Crashing Applications
This query identifies crashing processes based on parameters passed to werfault.exe and attempts to find the associated process launch from DeviceProcessEvents.
Microsoft Sentinel (KQL)

This query identifies crashing processes based on parameters passed to werfault.exe and attempts to find the associated process launch from DeviceProcessEvents.

Already have an account?