Defender-DeviceEvents

ActionType	Title	Sample	Rule
any	Defender event	Y	Y
PowerShellCommand	PowerShell command executed	Y	Y
AmsiScriptDetection	AMSI script detection	Y	N
AmsiScriptContent	AMSI script content captured	N	Y
CreateRemoteThreadApiCall	CreateRemoteThread API call	Y	Y
NamedPipeEvent	Named pipe event	Y	Y
UserAccountAddedToLocalGroup	User account added to local group	Y	Y
UserAccountRemovedFromLocalGroup	User account removed from local group	Y	N
AsrLsassCredentialTheftAudited	ASR: LSASS credential theft (audited)	N	N
AsrOfficeChildProcessAudited	ASR: Office child process (audited)	N	N
AntivirusReport	Antivirus report	Y	N
ScheduledTaskCreated	Scheduled task created	Y	N
ScheduledTaskDeleted	Scheduled task deleted	Y	N
ScheduledTaskUpdated	Scheduled task updated	Y	N
OpenProcessApiCall	Process opened (OpenProcess API call)	Y	Y
ProcessPrimaryTokenModified	Process primary token modified	Y	Y
LdapSearch	LDAP search	Y	Y
ClrUnbackedModuleLoaded	CLR unbacked module loaded	Y	Y
AsrUntrustedExecutableAudited	ASR untrusted executable (audited)	N	Y
DriverLoad	Driver loaded	Y	Y
NtAllocateVirtualMemoryRemoteApiCall	Remote virtual memory allocation (NtAllocateVirtualMemory)	Y	Y
MemoryRemoteProtect	Remote virtual memory protection change	N	Y
NtMapViewOfSectionRemoteApiCall	Remote section map (NtMapViewOfSection)	N	Y
QueueUserApcRemoteApiCall	Remote APC queued (QueueUserApc)	N	Y
SetThreadContextRemoteApiCall	Remote thread context change (SetThreadContext)	N	Y
AsrAbusedSystemToolAudited	ASR copied or impersonated system tool (audited)	Y	N
AsrAbusedSystemToolBlocked	ASR copied or impersonated system tool (blocked)	Y	N
AsrAbusedSystemToolWarnBypassed	ASR copied or impersonated system tool (warn bypassed)	N	N
AsrAdobeReaderChildProcessAudited	ASR Adobe Reader child process (audited)	N	N
AsrAdobeReaderChildProcessBlocked	ASR Adobe Reader child process (blocked)	N	N
AsrAdobeReaderChildProcessWarnBypassed	ASR Adobe Reader child process (warn bypassed)	N	N
AsrExecutableEmailContentAudited	ASR executable from email client (audited)	N	N
AsrExecutableEmailContentBlocked	ASR executable from email client (blocked)	N	N
AsrExecutableEmailContentWarnBypassed	ASR executable from email client (warn bypassed)	N	N
AsrExecutableOfficeContentAudited	ASR Office app creating executable content (audited)	N	N
AsrExecutableOfficeContentBlocked	ASR Office app creating executable content (blocked)	N	N
AsrExecutableOfficeContentWarnBypassed	ASR Office app creating executable content (warn bypassed)	N	N
AsrLsassCredentialTheftBlocked	ASR LSASS credential theft (blocked)	N	N
AsrObfuscatedScriptAudited	ASR obfuscated script execution (audited)	N	N
AsrObfuscatedScriptBlocked	ASR obfuscated script execution (blocked)	N	N
AsrObfuscatedScriptWarnBypassed	ASR obfuscated script execution (warn bypassed)	N	N
AsrOfficeChildProcessBlocked	ASR Office app child process (blocked)	N	N
AsrOfficeChildProcessWarnBypassed	ASR Office app child process (warn bypassed)	N	N
AsrOfficeCommAppChildProcessAudited	ASR Office communication app child process (audited)	N	N
AsrOfficeCommAppChildProcessBlocked	ASR Office communication app child process (blocked)	N	N
AsrOfficeCommAppChildProcessWarnBypassed	ASR Office communication app child process (warn bypassed)	N	N
AsrOfficeMacroWin32ApiCallsAudited	ASR Win32 API calls from Office macros (audited)	N	N
AsrOfficeMacroWin32ApiCallsBlocked	ASR Win32 API calls from Office macros (blocked)	N	N
AsrOfficeMacroWin32ApiCallsWarnBypassed	ASR Win32 API calls from Office macros (warn bypassed)	N	N
AsrOfficeProcessInjectionAudited	ASR Office app code injection (audited)	N	N
AsrOfficeProcessInjectionBlocked	ASR Office app code injection (blocked)	N	N
AsrPersistenceThroughWmiAudited	ASR WMI event subscription persistence (audited)	Y	N
AsrPersistenceThroughWmiBlocked	ASR WMI event subscription persistence (blocked)	Y	N
AsrPersistenceThroughWmiWarnBypassed	ASR WMI event subscription persistence (warn bypassed)	N	N
AsrPsexecWmiChildProcessAudited	ASR PsExec or WMI child process (audited)	Y	N
AsrPsexecWmiChildProcessBlocked	ASR PsExec or WMI child process (blocked)	Y	N
AsrPsexecWmiChildProcessWarnBypassed	ASR PsExec or WMI child process (warn bypassed)	N	N
AsrRansomwareAudited	ASR ransomware activity (audited)	N	N
AsrRansomwareBlocked	ASR ransomware activity (blocked)	N	N
AsrRansomwareWarnBypassed	ASR ransomware activity (warn bypassed)	N	N
AsrSafeModeRebootedAudited	ASR Safe mode reboot configuration (audited)	N	N
AsrSafeModeRebootBlocked	ASR Safe mode reboot configuration (blocked)	N	N
AsrSafeModeRebootWarnBypassed	ASR Safe mode reboot configuration (warn bypassed)	N	N
AsrScriptExecutableDownloadAudited	ASR script launching downloaded executable (audited)	N	N
AsrScriptExecutableDownloadBlocked	ASR script launching downloaded executable (blocked)	N	N
AsrScriptExecutableDownloadWarnBypassed	ASR script launching downloaded executable (warn bypassed)	N	N
AsrUntrustedExecutableBlocked	ASR untrusted executable (blocked)	N	Y
AsrUntrustedExecutableWarnBypassed	ASR untrusted executable (warn bypassed)	N	N
AsrUntrustedUsbProcessAudited	ASR untrusted process from USB (audited)	N	N
AsrUntrustedUsbProcessBlocked	ASR untrusted process from USB (blocked)	N	N
AsrUntrustedUsbProcessWarnBypassed	ASR untrusted process from USB (warn bypassed)	N	N
AsrVulnerableSignedDriverAudited	ASR vulnerable signed driver (audited)	N	N
AsrVulnerableSignedDriverBlocked	ASR vulnerable signed driver (blocked)	N	N
AsrVulnerableSignedDriverWarnBypassed	ASR vulnerable signed driver (warn bypassed)	N	N
AsrWebShellOnServerAudited	ASR webshell creation on Windows Server (audited)	N	N
AsrWebShellOnServerBlocked	ASR webshell creation on Windows Server (blocked)	N	N
AsrWebShellWarnBypassed	ASR webshell creation (warn bypassed)	N	N
AppControlAppInstallationAudited	AppControl app installation (audited)	N	N
AppControlAppInstallationBlocked	AppControl app installation (blocked)	N	N
AppControlCIScriptAudited	AppControl Config CI script (audited)	N	N
AppControlCIScriptBlocked	AppControl Config CI script (blocked)	N	N
AppControlCodeIntegrityDriverRevoked	AppControl Code Integrity driver revoked	N	N
AppControlCodeIntegrityImageAudited	AppControl Code Integrity image (audited)	N	N
AppControlCodeIntegrityImageRevoked	AppControl Code Integrity image revoked	N	N
AppControlCodeIntegrityOriginAllowed	AppControl Code Integrity origin allowed	N	N
AppControlCodeIntegrityOriginAudited	AppControl Code Integrity origin (audited)	N	N
AppControlCodeIntegrityOriginBlocked	AppControl Code Integrity origin (blocked)	N	N
AppControlCodeIntegrityPolicyAudited	AppControl Code Integrity policy (audited)	N	N
AppControlCodeIntegrityPolicyBlocked	AppControl Code Integrity policy (blocked)	N	N
AppControlCodeIntegrityPolicyLoaded	AppControl Code Integrity policy loaded	N	N
AppControlCodeIntegritySigningInformation	AppControl Code Integrity signing information	Y	N
AppControlExecutableAudited	AppControl executable (audited)	N	N
AppControlExecutableBlocked	AppControl executable (blocked)	N	N
AppControlPackagedAppAudited	AppControl packaged app (audited)	N	N
AppControlPackagedAppBlocked	AppControl packaged app (blocked)	N	N
AppControlPolicyApplied	AppControl policy applied	Y	N
AppControlScriptAudited	AppControl script (audited)	N	N
AppControlScriptBlocked	AppControl script (blocked)	N	N
AppGuardBrowseToUrl	Application Guard browse to URL	N	N
