables mainly used:

• 'DeviceProcessEvents': Log of process execution
• 'DeviceNetworkEvents': Records of the IP and domain of the destination
• 'DeviceFileEvents': File creation, modification, and deletion history
• 'DeviceLogonEvents': User logon/logoff status

---

2. Basic query: Follow the attack story on a device in chronological order

kql

let targetDevice = "device123.contoso.com";
DeviceProcessEvents
| where DeviceName == targetDevice
| union DeviceNetworkEvents
| union DeviceFileEvents
| union DeviceLogonEvents
| sort by Timestamp asc

This query consolidates all the events that occurred on the specified terminal and displays them in chronological order .

🔍 > Tip: Column names vary depending on the table, so it's easier to see them in a common format with 'project'.

---

3. Key points of storytelling

In time series analysis, the overall picture of the attack is clarified by being aware of the following "flows".

1. Initial intrusion (email attachment, USB, RDP, etc.)
2. Run (using PowerShell, rundll32, cmd, etc.)
3. Explore (IP scanning, AD enumeration, etc.)
4. Move (connect to another device, SMB, etc.)
5. Information Exploitation and Destruction (ZIP, Encryption, External Transmission)

---

4. Practical Example: Suspicious Deployment from PowerShell

kql

DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine has_any ("Invoke-WebRequest", "IEX", "DownloadFile")
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine
| order by Timestamp asc

This query can detect traces of "script-based attacks" and follow the deployment phase.

---

5. Visualization

• Convert to a 'Timeline' representation in Power BI
• Use 'datetime_diff()' in KQL to detect 'abnormal intervals'
• Separate stories for 'DeviceId' across multiple devices are also included

---

**6. Summary: Defender for Endpoint is powerful when used in stories! **

 

(Point of view) / (Point)

Don't end with a one-shot detection / Follow the "after" of the event to understand the actual damage and the next phase

Combine multiple tables/synthesize 'union' reports to see the entire attack flow

The analysis results are conveyed in a form that can be communicated, in the form of a story or visuals, and shared with non-technical people.

 

Attacks occur with "lines" rather than "points".
With Microsoft Defender for Endpoint logs, you can visualize the lines and understand what's happening quickly and accurately.

Colorkrew Security also provides incident response support and educational support based on this analytical know-how.
If you have any problems, please contact us!