Antivirus Scan Failure Detected
This rule detects instances where an antivirus scan fails on a device. It extracts the scan type, error code, and error description from the `AdditionalFields` property to provide detailed information about the failure. This could indicate issues with the antivirus software itself, a system compromise attempting to disable security controls, or a problem with the scanned files.
Microsoft Sentinel (KQL)