AppGuardCreateContainer	Application Guard container created	N	N
AppGuardLaunchedWithUrl	Application Guard launched with URL	N	N
AppGuardResumeContainer	Application Guard container resumed	N	N
AppGuardStopContainer	Application Guard container stopped	N	N
AppGuardSuspendContainer	Application Guard container suspended	N	N
AppLockerBlockExecutable	AppLocker blocked executable	N	N
AppLockerBlockPackagedApp	AppLocker blocked packaged app	N	N
AppLockerBlockPackagedAppInstallation	AppLocker blocked packaged app installation	N	N
AppLockerBlockScript	AppLocker blocked script	N	N
ControlFlowGuardViolation	Control Flow Guard violation	N	N
ExploitGuardAcgAudited	Exploit Guard ACG (audited)	Y	N
ExploitGuardAcgEnforced	Exploit Guard ACG (blocked)	N	N
ExploitGuardChildProcessAudited	Exploit Guard child process (audited)	Y	N
ExploitGuardChildProcessBlocked	Exploit Guard child process (blocked)	N	N
ExploitGuardEafViolationAudited	Exploit Guard EAF violation (audited)	N	N
ExploitGuardEafViolationBlocked	Exploit Guard EAF violation (blocked)	N	N
ExploitGuardIafViolationAudited	Exploit Guard IAF violation (audited)	N	N
ExploitGuardIafViolationBlocked	Exploit Guard IAF violation (blocked)	N	N
ExploitGuardLowIntegrityImageAudited	Exploit Guard low-integrity image (audited)	Y	N
ExploitGuardLowIntegrityImageBlocked	Exploit Guard low-integrity image (blocked)	N	N
ExploitGuardNetworkProtectionAudited	Exploit Guard Network Protection (audited)	N	N
ExploitGuardNetworkProtectionBlocked	Exploit Guard Network Protection (blocked)	N	N
ExploitGuardNonMicrosoftSignedAudited	Exploit Guard non-Microsoft signed image (audited)	N	N
ExploitGuardNonMicrosoftSignedBlocked	Exploit Guard non-Microsoft signed image (blocked)	Y	Y
ExploitGuardRopExploitAudited	Exploit Guard ROP exploit (audited)	N	N
ExploitGuardRopExploitBlocked	Exploit Guard ROP exploit (blocked)	N	N
ExploitGuardSharedBinaryAudited	Exploit Guard shared binary load (audited)	N	N
ExploitGuardSharedBinaryBlocked	Exploit Guard shared binary load (blocked)	N	N
ExploitGuardWin32SystemCallAudited	Exploit Guard Win32k system-call (audited)	Y	N
ExploitGuardWin32SystemCallBlocked	Exploit Guard Win32k system-call (blocked)	N	N
AntivirusDefinitionsUpdateFailed	Antivirus definitions update failed	N	N
AntivirusDefinitionsUpdated	Antivirus definitions updated	N	N
AntivirusDetection	Antivirus detection	Y	N
AntivirusEmergencyUpdatesInstalled	Antivirus emergency updates installed	N	N
AntivirusError	Antivirus error	N	N
AntivirusMalwareActionFailed	Antivirus malware action failed	N	N
AntivirusMalwareBlocked	Antivirus malware blocked	N	N
AntivirusScanCancelled	Antivirus scan cancelled	Y	N
AntivirusScanCompleted	Antivirus scan completed	Y	N
AntivirusScanFailed	Antivirus scan failed	N	N
AntivirusTroubleshootModeEvent	Antivirus troubleshoot mode state change	N	N
ControlledFolderAccessViolationAudited	Controlled folder access violation (audited)	Y	N
ControlledFolderAccessViolationBlocked	Controlled folder access violation (blocked)	N	N
FirewallInboundConnectionBlocked	Firewall inbound connection blocked	Y	N
FirewallInboundConnectionToAppBlocked	Firewall inbound connection to app blocked	Y	N
FirewallOutboundConnectionBlocked	Firewall outbound connection blocked	Y	N
FirewallServiceStopped	Firewall service stopped	N	N
NetworkProtectionUserBypassEvent	Network protection user bypass	N	N
NetworkShareObjectAccessChecked	Network share object access checked	N	N
NetworkShareObjectAdded	Network share object added	N	N
NetworkShareObjectDeleted	Network share object deleted	N	N
NetworkShareObjectModified	Network share object modified	N	N
SmartScreenAppWarning	SmartScreen app warning	N	N
SmartScreenExploitWarning	SmartScreen exploit warning	N	N
SmartScreenUrlWarning	SmartScreen URL warning	N	N
SmartScreenUserOverride	SmartScreen user override	N	N
AccountCheckedForBlankPassword	Account checked for blank password	N	N
AuditPolicyModification	Audit policy modified	Y	N
BitLockerAuditCompleted	BitLocker audit completed	N	N
BluetoothPolicyTriggered	Bluetooth policy triggered	N	N
BrowserLaunchedToOpenUrl	Browser launched to open URL	Y	Y
BruteForceActivityDetected	Brute force activity detected	N	N
CertificateServicesApprovedCertificateRequest	Certificate Services approved certificate request	Y	N
CertificateServicesLoadedTemplate	Certificate Services loaded template	Y	N
CertificateServicesReceivedCertificateRequest	Certificate Services received certificate request	Y	N
CredentialsBackup	Credentials backed up	N	N
DeviceBootAttestationInfo	Device boot attestation info	N	N
DirectoryServiceObjectCreated	Directory Service object created	Y	N
DirectoryServiceObjectModified	Directory Service object modified	N	N
DnsQueryResponse	DNS query response	Y	N
DpapiAccessed	DPAPI accessed	Y	N
ExternalDeviceConnected	External device connected	N	N
ExternalDeviceDisconnected	External device disconnected	N	N
FileTimestampModificationEvent	File timestamp modified	N	N
GetAsyncKeyStateApiCall	GetAsyncKeyState API call	N	N
GetClipboardData	GetClipboardData API call	N	N
LogonRightsSettingEnabled	Logon rights setting enabled	N	N
NtAllocateVirtualMemoryApiCall	NtAllocateVirtualMemory API call	Y	Y
NtProtectVirtualMemoryApiCall	NtProtectVirtualMemory API call	Y	Y
PTraceDetected	PTrace detected	N	N
PasswordChangeAttempt	Password change attempt	N	N
PlistPropertyModified	Plist property modified	N	N
PnpDeviceAllowed	PnP device allowed	N	N
PnpDeviceBlocked	PnP device blocked	N	N
PnpDeviceConnected	PnP device connected	Y	N
PrintJobBlocked	Print job blocked	N	N
ProcessCreatedUsingWmiQuery	Process created using WMI query	Y	N
ReadProcessMemoryApiCall	ReadProcessMemory API call	Y	Y
RemoteDesktopConnection	Remote Desktop connection	N	N
RemoteWmiOperation	Remote WMI operation	N	N
RemovableStorageFileEvent	Removable storage file event	N	N
RemovableStoragePolicyTriggered	Removable storage policy triggered	N	N
SafeDocFileScan	Safe Documents file scanned	N	N
ScheduledTaskDisabled	Scheduled task disabled	N	N
ScheduledTaskEnabled	Scheduled task enabled	N	N
ScreenshotTaken	Screenshot taken	N	N
SecurityGroupCreated	Security group created	Y	N
SecurityGroupDeleted	Security group deleted	Y	N
SecurityLogCleared	Security log cleared	Y	N
SensitiveFileRead	Sensitive file read	N	N
ServiceInstalled	Service installed	Y	N
ShellLinkCreateFileEvent	Shell link (LNK) file created	Y	N
TamperingAttempt	Tampering attempt	Y	N
UntrustedWifiConnection	Untrusted Wi-Fi connection	N	N
UsbDriveDriveLetterChanged	USB drive letter changed	N	N
UsbDriveMounted	USB drive mounted	Y	Y
UsbDriveUnmounted	USB drive unmounted	N	N
UserAccountCreated	User account created	Y	Y
UserAccountDeleted	User account deleted	Y	N
UserAccountModified	User account modified	Y	Y
UserAccountPasswordResetAttempt	User account password reset attempt	Y	N
WmiBindEventFilterToConsumer	WMI EventFilter bound to consumer	Y	N
WriteToLsassProcessMemory	Write to LSASS process memory	N	N
AsrLsassCredentialTheftWarnBypassed	ASR LSASS credential theft warn bypassed	N	N
AsrOfficeProcessInjectionWarnBypassed	ASR Office process injection warn bypassed	N	N
TvmAxonTelemetryEvent	Threat and vulnerability management telemetry	Y	N
OtherAlertRelatedActivity	Other alert-related activity	Y	N
ContainedUserLogonBlocked	Contained user logon blocked	Y	N
ContainedUserSmbFileOpenBlocked	Contained user SMB file open blocked	Y	N
ContainedUserRpcAccessBlocked	Contained user RPC access blocked	Y	N

