Agent Foskett Academy • SOC Analyst Academy • Module 4 • Lesson 34 • Endpoint Incidents: Following the Attack Chain

Lesson 34 — The File Appeared Seconds Before It Executed

The executable was not installed days ago.

It appeared on disk at 10:14:38.

Seven seconds later, it ran.

That timing mattered. A file that arrives and executes almost immediately can represent the hand-off between delivery and execution in an attack chain.

Agent Foskett's question became: what created the file, where did it land, and what process launched it?

File creation and execution are stronger evidence when the timestamps connect them into one sequence.

Correlate File and Process Events Back to SOC Analyst Academy

Agent Foskett investigating a file created seconds before execution in Microsoft Defender XDR

Seven seconds changed the story

The analyst must connect file creation, source process, path, hash and execution timing before deciding whether the file is part of the compromise.

✓ Identify the file creation event

✓ Find the process that created it

✓ Correlate creation with execution

✓ Follow the file into later activity

Case briefing

10:14:38 — FILE CREATED C:\Users\alex.wilson\AppData\Local\Temp\update-check.exe CREATED BY powershell.exe SHA1 9D0B...E41C 10:14:45 — PROCESS STARTED update-check.exe PARENT powershell.exe TIME BETWEEN CREATION AND EXECUTION 7 seconds THE EASY VIEW "A file was created." THE SOC VIEW "Why was it created and executed almost immediately?"

Investigation objective

Determine what created the file, whether the path and hash are expected, how quickly execution followed creation and what the new process did after launch.

Investigator's rule

Timing creates context. File creation and process execution become much more meaningful when they occur seconds apart in the same execution chain.

Stage 1 — establish the file event

Field	Why it matters
FileName	Provides the artifact name for further hunting.
FolderPath	Shows where the file landed and whether the location is expected.
SHA1 / SHA256	Provides a stable pivot across devices and telemetry.
InitiatingProcessFileName	Explains what created or modified the file.
Timestamp	Allows correlation with later execution.

Temporary paths deserve context

Legitimate software often uses temporary directories. A temp path is not malicious by itself, but it becomes more interesting when paired with suspicious creation and rapid execution.

Hashes are useful pivots

A file hash can help the analyst search for the same artifact elsewhere, compare prevalence and connect file telemetry with process execution.

Stage 2 — find the file creation event

12345 6789101112 131415

let TargetDevice = "WS-FIN-044";
DeviceFileEvents
| where Timestamp > ago(24h)
| where DeviceName =~ TargetDevice
| where FileName =~ "update-check.exe"
| project Timestamp,
          ActionType,
          FileName,
          FolderPath,
          SHA1,
          SHA256,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Find who created it

The initiating process is often the bridge back to the previous stage of the attack chain. Here, suspicious PowerShell activity created the file.

Preserve the exact path

The path can reveal staging behaviour and may distinguish a downloaded payload from a legitimately installed application.

Stage 3 — correlate file creation with process execution

12345 6789101112 1314151617

let TargetDevice = "WS-FIN-044";
let TargetHash = "9D0B...E41C";
DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceName =~ TargetDevice
| where SHA1 == TargetHash
   or FileName =~ "update-check.exe"
| project Timestamp,
          FileName,
          FolderPath,
          SHA1,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          AccountName
| order by Timestamp asc

Compare the timestamps

Creation at 10:14:38 and execution at 10:14:45 creates a seven-second hand-off. The timing strongly supports one continuous sequence.

The parent process matters again

If the same PowerShell process both creates and launches the file, the relationship between delivery and execution becomes much clearer.

Stage 4 — reconstruct the local timeline

10:14:27 powershell.exe starts ↓ 10:14:38 update-check.exe created ↓ 10:14:45 update-check.exe executes ↓ 10:14:49 child process appears ↓ 10:14:53 network connection begins ONE DEVICE ONE USER ONE CONTINUOUS CHAIN

Seconds matter

Endpoint attacks can move quickly. Preserve precise timestamps rather than rounding everything to the nearest minute.

Do not assume creation means download

A file can be created by download, extraction, script output, copy operations or another application. Use the initiating process and command line to establish the mechanism.

Stage 5 — hunt the hash across devices

1234567891011

let TargetHash = "9D0B...E41C";
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA1 == TargetHash
| summarize
    Devices=dcount(DeviceName),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
    by SHA1, FileName
| order by LastSeen desc

Prevalence changes confidence

A file seen once on one device may deserve more scrutiny than a well-known business binary observed across hundreds of endpoints — but rarity alone does not prove maliciousness.

