{"id":29687,"date":"2022-08-23T13:27:48","date_gmt":"2022-08-23T13:27:48","guid":{"rendered":"https:\/\/endusersupports.com\/?page_id=29687"},"modified":"2026-06-02T17:09:06","modified_gmt":"2026-06-02T17:09:06","slug":"kql-for-defender","status":"publish","type":"page","link":"https:\/\/endusersupports.com\/index.php\/kql-for-defender\/","title":{"rendered":"KQL for Defender"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

Kusto Query Language (KQL) queries for Advanced Hunting (Microsoft Defender for Endpoint) <\/strong><\/span><\/p>\n

<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Here is the KQL query list to check the Defender client details with specific areas.\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Virus Definition status<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tVirus Definition Compliance Status<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where Timestamp > ago(30d)<\/div>\n
| where \u00a0ConfigurationId == ‘scid-2011′ and Context !='[]’<\/div>\n
| extend DefUpdate = todatetime(parse_json(Context)[0][2])<\/div>\n
| extend DefAge = datetime_diff(‘day’,now(),DefUpdate)<\/div>\n
| extend DefageGroup=case(DefAge <7,’0 to 7 Days’, DefAge <14,’7 to 14 Days’, DefAge <30,’15 to 30 Days’,’More Than 30 Days’)<\/div>\n
| summarize dcount(DeviceId) by DefageGroup<\/div>\n

\u00a0<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tVirus Definition Device List<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where Timestamp > ago(30d)<\/div>\n
| where \u00a0ConfigurationId == ‘scid-2011′ and Context !='[]’<\/div>\n
| extend SigUpdate = todatetime(parse_json(Context)[0][2])<\/div>\n
| extend SigAge = datetime_diff(‘day’,now(),SigUpdate)<\/div>\n
| project Timestamp, DeviceName, SigAge, SigUpdate<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tViru Definition Not Updated Device List<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where Timestamp > ago(30d)<\/div>\n
| where \u00a0ConfigurationId == ‘scid-2011′ and Context !='[]’<\/div>\n
| extend SigUpdate = todatetime(parse_json(Context)[0][2])<\/div>\n
| extend SigAge = datetime_diff(‘day’,now(),SigUpdate)<\/div>\n
| where SigAge > 7<\/div>\n
| project Timestamp, DeviceName, SigAge, SigUpdate<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tVirus Definition status for specific device<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where Timestamp > ago(30d)<\/div>\n
| where \u00a0ConfigurationId == ‘scid-2011′ and Context !='[]’<\/div>\n
| extend SigUpdate = todatetime(parse_json(Context)[0][2])<\/div>\n
| extend SigAge = datetime_diff(‘day’,now(),SigUpdate)<\/div>\n
| where SigAge > 7<\/div>\n
| where DeviceName contains “lht00001”<\/div>\n
| project Timestamp, DeviceName, SigAge, SigUpdate<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Product AV Version Details<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tProduct AV version Counts<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where ConfigurationId == “scid-2011”<\/div>\n
| where isnotempty(Context) and Context != “[]”<\/div>\n
| extend avdata = parse_json(Context)<\/div>\n
| extend AVProductVersion = tostring(avdata[0][3])<\/div>\n
| where isnotempty(AVProductVersion)<\/div>\n
| summarize DeviceCount = dcount(DeviceId) by AVProductVersion<\/div>\n
| order by DeviceCount desc<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tProduct AV version list<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where ConfigurationId == “scid-2011”<\/div>\n
| where isnotempty(Context) and Context != “[]”<\/div>\n
| extend avdata = parse_json(Context)<\/div>\n
| extend AVProductVersion = tostring(avdata[0][3])<\/div>\n
| where isnotempty(AVProductVersion)<\/div>\n
| summarize arg_max(Timestamp, *) by DeviceId<\/div>\n
| project DeviceName, DeviceId, AVProductVersion, Timestamp<\/div>\n
| order by DeviceName asc<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tProduct AV version for Specific device<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where ConfigurationId == “scid-2011”<\/div>\n
| where isnotempty(Context) and Context != “[]”<\/div>\n
| extend avdata = parse_json(Context)<\/div>\n
| extend AVProductVersion = tostring(avdata[0][3])<\/div>\n
| where isnotempty(AVProductVersion)<\/div>\n
| summarize arg_max(Timestamp, *) by DeviceId<\/div>\n
| where DeviceName contains “lht00001”<\/div>\n
| project DeviceName, DeviceId, AVProductVersion, Timestamp<\/div>\n
| order by DeviceName asc<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDevices with specific product AV version<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where ConfigurationId == “scid-2011”<\/div>\n
| where isnotempty(Context) and Context != “[]”<\/div>\n
| extend avdata = parse_json(Context)<\/div>\n
| extend AVProductVersion = tostring(avdata[0][3])<\/div>\n
| where isnotempty(AVProductVersion)<\/div>\n
| summarize arg_max(Timestamp, *) by DeviceId<\/div>\n
| where AVProductVersion == “4.18.23.0.0”<\/div>\n
| project DeviceName, DeviceId, AVProductVersion, Timestamp<\/div>\n
| order by DeviceName asc<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Firewall\u00a0<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCheck block network connection<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

