Defender-DeviceTvmSoftwareEvidenceBeta
| ActionType | Title | Sample | Rule |
|---|---|---|---|
| any | Software evidence | Y | N |
any: Software evidence
#Fields #
| Name | Description |
|---|---|
DeviceId | |
SoftwareVendor | |
SoftwareName | |
SoftwareVersion | |
RegistryPaths | |
DiskPaths | |
LastSeenTime | |
MachineGroup |
Example Event #
{
"DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
"DiskPaths": [
"C:\\Program Files\\dotnet\\sdk\\10.0.201\\.version"
],
"DiskPaths@odata.type": "#Collection(String)",
"LastSeenTime": "2026-08-01 04:12:43",
"RegistryPaths@odata.type": "#Collection(String)",
"SoftwareName": ".net_core_sdk",
"SoftwareVendor": "microsoft",
"SoftwareVersion": "10.0.201.0"
}