Msbuild
Query
DeviceProcessEvents
| where ProcessVersionInfoInternalFileName contains "msbuild.exe"
| where InitiatingProcessFileName != @"devenv.exe" and InitiatingProcessVersionInfoInternalFileName != "MSBuild.exe"
References:About this query
Tags: Query:
Explanation
The query is searching for DeviceProcessEvents where the ProcessVersionInfoInternalFileName contains "msbuild.exe". It then filters out any results where the InitiatingProcessFileName is not "devenv.exe" and the InitiatingProcessVersionInfoInternalFileName is not "MSBuild.exe".