A security operations center (SOC) needs to create a custom detection rule in Microsoft Defender XDR that identifies PowerShell scripts being executed from a specific, unusual temporary folder path, which is known to be used by a new malware variant. The rule should trigger an alert if any process starts PowerShell from this path. Which Kusto Query Language (KQL) operator is most suitable for efficiently matching the specific folder path within the 'FolderPath' column of the 'DeviceProcessEvents' table, without being case-sensitive?
- Amatches regex
- Bcontains
- Cstartswith
- Dhas
Show answer & explanationAnswer & explanation
Correct answer: D. has
The 'has' operator in KQL is designed for faster, case-insensitive substring matches within text. Since the requirement is to efficiently match a specific folder path without case sensitivity, 'has' is the most suitable and performant choice. 'contains' is also case-insensitive but can be slower, especially for large datasets. 'startswith' requires the match to be at the beginning of the string, which might not cover all variations of a folder path. 'matches regex' is powerful but overkill and less performant for a simple substring match.
Why the other options are wrong
- A. The 'matches regex' operator is for complex pattern matching and is less efficient for a simple substring check.
- B. The 'contains' operator is case-insensitive but generally less performant than 'has' for exact word/substring matches.
- C. The 'startswith' operator would only match if the path began with the specified string, which may not be flexible enough.
KQL 'has' operator
A Kusto Query Language operator used for efficient, case-insensitive substring matching within text columns. It is generally faster than 'contains' for whole word or term searches.
- Performs a case-insensitive search.
- Optimized for performance compared to 'contains'.
- Matches a whole term or substring anywhere in the text.
Memory trick: Has the word? Case ignored? Fast!