KQL Search

Query Details

Options: Draft | InProgress | Stable | Deprecated

MDE Onboarding Offboarding Package Downloads

Query

let Lookback = 30d;
let PackageOperations = dynamic([
    "DownloadOnboardingPkg",
    "DownloadOffboardingPkg"
]);
CloudAppEvents
| where Timestamp > ago(Lookback)
| where ActionType in (PackageOperations)
    or RawEventData has_any (PackageOperations)
| extend Info = parse_json(RawEventData)
| extend
    Operation = case(
        ActionType == "DownloadOnboardingPkg", "Onboarding",
        ActionType == "DownloadOffboardingPkg", "Offboarding",
        tostring(RawEventData) contains "DownloadOnboardingPkg", "Onboarding",
        tostring(RawEventData) contains "DownloadOffboardingPkg", "Offboarding",
        "Unknown"
    ),
    DeploymentMethod = tostring(Info.DeploymentMethod),
    OsFamily = tostring(Info.OsFamily)
| project
    Timestamp,
    Operation,
    AccountDisplayName,
    AccountObjectId,
    IPAddress,
    DeploymentMethod,
    OsFamily,
    ActionType,
    RawEventData
| order by Timestamp desc

About this query

Explanation

This query is designed to audit the download events of onboarding and offboarding packages for Microsoft Defender for Endpoint. It looks at data from the past 30 days in the CloudAppEvents table. The query identifies whether the event was related to downloading an onboarding or offboarding package by checking specific operation types or raw event data. It then extracts and displays details such as the operation type (onboarding or offboarding), the account involved, IP address, deployment method, operating system family, and raw event data. The results are sorted by the timestamp of the events, with the most recent events appearing first.

The query is useful for identifying unexpected offboarding package downloads, which could be a security concern since running such a package can stop a device from reporting security data to Defender for Endpoint. However, the query only detects downloads and does not confirm whether the package was actually executed or if a device was offboarded.