Microsoft Workflow Compiler
Query
DeviceProcessEvents
| where ProcessVersionInfoInternalFileName == @"Microsoft.Workflow.Compiler.exe"
References:About this query
Tags: Query:
Explanation
The query is searching for DeviceProcessEvents where the ProcessVersionInfoInternalFileName is equal to "Microsoft.Workflow.Compiler.exe".
Details
Ali Hussein
Released: September 19, 2023
Tables
DeviceProcessEvents
Keywords
DeviceProcessEventsProcessVersionInfoInternalFileNameMicrosoft.Workflow.Compiler.exe
Operators
|where==@