Defender-AlertEvidence

{
  "AdditionalFields": {
    "DnsDomain": "ludus.domain",
    "HostName": "jd-win11-22h2-1",
    "NetBiosName": "jd-win11-22h2-1.ludus.domain",
    "OSFamily": "Windows",
    "OSVersion": "10.0",
    "IsDomainJoined": true,
    "IpInterfaces": [
      {
        "$id": "2",
        "Address": "10.2.10.21",
        "Type": "ip"
      },
      {
        "$id": "3",
        "Address": "127.0.0.1",
        "Type": "ip"
      },
      {
        "$id": "4",
        "Address": "::1",
        "Type": "ip"
      }
    ],
    "RemediationProviders": [
      {
        "RemediationState": "Active",
        "RemediationDate": "2026-08-01T09:23:27.0361808Z",
        "Type": "remediation-provider"
      }
    ],
    "LastRemediationState": "Active",
    "ThreatAnalysisSummary": [
      {
        "AnalyzersResult": [],
        "Verdict": "Suspicious",
        "AnalysisDate": "2026-08-01T09:23:27.0361808Z"
      }
    ],
    "LastVerdict": "Suspicious",
    "Asset": true,
    "DetailedRoles": [
      "PrimaryDevice"
    ],
    "RbacScopes": {
      "ScopesPerType": {
        "MachineGroupIds": {
          "Mode": "Any",
          "Scopes": [
            "223"
          ]
        },
        "Workloads": {
          "Mode": "All",
          "Scopes": [
            "Mdatp"
          ]
        }
      }
    },
    "Type": "host",
    "LeadingHost": true,
    "Role": 0,
    "MachineId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
    "MachineIdType": 3,
    "HostMachineId": null,
    "DetectionStatus": "Detected",
    "SuspicionLevel": "Suspicious",
    "EnrichmentType": "MachineIpInterfacesEnrichment",
    "IsIoc": false,
    "MergeByKey": "7i1RmyvZqPH7gS+N2PpTwV+Sz64=",
    "MergeByKeyHex": "EE2D519B2BD9A8F1FB812F8DD8FA53C15F92CFAE"
  },
  "AlertId": "da90e6fe47-4ecb-4cfd-abd5-826bc671bae6_1",
  "AttackTechniques": [
    "Masquerading (T1036)",
    "Masquerade Task or Service (T1036.004)",
    "Windows Service (T1543.003)",
    "Service Execution (T1569.002)",
    "Services Registry Permissions Weakness (T1574.011)"
  ],
  "Categories": [
    "Persistence"
  ],
  "DetectionSource": "EDR",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "EntityType": "Machine",
  "EvidenceRole": "Impacted",
  "LocalIP": "10.2.10.21",
  "ServiceSource": "Microsoft Defender for Endpoint",
  "Severity": "Medium",
  "Timestamp": "2026-08-01T02:22:14.8885692Z",
  "Title": "Suspicious service registration"
}