KQL Search

Query Details

Cert Req

Query

DeviceProcessEvents
          | where (FileName contains "CertReq.exe" or ProcessVersionInfoInternalFileName contains "CertReq.exe") and ProcessCommandLine contains "Post"
References:

About this query

Tags:

Query:

Explanation

This KQL (Kusto Query Language) query is searching through DeviceProcessEvents for events where:

  1. The FileName or ProcessVersionInfoInternalFileName contains "CertReq.exe".
  2. The ProcessCommandLine contains the word "Post".

In simple terms, it looks for any process events involving the "CertReq.exe" file that also have "Post" in their command line.