Lesson 9 — Investigating DeviceFileEvents
File events show what was created, modified, renamed, moved or deleted on an endpoint.
Microsoft Defender for Endpoint exposes this activity through DeviceFileEvents, allowing analysts to connect suspicious files with the process, command line, user and timeline that produced them.
This lesson explains how to investigate dropped payloads, malware staging, ransomware activity, persistence files and attacker cleanup using file telemetry.
What you will learn
This lesson explains how to investigate endpoint file activity using DeviceFileEvents.
Learning objectives
After completing this lesson, you should be able to investigate file activity using Defender for Endpoint telemetry.
- Explain what DeviceFileEvents records.
- Interpret filenames, paths, hashes and file sizes.
- Identify the process and user responsible for file activity.
- Recognise suspicious payload staging, ransomware and cleanup patterns.
- Correlate file activity with process, network, registry and timeline evidence.
The problem this solves
A suspicious filename alone rarely explains how it arrived or what happened next.
DeviceFileEvents connects the file operation to the process, command line, user and device that caused it.
What is DeviceFileEvents?
DeviceFileEvents is the Advanced Hunting table used to investigate file activity observed on endpoints.
It records operations such as file creation, modification, deletion and renaming together with the initiating process and related file metadata.
Do not investigate a file in isolation. Find the process that created it, the connection that delivered it and the activity that followed.
How file activity becomes evidence
Why file telemetry matters
Nearly every attack touches files at some stage.
Payloads may be downloaded, scripts written, tools extracted, documents encrypted or artefacts deleted to hide evidence.
Timestamp
The timestamp shows when the file operation occurred.
Correlate it with process creation, network activity and alert times to place the event within the attack sequence.
DeviceName
DeviceName identifies the endpoint where the file activity occurred.
Check whether the device is high value, exposed or involved in related incidents.
FileName
FileName identifies the affected file.
Attackers may use misleading names, double extensions or names that imitate trusted applications.
FolderPath
FolderPath shows where the file was located.
Temporary folders, downloads, user profile paths and writable shared locations often deserve closer attention.
ActionType
ActionType describes what happened to the file.
Common examples include creation, modification, deletion and renaming.
Common file actions
| Action | Investigation meaning |
|---|---|
| FileCreated | A new file appeared on the device. |
| FileModified | Existing file content or metadata changed. |
| FileDeleted | A file was removed, possibly as cleanup or defence evasion. |
| FileRenamed | A file name or extension changed, which may indicate staging or ransomware. |
Suspicious locations
Locations such as %TEMP%, Downloads, Public, ProgramData and user profile folders are commonly used for staging.
The path is not proof of maliciousness, but it helps prioritise review.
System locations
Files in Windows and application directories may be legitimate or may indicate tampering.
Review signer information, hashes, initiating process and whether the path is writable by ordinary users.
File hashes
SHA1 and SHA256 values identify file content.
Use hashes to search across devices, compare threat intelligence and determine whether the same payload appeared elsewhere.
MD5
MD5 may still appear in telemetry or intelligence sources.
It is useful for matching, but stronger hashes such as SHA256 are preferred for reliable identification.
File size
File size can help distinguish scripts, executables, archives and large data collections.
Unexpectedly small or large files may warrant further analysis.
File extensions
Extensions can reveal executable, script, archive or disk-image content.
Examples such as .pdf.exe, .doc.lnk, .js, .hta, .iso and .img may require closer review.
Double extensions
Double extensions can make executable files appear like documents.
Always inspect the full filename and true file type rather than relying on the visible icon.
InitiatingProcessFileName
This field identifies the process responsible for the file action.
It often provides the strongest clue about how the file arrived or changed.
InitiatingProcessCommandLine
The initiating command line may reveal download URLs, extraction commands, output paths or deletion instructions.
Read it together with the file path and action type.
Initiating process account
Account fields identify the user or security context responsible for the file event.
Determine whether the action was performed by a standard user, administrator, service account or SYSTEM.
Example payload sequence
Malware staging
Attackers often download or create files in temporary or writable folders before execution.
Look for a sequence of download, creation, execution and deletion.
Archive extraction
ZIP, RAR, ISO and other containers may be used to deliver multiple files.
Correlate archive creation or download with extraction tools and resulting executables.
Script creation
PowerShell, JavaScript, VBScript and batch files may be written to disk before execution.
Review the creating process, file contents where available and subsequent process events.
Living-off-the-land downloads
PowerShell, certutil and bitsadmin can create files from remote sources.
Investigate the command line, destination path and network activity.
Ransomware activity
Ransomware may generate large numbers of file modification and rename events.
Look for repeated actions across many directories, unusual extensions and a common initiating process.
Ransom note creation
Ransomware often creates text or HTML notes in multiple directories.
Repeated creation of similarly named files can help confirm widespread encryption activity.
Defence evasion
Attackers may delete tools, scripts or logs after use.
File deletion following suspicious execution may indicate cleanup rather than normal activity.
Persistence files
Files placed in startup folders, scheduled task paths or service directories may support persistence.
Correlate the file event with registry or scheduled task activity.
Web downloads
Browsers and other applications can create files in Downloads or cache locations.
Check the source URL, user action and whether the file executed afterward.
Email attachments
Attachments may be written to temporary or user-accessible paths before opening.
Correlate file creation with email evidence, Office processes and child process execution.
Example phishing sequence
Pivot to DeviceProcessEvents
Investigate the process that created, modified or deleted the file.
Review its command line, parent process, user, hash and child processes.
Pivot to DeviceNetworkEvents
Check whether the initiating process downloaded or uploaded data.
Correlate destination, timestamp and process identifiers.
Pivot to DeviceRegistryEvents
Review whether the file was referenced by a run key, service or other persistence mechanism.
This can connect file creation with long-term attacker access.
Pivot to the Device Timeline
The timeline shows file activity alongside process, network, registry and logon events.
Use it to reconstruct what happened before and after the file operation.
Search across devices
Use hashes, filenames and paths to determine whether the same artefact appeared elsewhere.
This helps establish whether the event is isolated or part of a wider campaign.
Threat intelligence
File hashes can be checked against reputation and malware intelligence.
Use intelligence as supporting evidence and verify the process and timeline context.
File investigation workflow
Common mistake
A common mistake is judging a file only by its name.
Attackers can rename binaries, use double extensions and imitate trusted applications.
Another common mistake
Do not ignore the folder path, initiating process or command line.
These fields often explain how the file arrived and whether it was expected.
Agent Foskett investigation tip
Follow the file back to the process that created it and forward to the execution, persistence or communication that followed.
Best practices
- Review the initiating process.
- Read the complete command line.
- Check the full folder path.
- Validate hashes and reputation.
- Correlate network and process activity.
- Search for the same artefact across devices.
Agent Foskett takeaway
Files provide tangible evidence of what changed on an endpoint.
DeviceFileEvents helps analysts identify payloads, staging, ransomware, persistence and attacker cleanup by connecting each file action to the process and timeline that caused it.
Related Agent Foskett learning
Continue learning
Microsoft Defender for Endpoint DeviceFileEvents
DeviceFileEvents records file creation, modification, deletion and renaming, including file names, paths, hashes, sizes, action types, initiating processes, command lines and user context.
Module 2 Endpoint Telemetry — DeviceFileEvents Lesson 9
This Agent Foskett Defender for Endpoint Academy lesson explains how analysts investigate payload delivery, malware staging, ransomware activity, persistence files and attacker cleanup using endpoint file telemetry.
