Approved

over 2 years ago

This query is one you are recommended to read the full content of the post to use. It is not simply a copy and paste query, like others in the forum. It is valuable in the right situation

Process that writes on Shadow Copy space

Any idea for creating a query in order to extract a list of processes that write on Shadow copy space during a specified interval of time? Thank you

GiovanniGiovannelli

Parents

Karl_Ackerman over 3 years ago

You can modify the time setting from a hardcoded 1 day back from now us using a Begin and End date variable.

You can also narrow this down with a GROUP BY Process_Pathname so that each process is only shown once.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Comment

Karl_Ackerman over 3 years ago

You can modify the time setting from a hardcoded 1 day back from now us using a Begin and End date variable.

You can also narrow this down with a GROUP BY Process_Pathname so that each process is only shown once.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Children

No Data

Uncategorized

Anomalies

ATT&CK

Cloud Optix

Compliance

Data Lake

Device

Email

Events

Files

Live Response

Network

Other queries

Processes

Query Tips

Registry

Threat Hunting

User

Process that writes on Shadow Copy space