DeviceNetworkEvents
| where ActionType == “ConnectionBlocked”
| project Timestamp, DeviceName, LocalIP, RemoteIP, RemotePort, Protocol, InitiatingProcessFileName
| sort by Timestamp desc<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCheck Inbound connections blocks<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

DeviceNetworkEvents
| where ActionType == “InboundConnectionBlocked”
| summarize BlockCount = count() by RemoteIP, DeviceName, bin(Timestamp, 1h)
| sort by BlockCount desc<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCheck Outbound connection blocks<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

DeviceNetworkEvents
| where ActionType == “ConnectionBlocked”
| where InitiatingProcessFileName !in~ (“chrome.exe”,”msedge.exe”,”firefox.exe”)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCheck Firewall block for all connections<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

DeviceEvents<\/p>\n

| where Timestamp > (30d)<\/p>\n

| where ActionType in (“FirewallOutBoundConnectionBlocked”, “FirewallInBoundConnectionBlocked”,”FirewallOutBoundConnectionToAppBlocked”)<\/p>\n

| project DeviceName, Timestamp, InitiatingProcessFileName, InitiatingProcessParentFileName, RemoteIP, RemotePort, LocalIP, LocalPort,ActionType<\/p>\n

\/\/| where DeviceName contains “”<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tFirewall blocked traffic<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

DeviceNetworkEvents<\/p>\n

| where Timestamp > (7d)<\/p>\n

| project Timestamp, DeviceName, ActionType, RemoteIP, RemotePort, RemoteUrl, LocalIP, LocalPort,Protocol, LocalIPType, InitiatingProcessFileName<\/p>\n

\/\/| where ActionType == “ConnectionFailed”<\/p>\n

| where RemotePort == “3389”<\/p>\n

| where DeviceName contains \u00a0“desktop-3jtb9c6”<\/p>\n

| order by Timestamp<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCheck who modified firewall rules<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

