Anomalous Device Models

Description

This query finds anomalous models discovered

Query · kql

// 
let AnomalousModelCount = 5;
DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| summarize ModelAppearanceCount=dcount(DeviceId) by Model
| where ModelAppearanceCount < AnomalousModelCount
Raw source Anomalous Device Models · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9ec67c0b-e319-4f1c-bbea-67119d03740a
name: Anomalous Device Models
description: |
  This query finds anomalous models discovered
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics: []
relevantTechniques: []
query: |
  // 
  let AnomalousModelCount = 5;
  DeviceInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | summarize ModelAppearanceCount=dcount(DeviceId) by Model
  | where ModelAppearanceCount < AnomalousModelCount

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.