Can Defender for Endppoint alert on the download of any executable from the Internet?

[Solu]

Looking to if this is even possible from Defender for Endpoint alert on the download of any executable from the Internet?

Thanks in advance

[#2]

@Solu 

1. DeviceFileEvents Table

DeviceFileEvents table in the advanced hunting schema | Microsoft Learn

2. Create Custom Alert

example query

DeviceFileEvents  

| where  ingestion_time() > ago(7d)

| where ActionType == "FileCreated"

->

https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-w...