Malware Eng Shutdown
Query
//Accounts that shutdown the Microsoft antimalware engine
search in (SecurityEvent) EventID == 4689 and "MsMpEng.exe"
| summarize TerminationCount = count() by AccountExplanation
This query searches for security events with Event ID 4689 that involve the shutdown of the Microsoft antimalware engine (MsMpEng.exe). It then summarizes the number of times this has occurred for each user account.