MDE Offboarding Package Download Detected
This rule detects when an MDE offboarding package is downloaded. This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
Microsoft Sentinel (KQL)
