Microsoft Defender KQL query for deletion lnk files - Following Friday 13th Event

MikeP751860 

I had the same issue as you. The KQL query provided by Microsoft did not return all the deleted .lnk files. In the timeline of our devices I found entries with the ActionType "BrowserLaunchedToOpenUrl" and the additional information "T1204.002: Malicious File". Based on that I built the following query:

DeviceEvents
| where Timestamp >= datetime(2023-01-13) and Timestamp < datetime(2023-01-14)
| where ActionType contains "BrowserLaunchedToOpenUrl"
| where RemoteUrl endswith ".lnk"
| summarize by Timestamp, DeviceName, DeviceId, RemoteUrl,ActionType
| sort by Timestamp asc

The RemoteURL shows the deleted .lnk file. 

From there you can further filter for the start menu folder:

DeviceEvents
| where Timestamp >= datetime(2023-01-13) and Timestamp < datetime(2023-01-14)
| where ActionType contains "BrowserLaunchedToOpenUrl"
| where RemoteUrl endswith ".lnk"
| where RemoteUrl contains "start menu"
| summarize by Timestamp, DeviceName, DeviceId, RemoteUrl,ActionType
| sort by Timestamp asc

Let me know if this helps!