Defender for Endpoint - WDAC
MDE WDAC
Query
DeviceEvents
ActionType startswith "AppControl"
| summarize Machines=dcount(DeviceName) by ActionType
| order by Machines descAbout this query
Explanation
This query looks at Windows Defender Application Control events generated by devices monitored by Microsoft Defender for Endpoint. It summarizes the number of machines by the type of action taken and orders them by the most machines. Additionally, it retrieves and parses Microsoft recommended driver block rules from an external source to analyze and display relevant information.
Details
Alex Verboon
Released: June 24, 2024
Tables
DeviceEvents
Keywords
WindowsDefenderEndpointApplicationControlEventsDevicesMonitoredActionTypeMachinesDeviceNameActionMicrosoftDriverBlockRulesDenyID_DENYFriendlyNameHash
Operators
startswithsummarizedcountbyorder byletexternaldatawithformatignoreFirstRecordwhereextendparse_xmlparse-kvproject