Follina
Query
DeviceProcessEvents
| where ProcessCommandLine contains "msdt.exe"
| where InitiatingProcessFileName has_any (@"WINWORD.EXE", @"EXCEL.EXE", @"OUTLOOK.EXE")Explanation
This query is looking for events related to a specific process called "msdt.exe". It then filters those events to only include cases where the initiating process is either "WINWORD.EXE", "EXCEL.EXE", or "OUTLOOK.EXE".
Details
C.J. May
Released: June 30, 2022
Tables
DeviceProcessEvents
Keywords
DeviceProcessEventsProcessCommandLinemsdt.exeInitiatingProcessFileNameWINWORD.EXEEXCEL.EXEOUTLOOK.EXE
Operators
|wherecontains"msdt.exe"has_any(@"WINWORD.EXE"@"EXCEL.EXE"@"OUTLOOK.EXE")