any: Defender event

Table: DeviceEvents

Fields #

Name	Description	Rules
`DeviceId`
`Timestamp`
`ActionType`
`AdditionalFields`
`InitiatingProcessFileName`		1 detection rule
`InitiatingProcessCommandLine`

Example Event #

{
  "ActionType": "AntivirusReport",
  "AdditionalFields": {
    "WasExecutingWhileDetected": false
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "wermgr.exe",
  "FolderPath": "C:\\Windows\\System32",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1852632695,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T14:28:02.3323642Z"
}

Detection Patterns #

Detect Suspicious Ncrypt Dll

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphEdges any: Exposure graph edgesORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

3 rules

Kusto

Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeeded

3 rules

Kusto

Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Defender-DeviceEvents any: Defender eventORDefender-DeviceFileEvents any: File activity

1 rule

Kusto

Azure VM Run Command operations executing a unique PowerShell script (source)

Microsoft Security Research

Defender-DeviceEvents any: Defender eventORCreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context change

1 rule

Kusto

Process Injection From Untrusted Process (source)

FalconForce

Show All Detection Patterns

Defender-DeviceEvents any: Defender eventORNamedPipeEvent: Named pipe event

1 rule

Kusto

Suspicious named pipes (source)

Execution: Exploitation for Client Execution

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activityORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devices

1 rule

Kusto

Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 (source)

Persistence: Compromise Host Software Binary

Defender-DeviceEvents any: Defender eventORDefender-DeviceImageLoadEvents any: Image load

1 rule

Kusto

SUNSPOT malware hashes (source)

Privilege Escalation: Exploitation for Privilege Escalation

Defender-DeviceEvents any: Defender eventORDefender-DeviceFileEvents any: File activityORFileCreated: File created

1 rule

Kusto

Detect LolDriver drop or load from unknown or unsigned process (source)

Robbe Van den Daele

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`ConnectionSuccess`	3 rules	kusto
`ActionType` (kusto rule field)	eq	`NamedPipeEvent`	2 rules	kusto
`ActionType` (kusto rule field)	starts_with	`AppControl`	5 rules	kusto
`file_name` (kusto rule field)	eq	`ncrypt.dll`	4 rules	kusto
`DestinationHostname` (kusto rule field)	eq	`login.microsoftonline.com`	3 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`250`	3 rules	kusto
`DestinationPort` (kusto rule field)	eq	`3389`	2 rules	kusto
`NodeLabel` (kusto rule field)	eq	`device`	2 rules	kusto
`OnboardingStatus` (kusto rule field)	ne	`Onboarded`	2 rules	kusto
`TpmActivated` (kusto rule field)	ne	`true`	2 rules	kusto
`TpmEnabled` (kusto rule field)	ne	`true`	2 rules	kusto
`TpmSupported` (kusto rule field)	ne	`true`	2 rules	kusto
`parent_process_name` (kusto rule field)	contains	`powershell`	2 rules	kusto
`parent_process_name` (kusto rule field)	contains	`python`	2 rules	kusto
`parent_process_name` (kusto rule field)	ne	`microsoft.tri.sensor.exe`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Windows host username encoded in base64 web request source medium: This detection will identify network requests in HTTP proxy data that contains Base64 encoded usernames from machines in the DeviceEvents table. This technique was seen usee by POLONIUM in their RunningRAT tool.T1041, T1071, T1071.001
Prestige ransomware IOCs Oct 2022 source high: This query looks for file hashes and AV signatures associated with Prestige ransomware payload.T1203
Office ASR rule triggered from browser spawned office process. source medium: The attacker sends a spearphishing email to a user. The email contains a link which points to a website that eventually presents the user a download of an MS Office document. This document contains a malicious macro. The macro triggers one of the ASR rules. This detection looks for Office ASR violations triggered by an Office document opened from a browser. Note: be aware that you need to have the proper ASR rules enabled for this detection to work.T1566, T1566.002

Show 7 more (10 total) on the rules page

References #

PowerShellCommand: PowerShell command executed

Table: DeviceEvents

Fields #

Name	Description	Rules
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`		1 detection rule
`InitiatingProcessCommandLine`

Example Event #

{
  "ActionType": "PowerShellCommand",
  "AdditionalFields": {
    "Command": "$keyInfo = Get-TargetResourceInternal -Key $Key -Verbose:$false    "
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "wmiprvse.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T09:32:33.3639393Z",
  "InitiatingProcessFileName": "wmiprvse.exe",
  "InitiatingProcessFileSize": 507904,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wbem\\wmiprvse.exe",
  "InitiatingProcessId": 3780,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "90815c0783bc9f9f6d96862c25c192bf",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:15.7271138Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1512,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "4d70bdf57f36cd27925fbda50b4cad05d0ccb64f",
  "InitiatingProcessSHA256": "1792731e030b7fe35a7eb21c9f907eae6e4ac381de918003f2709185c4ce0a5a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394480683",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "WMI Provider Host",
  "InitiatingProcessVersionInfoInternalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1061080,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:32:34.6610359Z"
}

Detection Patterns #

Lateral Movement: Exploitation of Remote Services

Defender-DeviceEvents PowerShellCommand: PowerShell command executedORDefender-DeviceLogonEvents LogonSuccess: Logon succeeded

