DET-MS-MDE-002 Defender for Endpoint Endpoint KQL Severity: Low
Local AI tool process execution
Detects execution of locally-installed AI clients (desktop apps for consumer LLMs) on managed endpoints.
Rule
// Locally installed AI clients executing on endpoints
let aiProcesses = dynamic(['ChatGPT.exe', 'Claude.exe', 'Copilot.exe', 'Cursor.exe', 'Otter.exe', 'Grammarly.exe', 'ChatGPT.app', 'Claude.app']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in (aiProcesses)
| summarize InvocationCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by FileName, AccountUpn = InitiatingProcessAccountUpn, DeviceName// Locally installed AI clients executing on endpoints
let aiProcesses = dynamic(['ChatGPT.exe', 'Claude.exe', 'Copilot.exe', 'Cursor.exe', 'Otter.exe', 'Grammarly.exe', 'ChatGPT.app', 'Claude.app']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in (aiProcesses)
| summarize InvocationCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by FileName, AccountUpn = InitiatingProcessAccountUpn, DeviceName How it works
Surfaces installation and use of consumer AI desktop apps. Use as a triage trigger; combine with DET-MS-PV-001 results to assess actual data egress risk.
Required data sources
- Defender for Endpoint (DeviceProcessEvents)
Prerequisites
- Defender for Endpoint P2 or M365 E5
Expected volume
Variable. Heavier in engineering-heavy orgs.
False-positive guidance
Allow-list users in approved enterprise pilots.
Tuning steps
- Maintain aiProcesses list as new desktop clients ship.
- Add Intune app-deployment policy alongside detection.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7
- ISO/IEC 42001: 8.2
- NIST CSF: DE.CM-7