Msbuild
Query
DeviceProcessEvents
| where ProcessVersionInfoInternalFileName contains "msbuild.exe"
| where InitiatingProcessFileName != @"devenv.exe" and InitiatingProcessVersionInfoInternalFileName != "MSBuild.exe"
References:About this query
Tags: Query:
Explanation
The query is searching for DeviceProcessEvents where the ProcessVersionInfoInternalFileName contains "msbuild.exe". It then filters out any results where the InitiatingProcessFileName is not "devenv.exe" and the InitiatingProcessVersionInfoInternalFileName is not "MSBuild.exe".
Details
Ali Hussein
Released: September 14, 2023
Tables
DeviceProcessEvents
Keywords
DeviceProcessEventsProcessVersionInfoInternalFileNamemsbuild.exeInitiatingProcessFileNameInitiatingProcessVersionInfoInternalFileNamedevenv.exe
Operators
|wherecontains!=and