Query File paths field from Microsoft Defender

Question

I am looking for documentation on how to build a Advanced Hunting query in Microsoft Defender for Endpoint where I can use the "File paths" in the KQL query.

The field is in the Software Inventory under devices and in the section Software Evidence See below screen dump:

enter image description here

Answer 1

You are looking for one of the pages under the Data Tables schema.

My first guess would have been DeviceTvmSoftwareInventory, however that does not seem to include the path.

There are other tables which contain path: DeviceFileEvents and DeviceImageLoadEvents could be the ones you are looking for, depending on the use case you are trying. The following queries could be a good start.

DeviceFileEvents
| where FolderPath contains "part\\of\\your\\path\\comes\\here"

or

DeviceImageLoadEvents
| where FolderPath == "your\\full\\path\\comes\\here"

If you have the full path of every software you are looking for, you can also use FolderPath == the escaped(double \\ in the path).