Skip to main content

New process execution by device

Summarise process launches to baseline what runs where.

Beginner
Use case

Understand normal process activity before hunting for anomalies.

Query
KQL Defender XDR 
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| summarize Count = count() by DeviceName, FileName
| sort by Count desc

Required tables: DeviceProcessEvents

Parameters to change
ParameterMeaningExample
ago(24h)Lookback periodago(30d)
Expected output

Process names ranked by launch count per device.

Investigation notes

Rare process names on a single device are worth a closer look.

False positive considerations

Software updates create bursts of new process names.

Works with
Defender XDR
Required tables
  • DeviceProcessEvents
ATT&CK tactic

Execution

Endpoint