1 rule

Kusto

Service Accounts Performing Remote PS (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`PowerShellCommand`	2 rules	kusto
`ActionType` (kusto rule field)	eq	`LogonSuccess`	1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`wsmprovhost.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Suspicious Powershell Commandlet Executed source medium: This analytic rule detects when a suspicious PowerShell commandlet is executed on a host. Threat actors often use PowerShell to execute commands and scripts to move laterally, escalate privileges, and exfiltrate data.T1059

References #

AmsiScriptDetection: AMSI script detection

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "AmsiScriptDetection",
  "AdditionalFields": {
    "Description": "wsmprovhost.exe executed a script"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-07-26T00:27:30.0919423Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFolderPath": "C:\\Windows\\System32\\wsmprovhost.exe",
  "InitiatingProcessId": 10244,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:36.8481467Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1284,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "ReportId": 17390,
  "ReportId@odata.type": "#Int64",
  "SHA256": "fb61e1383dcf4b5fabd730bd8f09d072756edbf61221f009e31a95ebb3080143",
  "Timestamp": "2026-07-26T00:27:32.3890818Z"
}

References #

AmsiScriptContent: AMSI script content captured

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Deimos Component Execution source high: Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.T1005, T1020, T1059

References #

CreateRemoteThreadApiCall: CreateRemoteThread API call

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "nt authority",
  "AccountName": "network service",
  "AccountSid": "S-1-5-20",
  "ActionType": "CreateRemoteThreadApiCall",
  "AdditionalFields": {
    "IntegrityLevel": 16384
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileName": "WmiPrvSE.exe",
  "FileSize": 507904,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\Windows\\System32\\wbem",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"rpcFwManager.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:25.8888861Z",
  "InitiatingProcessFileName": "rpcFwManager.exe",
  "InitiatingProcessFileSize": 431104,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\tools\\rpcfw_2.2.5\\rpcfwmanager.exe",
  "InitiatingProcessId": 5032,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "cb802ba6ada1ac4afaed97ff0c8db737",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:12.0633947Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1232,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "130e7788871e094a4c965b8b75c3f90965f84b54",
  "InitiatingProcessSHA256": "494ee86d2a538f23fcfbab1507612637b4af2b97166ed1e3b5f86da74506bca4",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394477161",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 996,
  "LogonId@odata.type": "#Int64",
  "MD5": "90815c0783bc9f9f6d96862c25c192bf",
  "ProcessCommandLine": "wmiprvse.exe -Embedding",
  "ProcessCreationTime": "2026-08-01T09:31:06.3599881Z",
  "ProcessId": 3160,
  "ProcessId@odata.type": "#Int64",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ReportId": 1060942,
  "ReportId@odata.type": "#Int64",
  "SHA1": "4d70bdf57f36cd27925fbda50b4cad05d0ccb64f",
  "Timestamp": "2026-08-01T09:31:08.5245699Z"
}

Detection Patterns #

Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORNtAllocateVirtualMemoryApiCall: NtAllocateVirtualMemory API callORNtProtectVirtualMemoryApiCall: NtProtectVirtualMemory API callORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeeded

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORReadProcessMemoryApiCall: ReadProcessMemory API call

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Execution: User Execution

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context change

1 rule

Kusto

Suspicious Process Injection from Office application (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`createremotethreadapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntallocatevirtualmemoryremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntmapviewofsectionremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`queueuserapcremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`setthreadcontextremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	2 rules	kusto
`DestinationPort` (kusto rule field)	eq	`9389`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`200`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`500`	1 rule	kusto
`InitiatingProcessSHA1` (kusto rule field)	is_not_null		1 rule	kusto
`Signer` (kusto rule field)	is_null		1 rule	kusto
`file_name` (kusto rule field)	is_not_null		1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`mmc.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`excel.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powerpnt.exe`	1 rule	kusto

References #

NamedPipeEvent: Named pipe event

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`InitiatingProcessFileName`

Example Event #

{
  "AccountSid": "S-1-5-18",
  "ActionType": "NamedPipeEvent",
  "AdditionalFields": {
    "DesiredAccess": 1704351,
    "FileOperation": "File created",
    "NamedPipeEnd": "Server",
    "PipeName": "\\Device\\NamedPipe\\PSHost.134300503533639393.3780.DscPsPluginWkr_AppDomain.WmiPrvSE",
    "RemoteClientsAccess": "AcceptRemote",
    "SessionId": 0,
    "ThreadId": 5400
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "wmiprvse.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T09:32:33.3639393Z",
  "InitiatingProcessFileName": "wmiprvse.exe",
  "InitiatingProcessFileSize": 507904,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wbem\\wmiprvse.exe",
  "InitiatingProcessId": 3780,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "90815c0783bc9f9f6d96862c25c192bf",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:15.7271138Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1512,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "4d70bdf57f36cd27925fbda50b4cad05d0ccb64f",
  "InitiatingProcessSHA256": "1792731e030b7fe35a7eb21c9f907eae6e4ac381de918003f2709185c4ce0a5a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394480683",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "WMI Provider Host",
  "InitiatingProcessVersionInfoInternalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1060995,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:32:33.7567061Z"
}

Detection Patterns #

Defender-DeviceEvents any: Defender eventORNamedPipeEvent: Named pipe event

1 rule

Kusto

Suspicious named pipes (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`NamedPipeEvent`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

C2-NamedPipe source high: Detects the creation of a named pipe used by known APT malware. Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487cT1105

References #

UserAccountAddedToLocalGroup: User account added to local group

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AdditionalFields`

Example Event #

{
  "AccountSid": "S-1-5-21-3407486967-1585450050-1838039599-1750",
  "ActionType": "UserAccountAddedToLocalGroup",
  "AdditionalFields": {
    "GroupName": "Administrators",
    "GroupDomainName": "Builtin",
    "GroupSid": "S-1-5-32-544"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5838,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:26.2894691Z"
}

Detection Patterns #

Persistence: Account Manipulation

Defender-DeviceEvents UserAccountAddedToLocalGroup: User account added to local groupORUserAccountCreated: User account createdORUserAccountModified: User account modifiedORDefender-IdentityInfo any: Identity information

1 rule

Kusto

Local Admin Group Changes (source)

References #

UserAccountRemovedFromLocalGroup: User account removed from local group

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AdditionalFields`

Example Event #

{
  "AccountSid": "S-1-5-21-3407486967-1585450050-1838039599-1750",
  "ActionType": "UserAccountRemovedFromLocalGroup",
  "AdditionalFields": {
    "GroupName": "Administrators",
    "GroupDomainName": "Builtin",
    "GroupSid": "S-1-5-32-544"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5840,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:26.3986187Z"
}

References #

AsrLsassCredentialTheftAudited: ASR: LSASS credential theft (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`

References #

AsrOfficeChildProcessAudited: ASR: Office child process (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`

References #

AntivirusReport: Antivirus report

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "AntivirusReport",
  "AdditionalFields": {
    "WasExecutingWhileDetected": false
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "wermgr.exe",
  "FolderPath": "C:\\Windows\\System32",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1852632695,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T14:28:02.3323642Z"
}

References #

ScheduledTaskCreated: Scheduled task created

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ScheduledTaskCreated",
  "AdditionalFields": {
    "TaskName": "\\dwh_sec_task",
    "TaskContent": {
      "Triggers": {
        "TimeTrigger": {
          "StartBoundary": "2026-08-01T08:19:42Z",
          "Enabled": "true"
        }
      },
      "Actions": {
        "Exec": {
          "Command": "cmd.exe",
          "Arguments": "/c exit"
        }
      }
    },
    "SubjectUserName": "domainadmin"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5976,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.5483068Z"
}

