Defender for Endpoint application control events

AppControl.kql

// Defender for Endpoint query
DeviceEvents
| where Timestamp > ago(1d)
    and ActionType startswith "AppControlExecutableAudited"
| where AccountName !has "system"
    and AccountName !has "local service"
    and AccountName !has "network service"
    and AccountName !has "dwm-1"
| where FolderPath startswith "%OSDRIVE%"
//| order by Timestamp desc

// DeviceProcessEvents with additional executable details
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FolderPath startswith "C:\\Users"
    or FolderPath startswith "C:\\ProgramData"
| where AccountName !has "system"
    and AccountName !has "local service"
    and AccountName !has "network service"
    and AccountName !has "dwm-1"
| project Timestamp, DeviceName, AccountUpn, FileName, FolderPath, SHA256, ProcessVersionInfoCompanyName, ProcessVersionInfoProductName, ProcessVersionInfoProductVersion, ProcessVersionInfoInternalFileName, ProcessVersionInfoOriginalFileName, ProcessVersionInfoFileDescription
| limit 1000