Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Antivirus detections (1)

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•2•0•24

Query for Microsoft Defender Antivirus detections. Query #1: Query for Antivirus detection events.

Microsoft Sentinel (KQL)

Tags

TA0002 - Execution M1049 - Antivirus/Antimalware S1084 - QUIETEXIT T1027.014 - Polymorphic Code T1588.001 - Malware T1587.001 - Malware T1608.001 - Upload Malware TA0005 - Defense Evasion T1211 - Exploitation for Defense Evasion T1622 - Debugger Evasion T1480 - Execution Guardrails T1204 - User Execution TA0042 - Resource Development TA0007 - Discovery DS0004 - Malware Repository S0343 - Exaramel for Windows T1543.003 - Windows Service T1562 - Impair Defenses TA0003 - Persistence TA0004 - Privilege Escalation Malware Detected Antivirus Detection Windows Windows Defender Avkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?