detection.wiki

Defender-DeviceTvmSoftwareEvidenceBeta

any: Software evidence

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
DeviceTvmSoftwareEvidenceBeta

Representative record #

{
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DiskPaths": [
    "C:\\Program Files\\dotnet\\sdk\\10.0.201\\.version"
  ],
  "DiskPaths@odata.type": "#Collection(String)",
  "LastSeenTime": "2026-08-01 04:12:43",
  "RegistryPaths@odata.type": "#Collection(String)",
  "SoftwareName": ".net_core_sdk",
  "SoftwareVendor": "microsoft",
  "SoftwareVersion": "10.0.201.0"
}

References #