ExploitGuardControlledFolderAccess (1)

Description

Total Controlled Folder Access events.

Query · kql

// Controlled Folder Access events across devices
DeviceEvents
 | where ActionType startswith "ControlledFolderAccess" 
 | summarize AsrDetections=count() by DeviceName
 | order by AsrDetections desc
Raw source ExploitGuardControlledFolderAccess (1) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ce33163e-68ba-470e-8641-ed61d43d38e1
name: ExploitGuardControlledFolderAccess (1)
description: |
  Total Controlled Folder Access events.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |2-
   // Controlled Folder Access events across devices
  DeviceEvents
   | where ActionType startswith "ControlledFolderAccess" 
   | summarize AsrDetections=count() by DeviceName
   | order by AsrDetections desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.