table

DeviceFileEvents

DeviceFileEvents contains file creation, modification, and other file system events reported by Microsoft Defender for Endpoint.

tablesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproduct Microsoft Defender for Endpoint P2
Required licenselicense Microsoft Graph Security API
API accessapi Microsoft Defender for Endpoint APIs
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi DeviceProcessEvents
Related tabletable DeviceEvents
Related tabletable DeviceImageLoadEvents
Related tabletable

Schema

Field	Type	Description
`Timestamp`	datetime	Date and time when the event was recorded.
`DeviceId`	string	Unique identifier for the device in the service.
`DeviceName`	string	Fully qualified domain name of the device.
`ActionType`	string	Type of file activity that triggered the event.
`FileName`	string	Name of the file that the recorded action was applied to.
`FolderPath`	string	Folder containing the file that the recorded action was applied to.
`SHA1`	string	SHA-1 hash of the file that the recorded action was applied to.
`SHA256`	string	SHA-256 hash of the file that the recorded action was applied to.
`InitiatingProcessAccountSid`	string	Security identifier of the account that ran the process responsible for the event.
`InitiatingProcessCommandLine`	string	Command line used to run the process responsible for the event.

Related KQL

Detect file modification bursts by process

Summarize high-volume file create/modify activity by device, account, and initiating process as a ransomware-style triage signal.

detection candidate

advancedendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceFileEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let minimumEvents = {minimum_events};
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| summarize FileEvents=count(), Extensions=make_set(tolower(extract(@"\.([^.\\]+)$", 1, FolderPath)), 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileEvents >= minimumEvents
| order by FileEvents desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from ransomware TTP themes into a generic file-burst query for modeled MDE tables.