Lesson 144 — The File Appeared Seconds Before It Executed

Case briefing

Stage 1 — find files created around the suspicious process

Start with the device and narrow time window from the process-tree investigation. Microsoft documents DeviceFileEvents as the advanced hunting table for file creation, modification and other file-system events.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:22:19);
DeviceFileEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 5m .. TargetTime + 5m)
| where ActionType == "FileCreated"
| project Timestamp,
          DeviceName,
          FileName,
          FolderPath,
          SHA1,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId
| order by Timestamp asc

Stage 2 — follow the file's own history

Once the suspicious filename is known, look at every observed file event for that file on the device. This can show whether it was created, modified, renamed or otherwise touched before execution.

let TargetDevice = "WS-FIN-042";
let TargetFile = "payload.dll";
DeviceFileEvents
| where DeviceName =~ TargetDevice
| where FileName =~ TargetFile
| project Timestamp,
          ActionType,
          FileName,
          FolderPath,
          SHA1,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId
| order by Timestamp asc

Stage 3 — correlate the file hash with process execution

Now pivot the SHA-1 into DeviceProcessEvents. If the same hash appears as a process image on the same device shortly afterwards, the evidence becomes much stronger.

let TargetDevice = "WS-FIN-042";
let TargetSHA1 = "0123456789abcdef0123456789abcdef01234567";
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where SHA1 == TargetSHA1
| project Timestamp,
          FileName,
          FolderPath,
          ProcessCommandLine,
          AccountName,
          ProcessId,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId
| order by Timestamp asc

Stage 4 — pivot the hash across the estate

The file hash is now an investigative entity. Ask whether the same content has been observed on other devices during the hunting window.

let TargetSHA1 = "0123456789abcdef0123456789abcdef01234567";
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA1 == TargetSHA1
| summarize FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp),
            Events=count(),
            Devices=make_set(DeviceName, 50),
            Paths=make_set(FolderPath, 50),
            Creators=make_set(InitiatingProcessFileName, 25)
          by SHA1, FileName
| order by FirstSeen asc

Stage 5 — build the file evidence timeline

Finish by laying the hash-related file events out chronologically across devices. This gives you the first-seen time and shows how the file moved or appeared through the environment.

let TargetSHA1 = "0123456789abcdef0123456789abcdef01234567";
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA1 == TargetSHA1
| project Timestamp,
          DeviceName,
          ActionType,
          FileName,
          FolderPath,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessId
| order by Timestamp asc

Agent Foskett's file timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft Defender XDR file telemetry recorded payload.dll being created on WS-FIN-042 shortly after the suspicious PowerShell and command-shell activity identified in the process tree. The file event preserved the file path, SHA-1 and initiating-process context. Process telemetry was then queried using the same SHA-1 to determine whether the file content appeared in execution-related activity on the device. The close timing and shared hash support a relationship between file arrival and subsequent execution; however, the file's maliciousness should be assessed using the complete process, network, prevalence and file-reputation context.

Lesson 144 key takeaways

• DeviceFileEvents records file creation, modification and other file-system activity.
• Preserve ActionType so you describe the observed file event accurately.
• The initiating process can explain where a file came from.
• Filename and path provide context but are not proof of maliciousness.
• SHA-1 is a valuable pivot for relating the same file content across telemetry.
• Creation does not prove execution.
• Use DeviceProcessEvents to test whether the file content appears in process execution telemetry.
• Time + device + hash can turn separate rows into one arrival-to-execution sequence.
• Pivot suspicious hashes across the estate to determine scope.
• Prevalence is investigative context, not a verdict.

Module 12 — the attack chain continues

Lesson 143 reconstructed the suspicious process tree. Lesson 144 now connects that execution chain to a file that appeared immediately before it became active. Next we follow the process into network telemetry and ask where it communicated.