ExploitGuardNetworkProtectionEvents

Description

Simple query to show the unique network connections that were audited or blocked by ExploitGuard. For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.

Query · kql

DeviceEvents
| where Timestamp > ago(7d)
| where  ActionType  =~ "ExploitGuardNetworkProtectionBlocked"
| summarize count_RemoteUrl = count() by InitiatingProcessFileName, RemoteUrl, Audit_Only=tostring(parse_json(AdditionalFields).IsAudit)
| sort by count_RemoteUrl desc
Raw source ExploitGuardNetworkProtectionEvents · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 47bf14f0-c6b7-4dd3-a13f-b9a3e7972e2f
name: ExploitGuardNetworkProtectionEvents
description: |
  Simple query to show the unique network connections that were audited or blocked by ExploitGuard.
  For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents
  | where Timestamp > ago(7d)
  | where  ActionType  =~ "ExploitGuardNetworkProtectionBlocked"
  | summarize count_RemoteUrl = count() by InitiatingProcessFileName, RemoteUrl, Audit_Only=tostring(parse_json(AdditionalFields).IsAudit)
  | sort by count_RemoteUrl desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.