Hafnium Exchange Vuln Detection - KQL

let networkEvent = DeviceNetworkEvents
| where ActionType == "InboundConnectionAccepted" and InitiatingProcessFileName =~ "System"
| extend netTimestamp = Timestamp
| project DeviceId, DeviceName, netTimestamp, RemoteIP, RemotePort; //Grab a table of all accepted inbound connections, projecting the Timestamp for further manipulation
let shellWrite = DeviceFileEvents
| where ActionType == "FileCreated" and FolderPath has "inetpub" and FileName has_any (".php", ".jsp", ".js", ".aspx", ".asmx", ".asax", ".cfm", ".shtml")
| project DeviceName, DeviceId, Timestamp, FileName, FolderPath;  //Grab a table of all created files in inetpub, with a file extension ending in ".php", ".jsp", ".js", ".aspx", ".asmx", ".asax", ".cfm", ".shtml". Projecting timestamp for further manipulation
DeviceFileEvents
| where (FileName =~ "applicationHost.config" or FileName =~ "administration.config") and FolderPath contains "inetpub" //Grab all instances of updates to the IIS applicationHost.config or administration.config
| join shellWrite on DeviceName, DeviceId
| join networkEvent on DeviceId, DeviceName
| extend time_diff = datetime_diff('second',Timestamp,Timestamp1) //create a time differential column for shellWrite and config update
| extend netTimeDiff = datetime_diff('second',Timestamp1,netTimestamp) //create a time differential column for networkEvent and the shellWrite
| where (time_diff <= 60 and time_diff >= 0) and (netTimeDiff <= 10  and netTimeDiff >= 0) //differential filtering for networkEvent and shellWrite