Castaldio86

emet_agent.exe
emet_service.exe
firesvc.exe
firetray.exe
hipsvc.exe
mfevtps.exe
mcafeefire.exe
scan32.exe
shstat.exe
tbmon.exe

Castaldio86

let DC = DeviceNetworkEvents
| where LocalPort == "88"
| distinct DeviceId
| extend Type = "DomainController"
;
let SVR = DeviceInfo
| where OSPlatform in ("WindowsServer2008R2","WindowsServer2019","WindowsServer2016","WindowsServer2012R2") and RegistryDeviceTag !contains "Domain Controllers"
| distinct DeviceId
| extend Type = "Server"
;