Microsoft Defender for Endpoint - Offboarding
MDE Offboarding
Query
// MDE Offboarding script executed
DeviceProcessEvents
| where ProcessCommandLine contains @"MicrosoftDefenderATPOffboarding"About this query
Microsoft Defender for Endpoint - Offboarding
Query Information
Description
Use the below queries to identify devices where the MDE offboarding file is saved or executed
References
Defender 365
// MDE offboarding script detected on endpoint
DeviceFileEvents
| where FileName contains @"MicrosoftDefenderATPOffboarding"
Explanation
This query is used to identify devices where the Microsoft Defender for Endpoint (MDE) offboarding file is saved or executed. It consists of two separate queries: one that looks for the MDE offboarding script being executed in the device's process events, and another that looks for the MDE offboarding script being detected in the device's file events.
Details
Alex Verboon
Released: June 4, 2023
Tables
DeviceProcessEventsDeviceFileEvents
Keywords
DevicesIntune
Operators
|wherecontains