Track Document Access by User SID

Monitor document access patterns for specific users using the groupBy() function

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result

logscale

#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|ProcessBlocked/ tag=process cid=CID_HERE UserSid=USER_SID_HERE
| (.pdf) OR (.xls) OR (.xlsx) OR (.doc) OR (.docx) OR (.ppt) OR (.pptx) OR (.txt) OR (.key) OR (.pages) OR (.numbers) OR (.odp) OR (.pps) OR (.ods) OR (.xlsm) OR (.odt) OR (.rtf) OR (.tex) OR (.wpd)
| groupBy([aid, ComputerName, ImageFileName, TargetFileName, CommandLine])

Introduction

The groupBy() function can be used to aggregate and analyze document access patterns by specific users, providing visibility into which documents are being accessed and from which systems.

In this example, the groupBy() function is used to track document access events for a specific user SID, helping security analysts monitor and investigate document access patterns across the environment.

Example incoming data might look like this:

@timestamp	event_simpleName	tag	cid	UserSid	aid	ComputerName	ImageFileName	TargetFileName	CommandLine
2025-11-05T10:00:00.000Z	ProcessRollup2	process	CID123	S-1-5-21-123	aid123	LAPTOP01	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	C:\Users\john\Documents\2024_Q1_pentest_host_list.xlsx	EXCEL.EXE
2025-11-05T10:01:00.000Z	ProcessRollup2	process	CID123	S-1-5-21-123	aid123	LAPTOP01	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	C:\Users\john\Documents\2024_Q1_pentest_results_draft.pptx	POWERPNT.EXE
2025-11-05T10:02:00.000Z	SyntheticProcessRollup2	process	CID123	S-1-5-21-123	aid124	DESKTOP02	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	C:\Users\john\Downloads\security_report.pdf	Acrobat.exe

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|ProcessBlocked/ tag=process cid=CID_HERE UserSid=USER_SID_HERE
```
Filters events to include only process-related events with specific event names, matching the process tag, specific CID, and User SID. The filter uses regular expressions to match multiple process event types.
It matches events where event_simpleName equals any of:
- ProcessRollup2 (captures process creation)
- SyntheticProcessRollup2 (captures synthetic process events)
- ProcessBlocked (captures blocked process creation attempts)
The tag=process ensures that only process-related events are included.
Note that this query requires replacing CID_HERE and USER_SID_HERE with actual values for the specific environment and investigation target.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| (.pdf) OR (.xls) OR (.xlsx) OR (.doc) OR (.docx) OR (.ppt) OR (.pptx) OR (.txt) OR (.key) OR (.pages) OR (.numbers) OR (.odp) OR (.pps) OR (.ods) OR (.xlsm) OR (.odt) OR (.rtf) OR (.tex) OR (.wpd)
```
Filters for common document file extensions to identify document access events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 3 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| groupBy([aid, ComputerName, ImageFileName, TargetFileName, CommandLine])
```
Groups the results by multiple fields to provide context for each document access event:
- aid: Agent ID for identifying specific endpoints.
- ComputerName: Name of the computer where the access occurred.
- ImageFileName: Full path of the process accessing the document.
- TargetFileName: Full path of the accessed document.
- CommandLine: Command line parameters used to open the document.
Event Result set.

Summary and Results

The query is used to track and analyze document access patterns for specific users by monitoring process creation events related to document handling applications.

This query is useful, for example, to investigate potential data exfiltration, monitor sensitive document access, track user behavior patterns, and provide context during security investigations.

Sample output from the incoming example data:

aid	ComputerName	ImageFileName	TargetFileName	CommandLine
aid123	LAPTOP01	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	C:\Users\john\Documents\2024_Q1_pentest_host_list.xlsx	EXCEL.EXE
aid123	LAPTOP01	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	C:\Users\john\Documents\2024_Q1_pentest_results_draft.pptx	POWERPNT.EXE
aid124	DESKTOP02	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	C:\Users\john\Downloads\security_report.pdf	Acrobat.exe

Note that this query requires replacing CID_HERE and USER_SID_HERE with actual values for the specific environment and investigation target.

Examples Library