Skip to content

Instantly share code, notes, and snippets.

@alexverboon

alexverboon/defender_networkprotection_systemaccount.kusto

Created May 20, 2021 20:49
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save alexverboon/9534b8a1fcafae1e7c15bcffb1ad8fdc to your computer and use it in GitHub Desktop.
Save alexverboon/9534b8a1fcafae1e7c15bcffb1ad8fdc to your computer and use it in GitHub Desktop.
Download ZIP
Defender Network Protection - blocked - activity with system account
Raw
defender_networkprotection_systemaccount.kusto
// Defender Network Protection - blocked - activity with system account
DeviceEvents
| where ActionType == "ExploitGuardNetworkProtectionBlocked"
| where InitiatingProcessAccountName == "system"
| extend ResponseCat = parse_json(AdditionalFields).ResponseCategory
| extend Uri = parse_json(AdditionalFields).DisplayName
| project Timestamp, DeviceName,DeviceId, RemoteUrl, ResponseCat, InitiatingProcessFileName, InitiatingProcessCommandLine
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment