Skip to content

Instantly share code, notes, and snippets.

@mwollenweber

mwollenweber/Defender AV Results

Created June 23, 2023 13:30
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mwollenweber/a3d6285f38b22b7f366cc9df20f54173 to your computer and use it in GitHub Desktop.
Save mwollenweber/a3d6285f38b22b7f366cc9df20f54173 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Defender AV Results
// Query for Microsoft Defender Antivirus detections.
// Query #1: Query for Antivirus detection events
DeviceEvents
| where ActionType == "AntivirusDetection"
| extend ParsedFields=parse_json(AdditionalFields)
| project ThreatName=tostring(ParsedFields.ThreatName),
WasRemediated=tobool(ParsedFields.WasRemediated),
WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected),
FileName, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine,
DeviceName, Timestamp
| limit 100
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment