Update README.md

README.md

@@ -128,5 +128,21 @@ Message="The Print Spooler service terminated unexpectedly"))
 - https://twitter.com/NathanMcNulty/status/1410289115354914820
 
 ## KQL Query for Sentinel / MDE via Olaf Hartong
+```
+let serverlist=DeviceInfo
+| where DeviceType != "Workstation"
+| distinct DeviceId;
+let suspiciousdrivers=DeviceImageLoadEvents
+| where DeviceId in (serverlist)
+| where FolderPath startswith @"c:\windows\system32\spool\drivers"
+| distinct SHA1
+| invoke FileProfile(SHA1, 1000) 
+| where GlobalPrevalence < 50 and IsRootSignerMicrosoft != 1 and SignatureState != "SignedValid";
+suspiciousdrivers
+| join kind=inner (DeviceImageLoadEvents
+| where DeviceId in (serverlist)
+| where FolderPath startswith @"c:\windows\system32\spool\drivers") on SHA1
+| where InitiatingProcessFileName != "ccmexec.exe"
+```
 
-https://twitter.com/olafhartong/status/1410229699993874442
+Source: https://twitter.com/olafhartong/status/1410229699993874442