DeviceEvents
| where ActionType in (“FirewallRuleAdded”, “FirewallRuleModified”, “FirewallRuleDeleted”)
| project Timestamp, DeviceName, ActionType, InitiatingProcessAccountName
| sort by Timestamp desc<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tTop Port Blocks<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceNetworkEvents<\/div>\n
| where ActionType == “ConnectionBlocked”<\/div>\n
| summarize Count = count() by RemotePort<\/div>\n
| sort by Count desc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHigh volume blocked activity<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceNetworkEvents<\/div>\n
| where ActionType == “ConnectionBlocked”<\/div>\n
| summarize BlockCount = count() by DeviceName, bin(Timestamp, 5m)<\/div>\n
| where BlockCount > 200<\/div>\n
| sort by BlockCount desc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tAdvanced: Firewall Health and Risk View<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceInfo<\/div>\n
| summarize LastSeen = max(Timestamp) by DeviceName<\/div>\n
| join kind=leftouter (<\/div>\n
\u00a0\u00a0\u00a0 DeviceEvents<\/div>\n
\u00a0\u00a0\u00a0 | where ActionType in (“FirewallDisabled”)<\/div>\n
\u00a0\u00a0\u00a0 | summarize FirewallDisabledCount = count() by DeviceName<\/div>\n
) on DeviceName<\/div>\n
| join kind=leftouter (<\/div>\n
\u00a0\u00a0\u00a0 DeviceNetworkEvents<\/div>\n
\u00a0\u00a0\u00a0 | where ActionType == “ConnectionBlocked”<\/div>\n
\u00a0\u00a0\u00a0 | summarize BlockedConnections = count() by DeviceName<\/div>\n
) on DeviceName<\/div>\n
| extend RiskLevel = case(<\/div>\n
\u00a0\u00a0\u00a0 FirewallDisabledCount > 0, “High Risk”,<\/div>\n
\u00a0\u00a0\u00a0 BlockedConnections > 1000, “Medium Risk”,<\/div>\n
\u00a0\u00a0\u00a0 “Normal”<\/div>\n
)<\/div>\n
| project DeviceName, LastSeen, FirewallDisabledCount, BlockedConnections, RiskLevel<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

