detection.wiki

Defender-DeviceTvmSoftwareInventory

ActionTypeTitleSampleRule
anyInstalled software inventoryYY

any: Installed software inventory

#
Table
DeviceTvmSoftwareInventory

Fields #

NameDescription
DeviceId
DeviceName
OSPlatform
OSVersion
OSArchitecture
SoftwareVendor
SoftwareName
SoftwareVersion
EndOfSupportStatus
EndOfSupportDate
ProductCodeCpe
MachineGroup

Example Event #

{
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "OSArchitecture": "x64",
  "OSPlatform": "Windows11",
  "OSVersion": "10.0.22621.6060",
  "ProductCodeCpe": "Not Available",
  "SoftwareName": "qsetup_installation_suite",
  "SoftwareVendor": "pantaray",
  "SoftwareVersion": "203.0.113.10"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

  • Hunt for Defender for Identity not installed but eligible source: This query shows you which servers are eligible for Defender for identity but does not have the Defender for Identity agent installed. The query seach the eligible servers via Defender for Endpoint (requirement for this query to work), and is based on the server roles that MDE recongnizes.
  • Hunt MSOL Azure AD Connect / Entra Sync servers source: Microsoft announced that starting from April 30 2025, Microsoft Entra Connect will need to have the minimal version of 2.4.18.0. If you want to identitify if you still have an AD Connect or Entra Sync server with a lower version, you can use below KQL query.

References #