SmartScreen app block ignored by user
Query for SmartScreen application blocks on files with "Malicious" reputation, where the user has decided to run the malware nontheless. Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview. Data availability: These events are available only on Windows 10 version 1703 and onwards. Tags: #SmartScreen.
Microsoft Sentinel (KQL)
