User-Driven Download of Potentially Malicious File Type

Kenji Choy@kchoy

•updated Jan 12, 2026•32•0•217

This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events, which is a high-fidelity source for this activity in Microsoft Defender for Endpoint.