detection.wiki

Defender-DeviceTvmSoftwareInventory

any: Installed software inventory

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
DeviceTvmSoftwareInventory

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

NameRulesVendors
SoftwareName2 detection rulesKusto
SoftwareVendor1 detection ruleKusto

Representative record #

{
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "OSArchitecture": "x64",
  "OSPlatform": "Windows11",
  "OSVersion": "10.0.22621.6060",
  "ProductCodeCpe": "Not Available",
  "SoftwareName": "qsetup_installation_suite",
  "SoftwareVendor": "pantaray",
  "SoftwareVersion": "203.0.113.10"
}

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

  • Hunt for Defender for Identity not installed but eligible source: This query shows you which servers are eligible for Defender for identity but does not have the Defender for Identity agent installed. The query seach the eligible servers via Defender for Endpoint (requirement for this query to work), and is based on the server roles that MDE recongnizes.
  • Hunt MSOL Azure AD Connect / Entra Sync servers source: Microsoft announced that starting from April 30 2025, Microsoft Entra Connect will need to have the minimal version of 2.4.18.0. If you want to identitify if you still have an AD Connect or Entra Sync server with a lower version, you can use below KQL query.

References #