Antivirus detections (1)

id: 05250700-5123-45be-826d-dd14c623fade
name: Antivirus detections (1)
description: |
  Query for Microsoft Defender Antivirus detections.
  Query #1: Query for Antivirus detection events.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
query: |
  // Query #2:
  //    This query select only machines where more than 1 malware family was detected.
  //    Such behavior is usually indicative that some malware was active on the machine
  // Implementation details:
  //    This query looks for alerts on Windows Defender Antivirus detections.
  //    For most purposes it is probably better to query on the events themselves (see query #1).
  //    However, this query might still be useful sometimes (e.g. to quickly parse the family name).
  AlertInfo | join AlertEvidence on AlertId
  | where Title contains "Defender AV detected"
  | parse Title with *"'"FamilyName"'"*
  | summarize FamilyCount=dcount(FamilyName), Families=makeset(FamilyName), Titles=makeset(Title) by DeviceName, DeviceId, bin(Timestamp, 1d)
  | where FamilyCount > 1
  | limit 100