mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 14:57:23 +00:00
update advanced hunting
This commit is contained in:
parent
ad08827f04
commit
7b50b55aea
@ -44,7 +44,10 @@ In the following example, we start with the table name **ProcessCreationEvents**
|
|||||||
|
|
||||||

|

|
||||||
|
|
||||||
First, we define a time filter to review only records from the previous 7 days. We then add a filter on the _FileName_ to contain only instances of powershell.exe
|
First, we define a time filter to review only records from the previous seven days.
|
||||||
|
|
||||||
|
We then add a filter on the _FileName_ to contain only instances of _powershell.exe_.
|
||||||
|
|
||||||
Afterwards, we add a filter on the _ProcessCommandLine_
|
Afterwards, we add a filter on the _ProcessCommandLine_
|
||||||
Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**.
|
Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**.
|
||||||
|
|
||||||
@ -141,4 +144,6 @@ You can refine your query based on the filter by clicking the "+" or "-" buttons
|
|||||||
The filter selections will resolve as an additional query term and the results will be updated accordingly.
|
The filter selections will resolve as an additional query term and the results will be updated accordingly.
|
||||||
|
|
||||||
## Public Advanced Hunting query GitHub repository
|
## Public Advanced Hunting query GitHub repository
|
||||||
Check out the [Advanced Hunting repository](https://github.com/Microsoft/Advanced-Hunting-Queries) - contribute and take examples of queries shared by our customers.
|
Check out the [Advanced Hunting repository](https://github.com/Microsoft/Advanced-Hunting-Queries). Contribute and use example queries shared by our customers.
|
||||||
|
|
||||||
|
|
||||||
|
Binary file not shown.
Before Width: | Height: | Size: 25 KiB After Width: | Height: | Size: 32 KiB |
Binary file not shown.
Before Width: | Height: | Size: 121 KiB After Width: | Height: | Size: 120 KiB |
Loading…
x
Reference in New Issue
Block a user