Share via

KQL for Team viewer/Anydesk

karthik palani 1,036 Reputation points
2022-11-17T09:30:34.907+00:00

Hi All,

Need your support in providing or suggesting or reference best custom KQL for Teamviewer & Anydesk for custom detection rule creation in Defender for Endpoint services. Since I am not an expert, kindly provide best available query as per your expertise.

Thanks

Microsoft Security | Microsoft Sentinel

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Matt Smith 26 Reputation points
    2022-11-17T12:52:33.087+00:00

    What's your goal for the detection rule? You can retrieve the process activity for TeamViewer using the simple query below but you'll need to be specific in what you're looking for to build a detection rule.

    DeviceProcessEvents
    | where InitiatingProcessVersionInfoProductName == "TeamViewer"

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.