Roman Phillips
@cyberOpticsCompletionist
0 followers0 downloads7 copies0 likes790 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
Products / Services
1
EXE Search
KQL
Gives you a report from a specific date and onwards of a certain file name that was used within the tenant. (Replace "Outlook.exe" with the file name you are looking for, and replace date to desired range)
Notes: LocalIP ≠ RemoteIP = Outbound connection
Notes: LocalIP ≠ RemoteIP = Outbound connection
