Microsoft Workflow Compiler
Query
DeviceProcessEvents
| where ProcessVersionInfoInternalFileName == @"Microsoft.Workflow.Compiler.exe"
References:About this query
Tags: Query:
Explanation
The query is searching for DeviceProcessEvents where the ProcessVersionInfoInternalFileName is equal to "Microsoft.Workflow.Compiler.exe".