{"id":261,"date":"2022-12-24T00:15:49","date_gmt":"2022-12-23T23:15:49","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=261"},"modified":"2023-01-13T11:47:12","modified_gmt":"2023-01-13T10:47:12","slug":"how-to-detect-impacted-files-by-controlled-folder-access-and-attack-surface-reduction-rules-using-advanced-hunting-queries","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=261","title":{"rendered":"How to detect impacted files by Controlled Folder Access and Attack Surface Reduction rules using Advanced Hunting queries ?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">CONTROLLED FOLDER ACCESS RULES<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">ControlledFolderAccess &#8211; All excluding Temp<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>DeviceEvents\n| where ActionType in (\"ControlledFolderAccessViolationAudited\",\"ControlledFolderAccessViolationBlocked\")\n| extend FolderCustomized = strcat(InitiatingProcessFolderPath, \"\\\\\")\n| where FolderCustomized !contains \"temp\"\n| extend FullName = strcat(FolderCustomized, InitiatingProcessFileName)\n| project FullName\n| distinct FullName<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">ControlledFolderAccess &#8211; Only Temp<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>DeviceEvents\n| where ActionType in (\"ControlledFolderAccessViolationAudited\",\"ControlledFolderAccessViolationBlocked\")\n| extend FolderCustomized = strcat(InitiatingProcessFolderPath, \"\\\\\")\n| where FolderCustomized contains \"temp\"\n| extend FullName = strcat(FolderCustomized, InitiatingProcessFileName)\n| project FolderCustomized, FullName, InitiatingProcessFileName\n| distinct FolderCustomized, FullName, InitiatingProcessFileName<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">ATTACK SURFACE REDUCTION RULES<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">ASR &#8211; All Events<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>DeviceEvents\n| where ActionType startswith \"asr\"\n| extend FolderCustomized = strcat(FolderPath, \"\\\\\")\n| extend FullName = strcat(FolderCustomized, FileName)\n| project FolderCustomized, FullName, FileName\n| distinct FolderCustomized, FullName, FileName<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">ASR &#8211; All excluding InetCache<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>DeviceEvents\n| where ActionType startswith \"asr\"\n| extend FolderCustomized = strcat(FolderPath, \"\\\\\")\n| where FolderCustomized !contains \"INetCache\"\n| extend FullName = strcat(FolderCustomized, FileName)\n| project FullName\n| distinct FullName<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">ASR &#8211; Only Temp<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>DeviceEvents\n| where ActionType startswith \"asr\"\n| extend FolderCustomized = strcat(FolderPath, \"\\\\\")\n| where FolderCustomized contains \"INetCache\"\n| extend FullName = strcat(FolderCustomized, FileName)\n| project FolderCustomized, FullName, FileName\n| distinct FolderCustomized, FullName, FileName<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>CONTROLLED FOLDER ACCESS RULES ControlledFolderAccess &#8211; All excluding Temp ControlledFolderAccess &#8211; Only Temp ATTACK SURFACE REDUCTION RULES ASR &#8211; All &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"How to detect impacted files by Controlled Folder Access and Attack Surface Reduction rules using Advanced Hunting queries ?\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=261#more-261\" aria-label=\"Read more about How to detect impacted files by Controlled Folder Access and Attack Surface Reduction rules using Advanced Hunting queries ?\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[42,56],"tags":[45,43,46,44,41,94,72,79,40],"class_list":["post-261","post","type-post","status-publish","format-standard","hentry","category-defender-for-endpoint","category-m365-security","tag-asr","tag-attack-surface-reduction","tag-cfa","tag-controlled-folder-access","tag-defender","tag-m365","tag-m365-security","tag-m365security","tag-mde","infinite-scroll-item"],"featured_image_src":null,"author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=261"}],"version-history":[{"count":4,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/261\/revisions"}],"predecessor-version":[{"id":713,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/261\/revisions\/713"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}