ExploitGuardControlledFolderAccess (2)

Description

Total Controlled Folder Access events.

Query · kql

// Exploit Guard Controlled Folder Access details
DeviceEvents 
| where ActionType contains "ControlledFolderAccess"
| extend JsonOut = parse_json(AdditionalFields)
| sort by Timestamp desc 
| project Timestamp, DeviceName, InitiatingProcessAccountName, ActionType,  
         FileName, FolderPath, RemoteUrl, ProcessCommandLine, InitiatingProcessCommandLine,
         JsonOut.IsAudit,JsonOut.Uri,JsonOut.RuleId,JsonOut.ActivityId
Raw source ExploitGuardControlledFolderAccess (2) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 01dacb6d-4964-42a5-b248-516fc40d605d
name: ExploitGuardControlledFolderAccess (2)
description: |
  Total Controlled Folder Access events.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  // Exploit Guard Controlled Folder Access details
  DeviceEvents 
  | where ActionType contains "ControlledFolderAccess"
  | extend JsonOut = parse_json(AdditionalFields)
  | sort by Timestamp desc 
  | project Timestamp, DeviceName, InitiatingProcessAccountName, ActionType,  
           FileName, FolderPath, RemoteUrl, ProcessCommandLine, InitiatingProcessCommandLine,
           JsonOut.IsAudit,JsonOut.Uri,JsonOut.RuleId,JsonOut.ActivityId

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.