Defender-AlertInfo
any: Alert information
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
Title | 1 detection rule | Kusto |
Representative record #
{
"AlertId": "da90e6fe47-4ecb-4cfd-abd5-826bc671bae6_1",
"AttackTechniques": [
"Masquerading (T1036)",
"Masquerade Task or Service (T1036.004)",
"Windows Service (T1543.003)",
"Service Execution (T1569.002)",
"Services Registry Permissions Weakness (T1574.011)"
],
"Category": "Persistence",
"DetectionSource": "EDR",
"ServiceSource": "Microsoft Defender for Endpoint",
"Severity": "Medium",
"Timestamp": "2026-08-01T02:22:14.8885692Z",
"Title": "Suspicious service registration"
}