Skip to content

Instantly share code, notes, and snippets.

@PixelRobots

PixelRobots/audit if a process is or has been running on a VM.kql

Created July 12, 2019 19:59
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save PixelRobots/1dc33cec4271cf987f4dcbe9670d2751 to your computer and use it in GitHub Desktop.
Save PixelRobots/1dc33cec4271cf987f4dcbe9670d2751 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
audit if a process is or has been running on a VM.kql
Perf
| where ObjectName == "Process" and CounterName == "% Processor Time"
| where InstanceName contains "dropbox"
| summarize Running_Instances = dcount(InstanceName) by Computer
let StartDate = datetime("2019-06-30 22:46:42");
let EndDate = datetime("2019-07-01 00:57:27");
Perf
| where TimeGenerated between(StartDate .. EndDate)
| where ObjectName == "Process" and CounterName == "% Processor Time"
| where InstanceName contains "DropBox"
| summarize Running_Instances = dcount(InstanceName) by Computer
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment