Windows Defender Antivirus (Active or Passive)

Wintermute110

Use TVM data in Advanced Hunting to get that info. Windows 10 and Windows Server 2019 supported.

Example:

let avmodetable = DeviceTvmSecureConfigurationAssessment

| where ConfigurationId == "scid-2010" and isnotnull(Context)

| extend avdata=parsejson(Context)

| extend AVMode = iif(tostring(avdata[0][0]) == '0', 'Active' , iif(tostring(avdata[0][0]) == '1', 'Passive' ,iif(tostring(avdata[0][0]) == '4', 'EDR Blocked' ,'Unknown')))

| project DeviceId, AVMode;

DeviceTvmSecureConfigurationAssessment

| where ConfigurationId == "scid-2011" and isnotnull(Context)

| extend avdata=parsejson(Context)

| extend AVSigVersion = tostring(avdata[0][0])

| extend AVEngineVersion = tostring(avdata[0][1])

| extend AVSigLastUpdateTime = tostring(avdata[0][2])

| project DeviceId, DeviceName, OSPlatform, AVSigVersion, AVEngineVersion, AVSigLastUpdateTime, IsCompliant, IsApplicable

| join avmodetable on DeviceId

| project-away DeviceId1