KQL for ASR and EDR\u00a0<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tASR Rule blocked<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents<\/div>\n
| where ActionType == “AsrRuleBlocked”<\/div>\n
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ActionType, AdditionalFields<\/div>\n
| sort by Timestamp desc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tASR Rule audit<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents<\/div>\n
| where ActionType == “AsrRuleAudited”<\/div>\n
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ActionType<\/div>\n
| sort by Timestamp desc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tBlocked by ASR<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
\n
DeviceEvents<\/div>\n
| where ActionType startswith “ASR”<\/div>\n
| extend Fields=parse_json(AdditionalFields)<\/div>\n
| extend IsAudit = tostring(Fields.IsAudit)<\/div>\n
| where IsAudit == “false”<\/div>\n
| project Timestamp, DeviceName, ActionType, IsAudit, ReportId, DeviceId<\/div>\n<\/div>\n<\/div>\n
<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tASR Trigger Pivo<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceEvents\n| where ActionType startswith 'ASR'\n| project DeviceName, ActionType\n| evaluate pivot(ActionType)<\/code><\/pre>\n<\/div>\n
<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHight Alerts from devices<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents<\/div>\n
| where ActionType == “AsrRuleBlocked”<\/div>\n
| summarize BlockCount = count() by DeviceName<\/div>\n
| sort by BlockCount desc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHigh Alerts from application<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents<\/div>\n
| where ActionType == “AsrRuleBlocked”<\/div>\n
| summarize Count = count() by InitiatingProcessFileName<\/div>\n
| sort by Count desc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tSuspicious activity from Microsoft Office<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents<\/div>\n
| where ActionType == “AsrRuleBlocked”<\/div>\n
| where InitiatingProcessFileName in~ (“winword.exe”,”excel.exe”,”powerpnt.exe”)<\/div>\n
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tASR Rule blocked rule per device<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents<\/div>\n
| where ActionType == “AsrRuleBlocked”<\/div>\n
| extend RuleId = tostring(parse_json(AdditionalFields).RuleId)<\/div>\n
| summarize BlockCount = count() by DeviceName, RuleId<\/div>\n
| sort by BlockCount desc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDevice with No ASR activity<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceInfo<\/div>\n
| join kind=leftouter (<\/div>\n
\u00a0\u00a0\u00a0 DeviceEvents<\/div>\n
\u00a0\u00a0\u00a0 | where ActionType in (“AsrRuleBlocked”,”AsrRuleAudited”)<\/div>\n
\u00a0\u00a0\u00a0 | summarize LastASR = max(Timestamp) by DeviceName<\/div>\n
) on DeviceName<\/div>\n
| where isnull(LastASR)<\/div>\n
| project DeviceName, OSPlatform, SensorHealthState<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tASR Ransomware attack details<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
\n
DeviceEvents\n| where<\/span> ingestion_time<\/span>() > ago<\/span>(30<\/span>d<\/span>)\n| where<\/span> ActionType in<\/span> ('AsrRansomwareBlocked'<\/span>, 'AsrRansomwareAudited'<\/span>)\n| summarize<\/span> arg_max<\/span>(Timestamp, *), TotalEvents = count<\/span>(), TriggeredFiles = make_set<\/span>(FileName), FileHashes = make_set<\/span>(SHA1), IntiatingProcesses = make_set<\/span>(InitiatingProcessCommandLine) by<\/span> DeviceName, AccountName\n| project<\/span> Timestamp, DeviceName, AccountDomain, AccountName, TotalEvents, TriggeredFiles, FileHashes, IntiatingProcesses<\/pre>\n<\/div>\n<\/div>\n
<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tEDR Status<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceInfo<\/div>\n
