Forum Discussion
Solved
AmsiScriptContent not under DeviceEvents table? MITRE Eval 2022
I was going through the MITRE eval results for 2022. One of the queries for script executions is documented as a DeviceEvent table search for ActionType "AmsiScriptContent". Looks like a very use...
- Scratch that. The ActionType is now just 'ScriptContent'
Scratch that. The ActionType is now just 'ScriptContent'
Under which table? DeviceEvents? Update: You nailed it. It is indeed changed to ScriptContent ActionType under DeviceEvents Table.
It is not documented in the schema though... 