table

DeviceProcessEvents

DeviceProcessEvents contains process creation and related endpoint process activity available for advanced hunting.

tablesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproduct Microsoft Defender for Endpoint P2
Required licenselicense Microsoft Graph Security API
API accessapi Microsoft Defender for Endpoint APIs
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi DeviceEvents
Related tabletable DeviceFileEvents
Related tabletable DeviceNetworkEvents
Related tabletable DeviceRegistryEvents
Related tabletable DeviceImageLoadEvents
Related tabletable

Schema

Field	Type	Description
`Timestamp`	datetime	Date and time when the event was recorded.
`DeviceId`	string	Unique identifier for the device in the service.
`DeviceName`	string	Fully qualified domain name of the device.
`ActionType`	string	Type of activity that triggered the event.
`FileName`	string	Name of the file that the recorded action was applied to.
`ProcessCommandLine`	string	Command line used to create the new process.
`InitiatingProcessAccountSid`	string	Security identifier of the account context that initiated the process.

Sample KQL

Suspicious PowerShell process creation

Find recent PowerShell executions with command-line indicators commonly used during hands-on-keyboard activity.

kql

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "EncodedCommand", "Invoke-WebRequest", "DownloadString")
| project Timestamp, DeviceName, InitiatingProcessAccountSid, FileName, ProcessCommandLine
| order by Timestamp desc

Related KQL

Review suspicious PowerShell process launches

Find PowerShell process executions with common download, encoded-command, hidden-window, or bypass indicators.

detection candidate

intermediateendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceProcessEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let suspiciousTerms = dynamic(["-enc", "encodedcommand", "downloadstring", "invoke-webrequest", "iex", "-w hidden", "bypass"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousTerms)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountUpn, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from endpoint and ransomware hunting themes with common PowerShell indicators.