| summarize LastSeen = max(Timestamp), Health = any(SensorHealthState), Onboard = any(OnboardingStatus) by DeviceName<\/div>\n
| extend EDRStatus = case(<\/div>\n
\u00a0\u00a0\u00a0 Onboard != “Onboarded”, “Not Onboarded”,<\/div>\n
\u00a0\u00a0\u00a0 Health != “Active”, “Sensor Issue”,<\/div>\n
\u00a0\u00a0\u00a0 LastSeen < ago(3d), “No Recent Check-in”,<\/div>\n
\u00a0\u00a0\u00a0 “Active”<\/div>\n
)<\/div>\n
| project DeviceName, LastSeen, Health, Onboard, EDRStatus<\/div>\n
| order by EDRStatus asc<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
KQL Query for USB Device Control Policy<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCheck USB Device Write or Deny status<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
\n
DeviceEvents<\/div>\n
| where ActionType == “RemovableStoragePolicyTriggered”<\/div>\n
| extend parsed=parse_json(AdditionalFields)<\/div>\n
| extend RemovableStorageAccess = tostring(parsed.RemovableStorageAccess)<\/div>\n
| extend RemovableStoragePolicyVerdict = tostring(parsed.RemovableStoragePolicyVerdict)<\/div>\n
| extend MediaBusType = tostring(parsed.BusType)<\/div>\n
| extend MediaClassGuid = tostring(parsed.ClassGuid)<\/div>\n
| extend MediaDeviceId = tostring(parsed.DeviceId)<\/div>\n
| extend MediaInstanceId = tostring(parsed.DeviceInstanceId)<\/div>\n
| extend MediaName = tostring(parsed.MediaName)<\/div>\n
| extend RemovableStoragePolicy = tostring(parsed.RemovableStoragePolicy)<\/div>\n
| project Timestamp, DeviceId, DeviceName, ActionType, RemovableStorageAccess,<\/div>\n
RemovableStoragePolicyVerdict, MediaBusType, MediaClassGuid, MediaDeviceId,<\/div>\n
MediaInstanceId, MediaName, RemovableStoragePolicy<\/div>\n
| where RemovableStoragePolicyVerdict == “Deny”<\/div>\n
| where DeviceName contains “LHT00001”<\/div>\n
| order by Timestamp desc<\/div>\n<\/div>\n<\/div>\n
<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tUSB Device Connectors<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents\n| where<\/span> ActionType == \"PnpDeviceConnected\"<\/span>\n| extend<\/span> PNPInfo = parse_json<\/span>(AdditionalFields)\n| extend<\/span> ClassName = tostring<\/span>(PNPInfo.ClassName), DeviceDescription = tostring<\/span>(PNPInfo.DeviceDescription), VendorIds = tostring<\/span>(PNPInfo.VendorIds), DeviceId = tostring<\/span>(PNPInfo.DeviceId)\n| extend<\/span> PnPType = tostring<\/span>(split<\/span>(DeviceId, @\"\\\"<\/span>, 0<\/span>)[0<\/span>])\n| where<\/span> PnPType == \"USB\"<\/span>\n| project<\/span>-reorder ClassName, PnPType, DeviceDescription, VendorIds, DeviceId\n| summarize<\/span> TotalEvents = count<\/span>() by<\/span> DeviceDescription\n| sort<\/span> by<\/span> TotalEvents<\/pre><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
General KQL Query\u00a0<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDevice Health Status<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
let avmodetable = DeviceTvmSecureConfigurationAssessment<\/div>\n
| where ConfigurationId == “scid-2010” and isnotnull(Context)<\/div>\n
| extend avdata=parsejson(Context)<\/div>\n
| extend AVMode = iif(tostring(avdata[0][0]) == ‘0’, ‘Active’ , iif(tostring(avdata[0][0]) == ‘1’, ‘Passive’ ,iif(tostring(avdata[0][0]) == ‘4’, ‘EDR Blocked’,iif(tostring(avdata[0][0]) == ‘2’, \u00a0‘SxS Passive’ ,’Unknown’))))<\/div>\n
| project DeviceId, AVMode;<\/div>\n
DeviceTvmSecureConfigurationAssessment<\/div>\n
| where ConfigurationId == “scid-2011” and isnotnull(Context)<\/div>\n
| extend avdata=parsejson(Context)<\/div>\n
| extend AVSigVersion = tostring(avdata[0][0])<\/div>\n
| extend AVEngineVersion = tostring(avdata[0][1])<\/div>\n
| extend AVSigLastUpdateTime = tostring(avdata[0][2])<\/div>\n
| project DeviceId, DeviceName, OSPlatform, AVSigVersion, AVEngineVersion, AVSigLastUpdateTime, IsCompliant, IsApplicable<\/div>\n
| join avmodetable on DeviceId<\/div>\n
| project-away DeviceId1<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDevice Scanning Details<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
DeviceEvents<\/div>\n
| where ActionType in (“AntivirusScanCompleted”, “AntivirusScanCancelled”)<\/div>\n
| extend A=parse_json(AdditionalFields) \u00a0<\/div>\n
| project Timestamp, DeviceName, ActionType,ScanType = A.ScanTypeIndex, StartedBy= A.User<\/div>\n
| sort by Timestamp desc<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDevice are not onboarded in Defender<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
let CanBeOnboarded = “Can be onboarded”;<\/div>\n
DeviceInfo<\/div>\n
| summarize arg_max(Timestamp, *) by DeviceId<\/div>\n
| where OnboardingStatus == CanBeOnboarded<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDefender Discovery Activities<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
let<\/span> ProcessBased <\/span>= DeviceProcessEvents\n| where<\/span> ProcessCommandLine has<\/span> \"Get-MpPreference\"<\/span>\n| extend<\/span> Table = \"DeviceProcessEvents\"<\/span>\n| project<\/span>-reorder Table, Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName;\nlet<\/span> EventBased <\/span>= DeviceEvents\n| extend<\/span> Command = parse_json<\/span>(AdditionalFields).Command\n| where<\/span>  Command == \"Get-MpPreference\"<\/span>\n| extend<\/span> ScriptLocation = extract<\/span>(@\"literalPath '(.*?)'\"<\/span>, 0<\/span>, InitiatingProcessCommandLine)\n| extend<\/span> Table = \"DeviceEvents\"<\/span>\n| project<\/span>-reorder Table, Timestamp, DeviceName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, ScriptLocation;\nunion<\/span> ProcessBased, EventBased<\/pre><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDefender Exclusions Events<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
let<\/span> ExclusionOptions <\/span>= dynamic<\/span>(['ExclusionPath'<\/span>, 'ExclusionExtension'<\/span>, 'ExclusionProcess'<\/span>, 'ExclusionIpAddress'<\/span>]);\nlet<\/span> Modules <\/span>= dynamic<\/span>(['Add-MpPreference'<\/span>,'Set-MpPreference'<\/span>]);\nlet<\/span> CommandLineExecutions <\/span>= DeviceProcessEvents\n    | where<\/span> ProcessCommandLine has_any (Modules) and<\/span> ProcessCommandLine has_any (ExclusionOptions);\nlet<\/span> PowerShellExecutions <\/span>= DeviceEvents\n    | where<\/span> ActionType == 'PowerShellCommand'<\/span> \n    | where<\/span> AdditionalFields  has_any (Modules) and<\/span> AdditionalFields has_any (ExclusionOptions);\nunion<\/span> PowerShellExecutions, CommandLineExecutions<\/pre><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tOperating System Counts in Defender<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
let CanBeOnboarded = “Can be onboarded”;<\/div>\n
DeviceInfo<\/div>\n
| summarize arg_max(Timestamp, *) by DeviceId<\/div>\n
| where OnboardingStatus == CanBeOnboarded<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tLast User Logged on details<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n
let LastLogins=DeviceLogonEvents<\/div>\n
\u00a0 | where LogonType == “Interactive”<\/div>\n
\u00a0 | where InitiatingProcessParentFileName == “wininit.exe”<\/div>\n
\u00a0 | summarize LastLogon=arg_max(Timestamp, *) by AccountName, DeviceName<\/div>\n
\u00a0 | project AccountName, DeviceName, LastLogon;<\/div>\n
let Logins=DeviceLogonEvents<\/div>\n
\u00a0 | where LogonType == “Interactive”<\/div>\n
\u00a0 | where InitiatingProcessParentFileName == “wininit.exe” \u00a0 \u00a0 \u00a0 \u00a0<\/div>\n
\u00a0 | summarize Logins=count() by AccountName, DeviceName<\/div>\n
\u00a0 | project AccountName, Logins, DeviceName;<\/div>\n
let NetworkInfo=DeviceNetworkInfo<\/div>\n
\u00a0 | where IPv4Dhcp <> “”<\/div>\n
\u00a0 | mvexpand parse_json(IPAddresses)<\/div>\n