References #

ScheduledTaskDeleted: Scheduled task deleted

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ScheduledTaskDeleted",
  "AdditionalFields": {
    "TaskName": "\\OneDrive Per-Machine Standalone Update Task",
    "SubjectUserName": "JD-WIN11-22H2-1$"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "jd-win11-22h2-1$",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 3534,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:03:51.0949261Z"
}

References #

ScheduledTaskUpdated: Scheduled task updated

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ScheduledTaskUpdated",
  "AdditionalFields": {
    "TaskName": "\\Microsoft\\Windows\\Windows Defender\\Windows Defender Cleanup",
    "TaskContent": {
      "Actions": {
        "Exec": {
          "Command": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26060.3008-0\\MpCmdRun.exe",
          "Arguments": "-IdleTask -TaskName WdCleanup"
        }
      }
    },
    "SubjectUserName": "JD-WIN11-22H2-1$"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "jd-win11-22h2-1$",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5080,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:07:00.5468087Z"
}

References #

OpenProcessApiCall: Process opened (OpenProcess API call)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

Example Event #

{
  "AccountDomain": "nt authority",
  "AccountName": "system",
  "AccountSid": "S-1-5-18",
  "ActionType": "OpenProcessApiCall",
  "AdditionalFields": {
    "DesiredAccess": 5136
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileName": "lsass.exe",
  "FileSize": 84128,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\Windows\\System32",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "network service",
  "InitiatingProcessAccountSid": "S-1-5-20",
  "InitiatingProcessCommandLine": "wmiprvse.exe -secured -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:32.9324028Z",
  "InitiatingProcessFileName": "WmiPrvSE.exe",
  "InitiatingProcessFileSize": 507904,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wbem\\wmiprvse.exe",
  "InitiatingProcessId": 3504,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "90815c0783bc9f9f6d96862c25c192bf",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:15.7271138Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1512,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "4d70bdf57f36cd27925fbda50b4cad05d0ccb64f",
  "InitiatingProcessSHA256": "1792731e030b7fe35a7eb21c9f907eae6e4ac381de918003f2709185c4ce0a5a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394477227",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "WMI Provider Host",
  "InitiatingProcessVersionInfoInternalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "4be1e4f6c6468a28dc00ffd4b8d412b3",
  "ProcessCommandLine": "lsass.exe",
  "ProcessCreationTime": "2026-08-01T01:02:12.199103Z",
  "ProcessId": 1244,
  "ProcessId@odata.type": "#Int64",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ReportId": 152,
  "ReportId@odata.type": "#Int64",
  "SHA1": "3add8d4abe6365d614055a741e24ebcd9e0492ec",
  "Timestamp": "2026-08-01T01:03:00.0579798Z"
}

Detection Patterns #

Defender-DeviceEvents OpenProcessApiCall: Process openedORProcessPrimaryTokenModified: Process primary token modified

1 rule

Kusto

LSASS Dumping using Debug Privileges (source)

FalconForce

References #

ProcessPrimaryTokenModified: Process primary token modified

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`AccountName`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ProcessPrimaryTokenModified",
  "AdditionalFields": {
    "TokenModificationProperties": {
      "tokenChangeDescription": "The process token of an unknown process was modified",
      "privilegesFlags": [],
      "isChangedToSystemToken": false,
      "originalTokenIntegrityLevelName": "High",
      "currentTokenIntegrityLevelName": "High"
    },
    "SystemTokenPointer": "18446645145557666272",
    "OriginalTokenIntegrityLevel": "12288",
    "OriginalTokenPointer": "18446645146047629424",
    "OriginalTokenPrivEnabled": "130793013024",
    "OriginalTokenPrivPresent": "130793013024",
    "OriginalTokenSource": "TnRMbVNzcCA=",
    "OriginalTokenUserSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "CurrentTokenIntegrityLevel": "12288",
    "CurrentTokenPointer": "18446645146047629424",
    "CurrentTokenPrivEnabled": "130792881696",
    "CurrentTokenSource": "TnRMbVNzcCA=",
    "CurrentTokenUserSid": "S-1-5-21-1006758700-2167138679-1475694448-1105"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"wevtutil.exe\" epl Microsoft-Windows-PowerShell/Operational C:\\Windows\\Temp\\dwh_219d560c2a944e3687d37b4d6a353fc3\\Microsoft-Windows-PowerShell_Operational-20e2d006ebed53378a929880bac454498a3f784897523b3ce33e8c1f74d9b22e.evtx /ow:false",
  "InitiatingProcessCreationTime": "2026-08-01T09:30:59.2162442Z",
  "InitiatingProcessFileName": "wevtutil.exe",
  "InitiatingProcessFileSize": 282624,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wevtutil.exe",
  "InitiatingProcessId": 12964,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 62296562,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "0ed501220da7e040d8fad1b8420ac7d0",
  "InitiatingProcessParentCreationTime": "2026-08-01T09:30:58.5896337Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wsmprovhost.exe",
  "InitiatingProcessParentId": 4208,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "8c7ec6581d1085c089c576f0635c9f0f80003271",
  "InitiatingProcessSHA256": "97afbe889bb9879a43e313097ebac19522412f254049b07b70cd7c15500c3fc6",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184879236",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Windows Event Log Utility",
  "InitiatingProcessVersionInfoInternalFileName": "wevtutil.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wevtutil.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.3085",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 14419,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:30:59.4644796Z"
}

Detection Patterns #

Defender-DeviceEvents OpenProcessApiCall: Process openedORProcessPrimaryTokenModified: Process primary token modified

1 rule

Kusto

LSASS Dumping using Debug Privileges (source)

FalconForce

References #

LdapSearch: LDAP search

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`
`AdditionalFields`

Example Event #

{
  "ActionType": "LdapSearch",
  "AdditionalFields": {
    "AttributeList": [
      "DC",
      "DnsRecord",
      "dnsProperty",
      "objectGuid",
      "ntSecurityDescriptor",
      "whenCreated",
      "whenChanged",
      "usnCreated",
      "usnChanged",
      "objectClass",
      "msDNS-IsSigned",
      "msDNS-SignWithNSEC3",
      "msDNS-NSEC3OptOut",
      "msDNS-MaintainTrustAnchor",
      "msDNS-DSRecordAlgorithms",
      "msDNS-RFC5011KeyRollovers",
      "msDNS-NSEC3HashAlgorithm",
      "msDNS-NSEC3RandomSaltLength",
      "msDNS-NSEC3Iterations",
      "msDNS-NSEC3UserSalt",
      "msDNS-NSEC3CurrentSalt",
      "msDNS-DNSKEYRecordSetTTL",
      "msDNS-DSRecordSetTTL",
      "msDNS-SignatureInceptionOffset",
      "msDNS-SecureDelegationPollingPeriod",
      "msDNS-SigningKeyDescriptors",
      "msDNS-SigningKeys",
      "msDNS-ParentHasSecureDelegation",
      "msDNS-PropagationTime",
      "msDNS-DNSKEYRecords"
    ],
    "DistinguishedName": "DC=ludus.domain,cn=MicrosoftDNS,DC=DomainDnsZones,DC=ludus,DC=domain",
    "ScopeOfSearch": "OneLevel",
    "SearchFilter": "(&(objectCategory=dnsNode)(uSNChanged>=118885))"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "dns.exe",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:25.8773382Z",
  "InitiatingProcessFileName": "dns.exe",
  "InitiatingProcessFileSize": 2277376,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\dns.exe",
  "InitiatingProcessId": 4916,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "30edc72665436070310310e640a090ce",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:12.0633947Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1232,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "2ad9bbf276040fb9f3d05262e04b373b3aef8c5a",
  "InitiatingProcessSHA256": "a7d6e1358c73681967db1360a84dfb9d79d3518f0741282f4c8dc5cbd918d5b8",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394477149",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Domain Name System (DNS) Server",
  "InitiatingProcessVersionInfoInternalFileName": "dns.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "dns.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.4893",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1061158,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:33:10.7688849Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ObjectServer` (kusto rule field)	eq	`DS`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

ADFS DKM Master Key Export source medium: Identifies an export of the ADFS DKM Master Key from Active Directory. References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/, https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor To understand further the details behind this detection, please review the details in the original PR and subequent PR update to this: https://github.com/Azure/Azure-Sentinel/pull/1562#issue-551542469 https://github.com/Azure/Azure-Sentinel/pull/1512#issue-543053339T1005
LDAP reconnaissance via search filters source: This query collects LDAP queries executed on systems monitored by Defender for Endpoint. The filter and distinguished name attributes of these queries are extracted and matched against a list of IOCs obtained from popular reconnaissance tools.T1018, T1033, T1069, T1069.002, T1087, T1087.002

References #

ClrUnbackedModuleLoaded: CLR unbacked module loaded

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "ClrUnbackedModuleLoaded",
  "AdditionalFields": {
    "ModuleILPathOrName": "qm52mblg",
    "ModuleFlags": 8,
    "ModuleId": 140735602879960,
    "AssemblyId": 2615288747408,
    "ClrInstanceId": 11,
    "ManagedPdbSignature": "00000000-0000-0000-0000-000000000000",
    "ManagedPdbAge": 0,
    "NativePdbSignature": "00000000-0000-0000-0000-000000000000",
    "NativePdbAge": 0
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-07-23T04:46:06.5069213Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFileSize": 65536,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
  "InitiatingProcessId": 12868,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 35900102,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:36.8481467Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1284,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208165085",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
  "InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5934,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T04:46:07.5239329Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`parent_process_name` (kusto rule field)	in	`cscript.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`mmc.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`mshta.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`wscript.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Script Interpreter Loading DotNet Assembly From Memory source: The query searches for script interpreters (mmc.exe, mshta.exe, wscript.exe, and cscript.exe) loading .NET assemblies from memory. In the case of the MMC executable, the query also checks for the MSC file that was loaded, as some legitimate MSC files are known to load .NET assemblies via MMC.T1059, T1059.005, T1059.007, T1218, T1218.005, T1218.014

References #

AsrUntrustedExecutableAudited: ASR untrusted executable (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

ASR Rare and Untrusted Executables source: Below query shows Untrusted executables that are seen on few devices (LocalPrevalence). It requires the below ASR rule to be configured and Cloud-delivered protection to be enabled.
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
You may need to exclude software development users/machines/folders.↳ also matches AsrUntrustedExecutableBlocked: ASR untrusted executable (blocked)

References #

DriverLoad: Driver loaded

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`

Example Event #

{
  "ActionType": "DriverLoad",
  "AdditionalFields": {
    "ImageBase": "18446735278520401920",
    "ImageMD5": "fhDA8Xq5sVfXJA5FZNGpVg==",
    "ImageName": "\\Device\\HarddiskVolume4\\Windows\\System32\\drivers\\mrxdav.sys",
    "ImageSHA1": "3cPaJSHbXy1nUwcWoKjcy10Dw/c=",
    "ImageSHA256": "pi1aSaDJAAD1PPEKV1mbRFc8qco0FOH2E5qoYP5oHVU=",
    "UserSid": "S-1-5-18"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "mrxdav.sys",
  "FolderPath": "C:\\Windows\\System32\\drivers",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:23.4789618Z",
  "InitiatingProcessFileName": "ntoskrnl.exe",
  "InitiatingProcessFileSize": 12080544,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\ntoskrnl.exe",
  "InitiatingProcessId": 4,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "7f51b4fec9c32bcb910365ce68ae492e",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "a92ba6de8966d5b1f0866951832e8ca62ebe6129",
  "InitiatingProcessSHA256": "3255a69b65c23e1356b247aa8c05e93f6a4868268c878952af60c520d887596b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184872961",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "NT Kernel & System",
  "InitiatingProcessVersionInfoInternalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.6060",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "7e10c0f17ab9b157d7240e4564d1a956",
  "ProcessCreationTime": "2022-05-07T05:20:16.9692045Z",
  "ReportId": 5867,
  "ReportId@odata.type": "#Int64",
  "SHA1": "ddc3da2521db5f2d67530716a0a8dccb5d03c3f7",
  "SHA256": "a62d5a49a0c90000f53cf10a57599b44573ca9ca3414e1f6139aa860fe681d55",
  "Timestamp": "2026-08-01T08:19:28.2082084Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`DriverLoad`	2 rules	kusto
`dcount_DeviceId` (kusto rule field)	le	`5`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Microsoft Recommended Driver Block List source: The query below detects loading or creation of a vulnerable driver that is listed in the Microsoft recommended driver block rules.↳ also matches any: Defender event
Suspicious Driver Load source: Below query detects suspicious(unusual/rare) driver loads. Further checks are required on detected files to confirm malicious activity.

References #

NtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocation (NtAllocateVirtualMemory)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "domainadmin",
  "AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "ActionType": "NtAllocateVirtualMemoryRemoteApiCall",
  "AdditionalFields": {
    "IntegrityLevel": 4096
  },
  "CreatedProcessSessionId": 1,
  "CreatedProcessSessionId@odata.type": "#Int64",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "msedgewebview2.exe",
  "FileSize": 4429640,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\150.0.4078.83",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=526.17301.10.0 --user-data-dir=\"C:\\Users\\domainadmin\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\LocalState\\EBWebView\" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=6716.12624.4578051268094391039 /pfhostedapp:667ae301900a1dda24fd8b72f06dca8ebb86dec6",
  "InitiatingProcessCreationTime": "2026-07-22T22:09:57.3672689Z",
  "InitiatingProcessFileName": "msedgewebview2.exe",
  "InitiatingProcessFileSize": 4429640,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\150.0.4078.83\\msedgewebview2.exe",
  "InitiatingProcessId": 7392,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 533154,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "6dab565f7abecfb5a650803a147d738a",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:56.3770216Z",
  "InitiatingProcessParentFileName": "Widgets.exe",
  "InitiatingProcessParentId": 6716,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d2bc131f01d98288a72d0c67f50beee6512705ea",
  "InitiatingProcessSHA256": "e681242df22d38e15d064747ce19be295264847ca0e0cfc25b5311c388aa914d",
  "InitiatingProcessSessionId": 1,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208162643",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft Edge WebView2",
  "InitiatingProcessVersionInfoInternalFileName": "msedgewebview2_exe",
  "InitiatingProcessVersionInfoOriginalFileName": "msedgewebview2.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft Edge WebView2",
  "InitiatingProcessVersionInfoProductVersion": "150.0.4078.83",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 533154,
  "LogonId@odata.type": "#Int64",
  "MD5": "6dab565f7abecfb5a650803a147d738a",
  "ProcessCommandLine": "\"msedgewebview2.exe\" --type=renderer --noerrdialogs --user-data-dir=\"C:\\Users\\domainadmin\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\LocalState\\EBWebView\" --webview-exe-name=Widgets.exe --webview-exe-version=526.17301.10.0 --embedded-browser-webview=1 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1784757861560877 --launch-time-ticks=340683765 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4352,i,5697300689898617178,13885805881883841251,2097152 --field-trial-handle=1876,i,9381192226785814986,12887674189157655895,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13839896133908077084,18330461553330204393,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4376 /pfhostedapp:667ae301900a1dda24fd8b72f06dca8ebb86dec6 /prefetch:1",
  "ProcessCreationTime": "2026-07-22T22:10:02.2519765Z",
  "ProcessId": 10492,
  "ProcessId@odata.type": "#Int64",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ReportId": 1858,
  "ReportId@odata.type": "#Int64",
  "SHA1": "d2bc131f01d98288a72d0c67f50beee6512705ea",
  "Timestamp": "2026-07-22T22:35:01.3220101Z"
}

Detection Patterns #

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORReadProcessMemoryApiCall: ReadProcessMemory API call

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`createremotethreadapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntallocatevirtualmemoryremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntmapviewofsectionremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`queueuserapcremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`setthreadcontextremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	2 rules	kusto
`DestinationPort` (kusto rule field)	eq	`9389`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`500`	1 rule	kusto
`InitiatingProcessSHA1` (kusto rule field)	is_not_null		1 rule	kusto
`Signer` (kusto rule field)	is_null		1 rule	kusto
`file_name` (kusto rule field)	is_not_null		1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`mmc.exe`	1 rule	kusto

References #

MemoryRemoteProtect: Remote virtual memory protection change

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`

Detection Patterns #

Process Injection

2 rules

Kusto

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORReadProcessMemoryApiCall: ReadProcessMemory API call

2 rules

Kusto

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`createremotethreadapicall`	2 rules	kusto
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	2 rules	kusto
`ActionType` (kusto rule field)	in	`ntallocatevirtualmemoryremoteapicall`	2 rules	kusto
`ActionType` (kusto rule field)	in	`ntmapviewofsectionremoteapicall`	2 rules	kusto
`ActionType` (kusto rule field)	in	`queueuserapcremoteapicall`	2 rules	kusto
`ActionType` (kusto rule field)	in	`setthreadcontextremoteapicall`	2 rules	kusto
`DestinationPort` (kusto rule field)	eq	`9389`	1 rule	kusto
`file_name` (kusto rule field)	is_not_null		1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`mmc.exe`	1 rule	kusto

References #

NtMapViewOfSectionRemoteApiCall: Remote section map (NtMapViewOfSection)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`

Detection Patterns #

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORReadProcessMemoryApiCall: ReadProcessMemory API call

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`createremotethreadapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntallocatevirtualmemoryremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntmapviewofsectionremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`queueuserapcremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`setthreadcontextremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	2 rules	kusto
`DestinationPort` (kusto rule field)	eq	`9389`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`500`	1 rule	kusto
`InitiatingProcessSHA1` (kusto rule field)	is_not_null		1 rule	kusto
`Signer` (kusto rule field)	is_null		1 rule	kusto
`file_name` (kusto rule field)	is_not_null		1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`mmc.exe`	1 rule	kusto

References #

QueueUserApcRemoteApiCall: Remote APC queued (QueueUserApc)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`

Detection Patterns #

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORReadProcessMemoryApiCall: ReadProcessMemory API call

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Execution: User Execution

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context change

1 rule

Kusto

Suspicious Process Injection from Office application (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`createremotethreadapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntallocatevirtualmemoryremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntmapviewofsectionremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`queueuserapcremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`setthreadcontextremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`500`	1 rule	kusto
`InitiatingProcessSHA1` (kusto rule field)	is_not_null		1 rule	kusto
`Signer` (kusto rule field)	is_null		1 rule	kusto
`file_name` (kusto rule field)	is_not_null		1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`mmc.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`excel.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powerpnt.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`winword.exe`	1 rule	kusto

References #

SetThreadContextRemoteApiCall: Remote thread context change (SetThreadContext)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`

Detection Patterns #

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORReadProcessMemoryApiCall: ReadProcessMemory API call

3 rules

Kusto

Process Injection From Untrusted Process (source)

FalconForce

ADWS Connection from Process Injection Target (source)

FalconForce

Process Injection Initiated By MMC (source)

FalconForce

Execution: User Execution

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context change

1 rule

Kusto

Suspicious Process Injection from Office application (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`createremotethreadapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntallocatevirtualmemoryremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ntmapviewofsectionremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`queueuserapcremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`setthreadcontextremoteapicall`	3 rules	kusto
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`500`	1 rule	kusto
`InitiatingProcessSHA1` (kusto rule field)	is_not_null		1 rule	kusto
`Signer` (kusto rule field)	is_null		1 rule	kusto
`file_name` (kusto rule field)	is_not_null		1 rule	kusto
`parent_process_name` (kusto rule field)	in	`excel.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`powerpnt.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`winword.exe`	1 rule	kusto

References #

AsrAbusedSystemToolAudited: ASR copied or impersonated system tool (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "AsrAbusedSystemToolAudited",
  "AdditionalFields": {
    "IsAudit": true,
    "RuleId": "c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "dw_test_cmd.exe",
  "FolderPath": "C:\\DW-Lab",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-07-23T04:45:09.4639744Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFileSize": 65536,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
  "InitiatingProcessId": 4620,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 35520381,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:36.8481467Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 1284,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208165049",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
  "InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "0395d225889a29cda8c59a735c18b773",
  "ProcessCommandLine": "\"C:\\DW-Lab\\dw_test_cmd.exe\" /c exit",
  "ReportId": 5830,
  "ReportId@odata.type": "#Int64",
  "SHA1": "d75a577f0159b97dc98fa987321ce53decf52434",
  "SHA256": "ed1358cb5f7a7e4fa21e6b07ef1c6f664f0d363c60b4641aff43f5602a0b3f6e",
  "Timestamp": "2026-07-23T04:45:10.3398746Z"
}

References #

AsrAbusedSystemToolBlocked: ASR copied or impersonated system tool (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "AsrAbusedSystemToolBlocked",
  "AdditionalFields": {
    "IsAudit": false,
    "RuleId": "c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "dw_blk_cmd.exe",
  "FolderPath": "C:\\DW-Lab",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-07-23T05:07:29.5319908Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFileSize": 65536,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
  "InitiatingProcessId": 10160,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 38445042,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:36.8481467Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 1284,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208165265",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
  "InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "0395d225889a29cda8c59a735c18b773",
  "ProcessCommandLine": "\"C:\\DW-Lab\\DW_BLK~1.EXE\" \"C:\\DW-Lab\\dw_blk_cmd.exe\" /c exit",
  "ReportId": 6343,
  "ReportId@odata.type": "#Int64",
  "SHA1": "d75a577f0159b97dc98fa987321ce53decf52434",
  "SHA256": "ed1358cb5f7a7e4fa21e6b07ef1c6f664f0d363c60b4641aff43f5602a0b3f6e",
  "Timestamp": "2026-07-23T05:07:30.4460868Z"
}

References #

AsrAbusedSystemToolWarnBypassed: ASR copied or impersonated system tool (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrAdobeReaderChildProcessAudited: ASR Adobe Reader child process (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrAdobeReaderChildProcessBlocked: ASR Adobe Reader child process (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrAdobeReaderChildProcessWarnBypassed: ASR Adobe Reader child process (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrExecutableEmailContentAudited: ASR executable from email client (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrExecutableEmailContentBlocked: ASR executable from email client (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrExecutableEmailContentWarnBypassed: ASR executable from email client (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrExecutableOfficeContentAudited: ASR Office app creating executable content (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrExecutableOfficeContentBlocked: ASR Office app creating executable content (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrExecutableOfficeContentWarnBypassed: ASR Office app creating executable content (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrLsassCredentialTheftBlocked: ASR LSASS credential theft (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrObfuscatedScriptAudited: ASR obfuscated script execution (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrObfuscatedScriptBlocked: ASR obfuscated script execution (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrObfuscatedScriptWarnBypassed: ASR obfuscated script execution (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeChildProcessBlocked: ASR Office app child process (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeChildProcessWarnBypassed: ASR Office app child process (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeCommAppChildProcessAudited: ASR Office communication app child process (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeCommAppChildProcessBlocked: ASR Office communication app child process (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeCommAppChildProcessWarnBypassed: ASR Office communication app child process (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeMacroWin32ApiCallsAudited: ASR Win32 API calls from Office macros (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeMacroWin32ApiCallsBlocked: ASR Win32 API calls from Office macros (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeMacroWin32ApiCallsWarnBypassed: ASR Win32 API calls from Office macros (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeProcessInjectionAudited: ASR Office app code injection (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrOfficeProcessInjectionBlocked: ASR Office app code injection (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrPersistenceThroughWmiAudited: ASR WMI event subscription persistence (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "AsrPersistenceThroughWmiAudited",
  "AdditionalFields": {
    "IsAudit": true,
    "RuleId": "e6db77e5-3df2-4cf1-b95a-636979351e5b"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFolderPath": "C:\\Windows\\System32",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "1a7f41ba70afd1f2d027bd5f694e5e2b",
  "ReportId": 5851,
  "ReportId@odata.type": "#Int64",
  "SHA1": "b33086b5021f6f2db6e25de54149285271f5b159",
  "SHA256": "f16f2815d878b8af9dde7f1b0836da928114497d2e03b3888353ba523f3c18c1",
  "Timestamp": "2026-07-23T04:45:09.3045612Z"
}

