Find Software By Name and Version

Description

This query finds a software by name and/or version

Query · kql

//
let SearchSoftwareName = "chrome";
let SoftwareKnownVersion = "10";
DeviceTvmSoftwareInventory
// to surface software that the version is not discovered for, remove SoftwareVersion filtering
| where SoftwareName == SearchSoftwareName
| where SoftwareVersion startswith SoftwareKnownVersion
Raw source Find Software By Name and Version · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 929d1046-11a9-40c1-977e-bd1984b30c31
name: Find Software By Name and Version
description: |
  This query finds a software by name and/or version
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceTvmSoftwareInventory
tactics:
- Initial Access
- Execution
relevantTechniques:
- Exploitation for Client Execution
query: |
  //
  let SearchSoftwareName = "chrome";
  let SoftwareKnownVersion = "10";
  DeviceTvmSoftwareInventory
  // to surface software that the version is not discovered for, remove SoftwareVersion filtering
  | where SoftwareName == SearchSoftwareName
  | where SoftwareVersion startswith SoftwareKnownVersion

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.