Recurring Antivirus Detections (Excluding Browser Caches)
This rule identifies recurring antivirus detections on endpoints, specifically filtering out common false positives originating from browser cache directories. It aggregates detections by device, threat name, and device ID, and flags instances where the same threat has been detected on at least two distinct days within a 30-day lookback period. This helps to highlight persistent malware issues rather than transient or benign detections.
Microsoft Sentinel (KQL)
