ShadowAI Defense GitHub
← All detections
DET-MS-MDE-003 Defender for Endpoint Endpoint KQL Severity: Medium

Defender for Endpoint — AI desktop app installation detection

Detects the installation of AI desktop applications on managed endpoints by monitoring Windows Installer events, MSI/EXE executions, and application registration in Add/Remove Programs.

Rule

// Detect installation of AI desktop applications on managed endpoints
// Monitors installer processes, setup executables, and app registration events
let aiInstallerPatterns = dynamic([
    'ChatGPTSetup', 'Claude-Setup', 'Claude_Setup', 'ClaudeSetup',
    'CursorSetup', 'Cursor-Setup', 'cursor-setup',
    'OtterSetup', 'Grammarly', 'GrammarlySetup',
    'CopilotSetup', 'GitHub.Copilot',
    'TabnineSetup', 'Codeium', 'CodeiumSetup',
    'Pieces', 'PiecesSetup', 'WindsurfSetup'
]);
let aiAppNames = dynamic([
    'ChatGPT', 'Claude', 'Cursor', 'Otter', 'Grammarly Desktop',
    'GitHub Copilot', 'Tabnine', 'Codeium', 'Pieces', 'Windsurf'
]);
// Track 1: Installer/setup process execution
let installerEvents = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has_any (aiInstallerPatterns)
    or ProcessCommandLine has_any (aiInstallerPatterns)
| project Timestamp, DeviceName, AccountUpn = InitiatingProcessAccountUpn,
          DetectionMethod = 'Installer Execution',
          Detail = strcat(FileName, ' | ', ProcessCommandLine);
// Track 2: Registry-based installation detection (Add/Remove Programs)
let registryEvents = DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == 'RegistryValueSet'
| where RegistryKey has 'Uninstall'
| where RegistryValueName == 'DisplayName'
| where RegistryValueData has_any (aiAppNames)
| project Timestamp, DeviceName, AccountUpn = InitiatingProcessAccountUpn,
          DetectionMethod = 'Registry Installation',
          Detail = strcat(RegistryKey, ' | ', RegistryValueData);
union installerEvents, registryEvents
| summarize InstallEvents = count(), Methods = make_set(DetectionMethod),
            FirstSeen = min(Timestamp), Details = make_set(Detail, 5)
          by AccountUpn, DeviceName
| project-reorder AccountUpn, DeviceName, InstallEvents, Methods, FirstSeen, Details

How it works

Uses a two-track detection approach: (1) monitors process execution events for known AI application installer names and setup executables, and (2) monitors Windows registry writes to the Uninstall key, which captures the moment an application registers itself in Add/Remove Programs. The dual approach catches both standard MSI/EXE installations and silent/scripted deployments. This detection runs over a 7-day window to catch installations that may have occurred during weekend or off-hours maintenance. Unlike DET-MS-MDE-002 (which detects runtime execution), this rule specifically targets the installation event, enabling earlier intervention.

Required data sources

  • Defender for Endpoint (DeviceProcessEvents)
  • Defender for Endpoint (DeviceRegistryEvents)

Prerequisites

  • Microsoft 365 E5 or Defender for Endpoint P2
  • Sentinel workspace with M365D connector
  • DeviceRegistryEvents table populated (requires advanced hunting data collection)
  • Note: preventive control via Intune AppLocker/WDAC is preferred; this is the detective fallback

Expected volume

Low — 2-15 installation events per week in a typical 10k-seat org. Spikes may occur after a popular AI tool release or viral social media coverage.

False-positive guidance

IT-deployed sanctioned AI tools will trigger this rule during authorized deployments. Coordinate with IT deployment schedules or exclude SCCM/Intune service accounts from the query. Some AI tools auto-update via background installers that may re-trigger the detection.

Tuning steps

  1. Update aiInstallerPatterns and aiAppNames lists as new AI desktop clients are released.
  2. Exclude IT deployment service accounts (SCCM, Intune) from installer execution tracking.
  3. Add auto-update exclusions for sanctioned AI tools that trigger registry events on update.
  4. Pair with Intune application control policies for preventive enforcement.
  5. Correlate with DET-MS-MDE-002 to build a timeline: installation -> first execution -> sustained use.

Framework mappings

  • NIST AI RMF: GOVERN-4.1, MEASURE-2.7
  • ISO/IEC 42001: 8.2
  • NIST CSF: DE.CM-7, PR.IP-1

Related AI Controls Catalog entries