Curly Comrades — Detect Enable + Disable Hyper-V Events
This query looks for DISM enable & disable events on the same device within a 15-minute window.
Microsoft Sentinel (KQL)

This query looks for DISM enable & disable events on the same device within a 15-minute window.

Already have an account?