detection.wiki

Defender-AlertEvidence

any: Alert evidence

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
AlertEvidence

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

NameRulesVendors
EntityType2 detection rulesKusto
ServiceSource1 detection ruleKusto

Representative record #

{
  "AdditionalFields": {
    "DnsDomain": "ludus.domain",
    "HostName": "jd-win11-22h2-1",
    "NetBiosName": "jd-win11-22h2-1.ludus.domain",
    "OSFamily": "Windows",
    "OSVersion": "10.0",
    "IsDomainJoined": true,
    "IpInterfaces": [
      {
        "$id": "2",
        "Address": "10.2.10.21",
        "Type": "ip"
      },
      {
        "$id": "3",
        "Address": "127.0.0.1",
        "Type": "ip"
      },
      {
        "$id": "4",
        "Address": "::1",
        "Type": "ip"
      }
    ],
    "RemediationProviders": [
      {
        "RemediationState": "Active",
        "RemediationDate": "2026-08-01T09:23:27.0361808Z",
        "Type": "remediation-provider"
      }
    ],
    "LastRemediationState": "Active",
    "ThreatAnalysisSummary": [
      {
        "AnalyzersResult": [],
        "Verdict": "Suspicious",
        "AnalysisDate": "2026-08-01T09:23:27.0361808Z"
      }
    ],
    "LastVerdict": "Suspicious",
    "Asset": true,
    "DetailedRoles": [
      "PrimaryDevice"
    ],
    "RbacScopes": {
      "ScopesPerType": {
        "MachineGroupIds": {
          "Mode": "Any",
          "Scopes": [
            "223"
          ]
        },
        "Workloads": {
          "Mode": "All",
          "Scopes": [
            "Mdatp"
          ]
        }
      }
    },
    "Type": "host",
    "LeadingHost": true,
    "Role": 0,
    "MachineId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
    "MachineIdType": 3,
    "HostMachineId": null,
    "DetectionStatus": "Detected",
    "SuspicionLevel": "Suspicious",
    "EnrichmentType": "MachineIpInterfacesEnrichment",
    "IsIoc": false,
    "MergeByKey": "7i1RmyvZqPH7gS+N2PpTwV+Sz64=",
    "MergeByKeyHex": "EE2D519B2BD9A8F1FB812F8DD8FA53C15F92CFAE"
  },
  "AlertId": "da90e6fe47-4ecb-4cfd-abd5-826bc671bae6_1",
  "AttackTechniques": [
    "Masquerading (T1036)",
    "Masquerade Task or Service (T1036.004)",
    "Windows Service (T1543.003)",
    "Service Execution (T1569.002)",
    "Services Registry Permissions Weakness (T1574.011)"
  ],
  "Categories": [
    "Persistence"
  ],
  "DetectionSource": "EDR",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "EntityType": "Machine",
  "EvidenceRole": "Impacted",
  "LocalIP": "10.2.10.21",
  "ServiceSource": "Microsoft Defender for Endpoint",
  "Severity": "Medium",
  "Timestamp": "2026-08-01T02:22:14.8885692Z",
  "Title": "Suspicious service registration"
}

Detection Patterns #

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

  • Possible Phishing with CSL and Network Sessions source medium: This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. If your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.T1102, T1566
  • Defender Alert Evidence source high: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.T1546

References #