Dism Linux Subsystem
Query
DeviceProcessEvents
| where FileName contains "Dism.exe" or ProcessVersionInfoInternalFileName == @"dism" | where ProcessCommandLine contains "Subsystem"
Refernces:About this query
Tags:
Query:
Explanation
Sure! Here's a simple summary of the query:
This query is looking at events related to processes on devices. Specifically, it is searching for events where the process name is "Dism.exe" or the internal file name of the process is "dism". Additionally, it filters these results to only include events where the command line used to start the process contains the word "Subsystem".