Elevate your telemetry using custom data collection in Microsoft Defender

Good initiative creating this post.

I have some suggestions as constructive tips for it:

1) The AH KQL codes should be a text, so us, Defenders, can copy and test, instead of typing while looking for each image

2) The last search is a bit useless as it finds too many things even in small firms.

3) Also, the last search schema does not exist. DeviceCustomProcessEvents should be replaced by DeviceProcessEvents

4) You suggested a custom detection rule but you didn't suggest which AH KQL code above should be the base for the detection

5) Your rule 4 (full process and script telemetry) has a condition "broad" but you could suggest how to make it broad

best

Rafael Martin