\u00a0 | where IPAddresses.IPAddress !contains “:”<\/div>\n
\u00a0 | summarize arg_max(Timestamp, *) by DeviceName<\/div>\n
\u00a0 | project DeviceName, IPAddress=IPAddresses.IPAddress, Timestamp;<\/div>\n
Logins<\/div>\n
| join kind=inner ( LastLogins<\/div>\n
\u00a0 | project AccountName, DeviceName, LastLogon<\/div>\n
) on DeviceName, AccountName<\/div>\n
| join kind=leftouter \u00a0( NetworkInfo<\/div>\n
\u00a0 | project DeviceName, IPAddress, Timestamp<\/div>\n
) on DeviceName<\/div>\n
| project AccountName, DeviceName, LastLogon, Logins, IPAddress<\/div>\n
| sort by DeviceName<\/div>\n<\/div><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tSmart Screen event<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceEvents\n| where<\/span> Timestamp > ago<\/span>(30<\/span>d<\/span>)\n| where<\/span> ActionType startswith<\/span> \"SmartScreen\"<\/span>\n| extend<\/span> SmartScreenTrigger = iff<\/span>(ActionType == \"SmartScreenUrlWarning\"<\/span>, \nRemoteUrl, FileName)\n| extend<\/span> ReasonForTrigger = parse_json<\/span>(AdditionalFields).Experience\n| project<\/span>\n     Timestamp,\n     DeviceName,\n     ActionType,\n     SmartScreenTrigger,\n     ReasonForTrigger,\n     InitiatingProcessCommandLine<\/pre><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDetect Know RAT and RMM Process Patterns<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\/\/ Author: Alex Teixeira (alex@opstune.com)<\/span>\nDeviceProcessEvents\n| where<\/span> Timestamp > ago<\/span>(60<\/span>d<\/span>)\n\/\/ Speed up the query by filtering most frequent processes<\/span>\n| where<\/span> FolderPath matches<\/span> regex<\/span> @'(?i)^[a-z]:\\\\\\S+\\.exe'<\/span> and<\/span> not<\/span> ((FolderPath contains<\/span> \"c:\\\\windows\"<\/span> and<\/span> FolderPath matches<\/span> regex<\/span> @'(?i)microsoft\\.net|softwaredistribution|system32|syswow64|ccm|servicing|winsxs'<\/span>) or<\/span> FolderPath matches<\/span> regex<\/span> @'(?i)^(d:\\\\apps|c:\\\\_datas\\\\)'<\/span>)\n\/\/ Normalize to frequent (known) RATs<\/span>\n| extend<\/span> RAT=case<\/span>(\n  FolderPath contains<\/span> \"teamviewer\"<\/span>, \"TeamViewer\"<\/span>,\n  FolderPath contains<\/span> \"anydesk\"<\/span>, \"AnyDesk\"<\/span>,\n  FolderPath contains<\/span> \"rustdesk\"<\/span>, \"RustDesk\"<\/span>,\n  FolderPath contains<\/span> \"vnc\"<\/span>, \"VNC\"<\/span>,\n  FolderPath contains<\/span> \"manageengine\"<\/span>, \"ManageEngine\"<\/span>,\n  FolderPath contains<\/span> \"fastclient\"<\/span>, \"FastClient\"<\/span>,\n  FolderPath contains<\/span> \"logmein\"<\/span>, \"LogMeIn\"<\/span>,\n  FolderPath contains<\/span> \"bomgar\"<\/span>, \"Bomgar\"<\/span>,\n  FolderPath contains<\/span> \"netviewer\"<\/span>, \"NetViewer\"<\/span>,\n  FolderPath contains<\/span> \"ultraviewer\"<\/span>, \"UltraViewer\"<\/span>,\n  FolderPath contains<\/span> \"dwrcs\"<\/span>, \"Dameware\"<\/span>,\n  FolderPath contains<\/span> \"splashtop\"<\/span>, \"Splashtop\"<\/span>,\n  FolderPath contains<\/span> \"zerotier\"<\/span>, \"ZeroTier\"<\/span>,\n  FolderPath contains<\/span> \"supremo\"<\/span>, \"Supremo\"<\/span>,\n  \"Other\"<\/span>\n)\n| summarize<\/span> count<\/span>(), count_distinct(DeviceName), make_set<\/span>(DeviceName), max<\/span>(Timestamp) by<\/span> RAT, FolderPath\n| extend<\/span> r_1=@'(?i)[\\\\]+(NetWire|rport)[\\\\]+|Rsocx|BeAnywhere|DWservice|Fleetdeck|Itarian Endpoint Manager|Splashtop|Level\\.io|ManageEngine|ScreenConnect|TrendMicro BaseCamp|Sorillus|ZeroTier|JollyFastVNC|AB Tutor|Barracuda Workplace|SolarWinds RMM|Naverisk'<\/span>\n| extend r_2=@'(?i)(NetSupport|TeamViewer|Anydesk|UltraViewer|realvnc|TightVNC|LogMeIn|fastclient|ultraVNC|bomgar.