ExploitGuardControlledFolderAccess

Description

Total Controlled Folder Access events.

Query · kql

DeviceEvents
 | where ActionType  startswith "ControlledFolderAccess" 
 | summarize NumberOfEvents=count() by ActionType
 | sort by NumberOfEvents desc
Raw source ExploitGuardControlledFolderAccess · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c4e021bc-59f8-4464-9f93-3b08d8b28cc3
name: ExploitGuardControlledFolderAccess
description: |
  Total Controlled Folder Access events.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents
   | where ActionType  startswith "ControlledFolderAccess" 
   | summarize NumberOfEvents=count() by ActionType
   | sort by NumberOfEvents desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.