Search both file and process telemetry

The same hash can appear in file events and process events. Use both to understand where the artifact existed and where it actually executed.

Stage 6 — follow what the file did next

12345678910111213

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where DeviceName =~ "WS-FIN-044"
| where InitiatingProcessFileName =~ "update-check.exe"
| project Timestamp,
          RemoteUrl,
          RemoteIP,
          RemotePort,
          Protocol,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Execution may only be the midpoint

Once the file runs, the next clues may be network connections, child processes, persistence changes or credential-access behaviour.

Follow evidence, not assumptions

If there is no network activity, do not invent command-and-control. Continue with the endpoint telemetry that is actually present.

Stage 7 — test competing explanations

Hypothesis	Evidence to test
Legitimate software update	Signed binary, expected vendor path, change context and broad prevalence.
User-downloaded executable	Browser/download evidence, user confirmation and expected filename/path.
Script-created business tool	Known automation, expected PowerShell command and historical recurrence.
Malicious payload	Suspicious creator process, unusual path, low prevalence and malicious follow-on behaviour.

Stage 8 — make the SOC decision

FILE CREATED ↓ IDENTIFY CREATOR PROCESS ↓ RECORD PATH + HASH ↓ MATCH FILE TO PROCESS EXECUTION ↓ COMPARE TIMESTAMPS ↓ CHECK PREVALENCE ↓ FOLLOW CHILD / NETWORK ACTIVITY ↓ VALIDATE BUSINESS CONTEXT ↓ CLOSE / CONTINUE / ESCALATE / CONTAIN

The important clue was not merely that the file existed. It was that creation and execution were separated by only seven seconds inside the same suspicious chain.

Write the investigation finding

ENDPOINT INVESTIGATION FINDING DeviceFileEvents showed update-check.exe created on WS-FIN-044 at 10:14:38. The file was created by powershell.exe. DeviceProcessEvents showed the same file executing at 10:14:45. Creation and execution were separated by seven seconds. The file was not prevalent in the environment and follow-on endpoint activity remained inconsistent with expected user behaviour. DECISION Escalate the file as part of the suspected endpoint compromise. REASON Creation, execution timing and process ancestry connect the file directly to the previously identified suspicious PowerShell chain.

Lesson 34 key takeaways

Correlate file creation and process execution rather than investigating them separately.
Precise timestamps can connect delivery and execution into one sequence.
Use the initiating process to understand how the file appeared.
Preserve file path and cryptographic hashes as investigation pivots.
Temporary directories are context, not proof of maliciousness.
Use DeviceFileEvents and DeviceProcessEvents together.
Check prevalence across the environment before deciding what rarity means.
Follow the executed file into child-process and network telemetry.
Test legitimate software and user explanations before escalating.
Make the final decision from the complete creation-to-execution chain.

Module 4 — Endpoint Incidents: Following the Attack Chain

Lesson 34 connects file creation to execution. Next, Agent Foskett follows the newly executed process when it begins communicating with an external IP address.

Next: Lesson 35 — The Process Connected to an External IP

Continue your SOC Analyst training

Module 3 focuses on identity incidents, authentication, MFA, privilege, sessions and application access.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 4: Endpoint Incidents: Following the Attack Chain

Follow endpoint evidence across execution, persistence, credential access, movement and containment.

← Previous lesson

Lesson 33 — The Process Tree Didn't Match Normal User Activity Use process ancestry to distinguish normal from suspicious execution.

✅ Current lesson

Lesson 34 — The File Appeared Seconds Before It Executed Correlate file creation with execution.

Next lesson →

Lesson 35 — The Process Connected to an External IP Connect execution with outbound network activity.

How to investigate a file created seconds before execution in Microsoft Defender XDR

Lesson 34 of the Agent Foskett SOC Analyst Academy teaches analysts how to correlate DeviceFileEvents with DeviceProcessEvents, compare creation and execution timestamps, preserve hashes and follow suspicious files through an endpoint attack chain.

KQL file creation and execution correlation for SOC analysts

Learn how to use Microsoft Defender XDR advanced hunting to investigate file creation, process execution, hash prevalence and follow-on network activity during endpoint compromise analysis.