https://github.com/reprise99/Sentinel-Queries/blob/3102a56d0f081441a0b73c906ceed227fa93701b/Defender%20for%20Endpoint/Device-DetectEncodedPowershellandDecode.kql
Sentinel-Queries/Defender for Endpoint/Device-DetectEncodedPowershellandDecode.kql at...
Collection of KQL queries. Contribute to reprise99/Sentinel-Queries development by creating an account on GitHub.
defender for endpointsentinelqueriesdevicekql