+scc|accessserver|aeroadmin|alitask|alpemix|ammyy|ateraagent|basupsrvc|basupsrvcupdate|basuptshelper|beamyourscreen|beanywhere|cagservice|chrome remote desktop|clientmrinit|connectwise|connectwisecontrol|crossloopservice|ctiserv|dameware|datto|domotz|dwrcs|dwservice|eratool|ericomconnnectconfigurationtool|ezhelpclient|fixmeit|fixmeitclient|fleetdeck|goverrmc|guacd|instanthousecall|intelliadmin|iperiusremote|islalwaysonmonitor|isllightservice|itarian|jumpclient|jumpdesktop|jumpservice|kaseya|landeskagentbootstrap|laplink|laplinkeverywhere|ldsensors|llrcservice|lmiignition|ltsvcmon|mgntsvc|mikogo|mionet|myivomanager|nateon|neturo|netviewer|nhostsvc|ntrntservice|orcus|pcaquickconnect|pcstarter|pcvisit|pocketcontroller|ptdskclient|pulseway|rcengmgru|rcmgrsvc|rdpwrap|remobo|remote utilities|remoteconsole|remotepass|remotepc|remotepcservice|remotesupportplayeru|remoteview|rfusclient|romfusclient|romserver|romviewer|rpaccess|rpcgrab|rpcsetup|rpcsuite|rpwhostscr|rustdesk|rutserv|rutview|rxstartsupport|screenconnect|seetrolclient|seetrolremote|serverproxyservice|showmypc|simplehelpcustomer|simpleservice|sorillus|sragent|supremo|supremohelper|syncro|tacticalrmm|take\\s*control|tdp2tcp|tigervnc|trend.+basecamp|turbomeeting|ultraviewer|vncconnect|webex remote|webrdp|weezo|weezohttpd|windows admin centre|wmcsvc|zerotier|zoho assist).*\\.exe$'\n| extend<\/span> r_3=@'(?i)\\\\(baseclient|BASupApp|DWAgent|ITSMAgent|level|Atera|radmin|srserver|rvagent|intouch)\\.exe$'<\/span>\n| where<\/span> (FolderPath matches<\/span> regex<\/span> r_1 or<\/span> FolderPath matches<\/span> regex<\/span> r_2 or<\/span> FolderPath matches<\/span> regex<\/span> r_3)\n| extend<\/span> set_DeviceName=iff<\/span>(count_distinct_DeviceName>5<\/span>, strcat<\/span>(\"Too many (\"<\/span>, count_distinct_DeviceName, \")\"<\/span>), set_DeviceName)\n| summarize<\/span> TotalEvents=sum<\/span>(count_), DeviceCount=count_distinct(set_DeviceName), Devices=make_set<\/span>(set_DeviceName), Processes=make_set<\/span>(FolderPath), LastSeen=max<\/span>(max_Timestamp) by<\/span> RAT\n| sort<\/span> by<\/span> DeviceCount desc<\/span>, TotalEvents desc<\/span><\/pre><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDevice with SMB Connections Details<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
DeviceNetworkEvents\n| where<\/span> RemotePort == 445<\/span>\n| where<\/span> ActionType == \"ConnectionSuccess\"<\/span>\n\/\/ Collect the last event that a device has connected via SMB to a unique remote IP<\/span>\n| summarize<\/span> arg_max<\/span>(Timestamp, *) by<\/span> DeviceId, RemoteIP\n| summarize<\/span> RemoteSMBUrls = make_set_if(RemoteUrl, isnotempty<\/span>(RemoteUrl)), make_set_if(RemoteIP, isempty<\/span>(RemoteUrl)), TotalConnections = dcount<\/span>(RemoteIP) by<\/span> DeviceName\n| sort<\/span> by<\/span> TotalConnections<\/pre><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"
Kusto Query Language (KQL) queries for Advanced Hunting (Microsoft Defender for Endpoint)  Here is the KQL query list to check the Defender client details with specific areas.\u00a0 Virus Definition status Virus Definition Compliance Status DeviceTvmSecureConfigurationAssessment | where Timestamp > ago(30d) | where \u00a0ConfigurationId == ‘scid-2011′ and Context !='[]’ | extend DefUpdate = todatetime(parse_json(Context)[0][2]) | extend […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"class_list":["post-29687","page","type-page","status-publish","hentry"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/pages\/29687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/comments?post=29687"}],"version-history":[{"count":49,"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/pages\/29687\/revisions"}],"predecessor-version":[{"id":31087,"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/pages\/29687\/revisions\/31087"}],"wp:attachment":[{"href":"https:\/\/endusersupports.com\/index.php\/wp-json\/wp\/v2\/media?parent=29687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}