Forum Discussion
Microsoft Defender KQL query for deletion lnk files - Following Friday 13th Event
Hi, Following the Friday 13th event with Defender ASR block and removing of shortcut links. Has anyone been able to use the Defender Timeline information on assets to report on the shortcut links...
yongrheemsft Tried the AH query but the returned data records is too small.
When you exclude '| where AvSignatureVersion in (badsignatures)' from the query and in my case see most of the machines have an AV signature version of 1.381.2325.0.
yongrheemsft
Microsoft
MicrosoftThat is good, that version doesn't have the problem. The query is checking for machines in the last 30 days that had the problematic version and lists the shortcuts. Thx.