detection.wiki

Defender-DeviceTvmInfoGatheringKB

any: Information-gathering knowledge base

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
DeviceTvmInfoGatheringKB

Representative record #

{
  "Categories": [
    "network protocol",
    "communication",
    "tls"
  ],
  "Categories@odata.type": "#Collection(String)",
  "DataStructure": "One of the following values: Enabled/Disabled/DisabledByDefault",
  "Description": "Client setting for TLS version 1.0. Can be one of the following: 'Enabled', 'Disabled', 'DisabledByDefault'. See <a href=\"https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings#tls-dtls-and-ssl-protocol-version-settings\">here</a> for more details",
  "FieldName": "TlsClient10",
  "IgId": "igid-1"
}

References #