Microsoft Defender for Endpoint - Malware Detected

This alert will trigger when Malware is detected by Microsoft Defender for Endpoint.

Microsoft Defender for Endpoint HIGH EXECUTION

Details

ID	`6af7a4d0-498c-4d89-804c-655dd14c37ab`
From Version	6.10.0
Execution Mode	SCHEDULED
Crontab	`/10 * * *`
Search Window	10 minutes
Dataset	alerts

XQL Query

datamodel dataset = microsoft_365_defender_raw 
|filter (xdm.alert.category = "Malware") and xdm.target.file.sha256 != null
|fields 
    xdm.event.id,
    xdm.alert.original_alert_id,
    xdm.alert.severity,
    xdm.alert.subcategory,
    xdm.alert.name,
    xdm.alert.description,
    xdm.target.host.device_id,
    xdm.target.host.fqdn,
    xdm.alert.mitre_techniques,
    xdm.target.file.sha256,
    xdm.target.file.filename,
    xdm.target.file.path,
    xdm.target.process.pid,
    xdm.target.process.command_line,
    xdm.target.process.parent_id,
    xdm.target.host.ipv4_addresses,
    xdm.target.registry.key,
    xdm.target.registry.value_type,
    xdm.target.registry.value,
    xdm.source.user.username,
    xdm.source.user.domain,
    xdm.source.user.identifier,
    xdm.target.ipv4,
    xdm.event.outcome