detection.wiki

Defender-DeviceTvmSoftwareInventory

ActionTypeTitleSampleRule
anyInstalled software inventoryYY

any: Installed software inventory

#
Table
DeviceTvmSoftwareInventory

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
SoftwareName2 detection rulesKusto
SoftwareVendor1 detection ruleKusto

Example Event #

{
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "OSArchitecture": "x64",
  "OSPlatform": "Windows11",
  "OSVersion": "10.0.22621.6060",
  "ProductCodeCpe": "Not Available",
  "SoftwareName": "qsetup_installation_suite",
  "SoftwareVendor": "pantaray",
  "SoftwareVersion": "203.0.113.10"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

  • Hunt for Defender for Identity not installed but eligible source: This query shows you which servers are eligible for Defender for identity but does not have the Defender for Identity agent installed. The query seach the eligible servers via Defender for Endpoint (requirement for this query to work), and is based on the server roles that MDE recongnizes.
  • Hunt MSOL Azure AD Connect / Entra Sync servers source: Microsoft announced that starting from April 30 2025, Microsoft Entra Connect will need to have the minimal version of 2.4.18.0. If you want to identitify if you still have an AD Connect or Entra Sync server with a lower version, you can use below KQL query.

References #