Device-ASROfficeChildProcessAudit.kql

//Detects when you have audit hits on the "Block all Office applications from creating child processes" ASR rule. 
//For instance if you want to audit the impact for the MSDT vulnerability - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
//Microsoft Sentinel query
DeviceEvents
| where TimeGenerated > ago (30d)
| where ActionType == "AsrOfficeChildProcessAudited"
| where AdditionalFields.IsAudit == true
| project
    TimeGenerated,
    DeviceName,
    InitiatingProcessAccountName,
    FileName,
    ProcessCommandLine,
    InitiatingProcessFileName

//Advanced Hunting query
DeviceEvents
| where Timestamp > ago (30d)
| where ActionType == "AsrOfficeChildProcessAudited"
| project
    Timestamp,
    DeviceName,
    InitiatingProcessAccountName,
    FileName,
    ProcessCommandLine,
    InitiatingProcessFileName