References #

AsrPersistenceThroughWmiBlocked: ASR WMI event subscription persistence (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "AsrPersistenceThroughWmiBlocked",
  "AdditionalFields": {
    "IsAudit": false,
    "RuleId": "e6db77e5-3df2-4cf1-b95a-636979351e5b"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFolderPath": "C:\\Windows\\System32",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "5be7459714ccbb5a526c4649c5f82379",
  "ReportId": 6368,
  "ReportId@odata.type": "#Int64",
  "SHA1": "4b5d0ee1b711b652bd94de0c1bc8772978c57aee",
  "SHA256": "274eb0c49b43ff4d0d604e8a7d4fa0cde36c1edf2166877bbef6123e8c5c103e",
  "Timestamp": "2026-07-23T05:07:29.2189992Z"
}

References #

AsrPersistenceThroughWmiWarnBypassed: ASR WMI event subscription persistence (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrPsexecWmiChildProcessAudited: ASR PsExec or WMI child process (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "AsrPsexecWmiChildProcessAudited",
  "AdditionalFields": {
    "IsAudit": true,
    "RuleId": "d1e49aac-8f56-4280-b9ba-993a6d77406c"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "conhost.exe",
  "FolderPath": "C:\\Windows\\System32",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "cmd.exe /c exit",
  "InitiatingProcessCreationTime": "2026-07-23T04:45:08.2314022Z",
  "InitiatingProcessFileName": "cmd.exe",
  "InitiatingProcessFileSize": 364544,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\cmd.exe",
  "InitiatingProcessId": 12500,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 35520381,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "0395d225889a29cda8c59a735c18b773",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:42.731857Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wbem\\WmiPrvSE.exe",
  "InitiatingProcessParentId": 6520,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d75a577f0159b97dc98fa987321ce53decf52434",
  "InitiatingProcessSHA256": "ed1358cb5f7a7e4fa21e6b07ef1c6f664f0d363c60b4641aff43f5602a0b3f6e",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208165045",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Windows Command Processor",
  "InitiatingProcessVersionInfoInternalFileName": "cmd",
  "InitiatingProcessVersionInfoOriginalFileName": "Cmd.Exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.5840",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "f5a1251eed15fde7ffb83ba941695095",
  "ProcessCommandLine": "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1",
  "ReportId": 5812,
  "ReportId@odata.type": "#Int64",
  "SHA1": "713000b331602188f1f0fda13b1754e92a539776",
  "SHA256": "2266b396ef92534a2a2844438df043d4069a2ec47d4e464f55e8c1cd47124a98",
  "Timestamp": "2026-07-23T04:45:08.3777179Z"
}

References #

AsrPsexecWmiChildProcessBlocked: ASR PsExec or WMI child process (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "AsrPsexecWmiChildProcessBlocked",
  "AdditionalFields": {
    "IsAudit": false,
    "RuleId": "d1e49aac-8f56-4280-b9ba-993a6d77406c"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "cmd.exe",
  "FolderPath": "C:\\Windows\\System32",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "network service",
  "InitiatingProcessAccountSid": "S-1-5-20",
  "InitiatingProcessCommandLine": "wmiprvse.exe -secured -Embedding",
  "InitiatingProcessCreationTime": "2026-07-22T22:04:42.731857Z",
  "InitiatingProcessFileName": "WmiPrvSE.exe",
  "InitiatingProcessFileSize": 516096,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wbem\\wmiprvse.exe",
  "InitiatingProcessId": 6520,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "7528ccabaccd5c1748e63e192097472a",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:36.8481467Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1284,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "91180ed89976d16353404ac982a422a707f2ae37",
  "InitiatingProcessSHA256": "196cabed59111b6c4bbf78c84a56846d96cbbc4f06935a4fd4e6432ef0ae4083",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208162426",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "WMI Provider Host",
  "InitiatingProcessVersionInfoInternalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "0395d225889a29cda8c59a735c18b773",
  "ProcessCommandLine": "cmd.exe /c exit",
  "ReportId": 6315,
  "ReportId@odata.type": "#Int64",
  "SHA1": "d75a577f0159b97dc98fa987321ce53decf52434",
  "SHA256": "ed1358cb5f7a7e4fa21e6b07ef1c6f664f0d363c60b4641aff43f5602a0b3f6e",
  "Timestamp": "2026-07-23T05:07:26.8304733Z"
}

References #

AsrPsexecWmiChildProcessWarnBypassed: ASR PsExec or WMI child process (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrRansomwareAudited: ASR ransomware activity (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrRansomwareBlocked: ASR ransomware activity (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrRansomwareWarnBypassed: ASR ransomware activity (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrSafeModeRebootedAudited: ASR Safe mode reboot configuration (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrSafeModeRebootBlocked: ASR Safe mode reboot configuration (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrSafeModeRebootWarnBypassed: ASR Safe mode reboot configuration (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrScriptExecutableDownloadAudited: ASR script launching downloaded executable (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrScriptExecutableDownloadBlocked: ASR script launching downloaded executable (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrScriptExecutableDownloadWarnBypassed: ASR script launching downloaded executable (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrUntrustedExecutableBlocked: ASR untrusted executable (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

ASR Rare and Untrusted Executables source: Below query shows Untrusted executables that are seen on few devices (LocalPrevalence). It requires the below ASR rule to be configured and Cloud-delivered protection to be enabled.
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
You may need to exclude software development users/machines/folders.↳ also matches AsrUntrustedExecutableAudited: ASR untrusted executable (audited)

References #

AsrUntrustedExecutableWarnBypassed: ASR untrusted executable (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrUntrustedUsbProcessAudited: ASR untrusted process from USB (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrUntrustedUsbProcessBlocked: ASR untrusted process from USB (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrUntrustedUsbProcessWarnBypassed: ASR untrusted process from USB (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrVulnerableSignedDriverAudited: ASR vulnerable signed driver (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrVulnerableSignedDriverBlocked: ASR vulnerable signed driver (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrVulnerableSignedDriverWarnBypassed: ASR vulnerable signed driver (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AsrWebShellOnServerAudited: ASR webshell creation on Windows Server (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrWebShellOnServerBlocked: ASR webshell creation on Windows Server (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AsrWebShellWarnBypassed: ASR webshell creation (warn bypassed)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AppControlAppInstallationAudited: AppControl app installation (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlAppInstallationBlocked: AppControl app installation (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCIScriptAudited: AppControl Config CI script (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCIScriptBlocked: AppControl Config CI script (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityDriverRevoked: AppControl Code Integrity driver revoked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityImageAudited: AppControl Code Integrity image (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityImageRevoked: AppControl Code Integrity image revoked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityOriginAllowed: AppControl Code Integrity origin allowed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityOriginAudited: AppControl Code Integrity origin (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityOriginBlocked: AppControl Code Integrity origin (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityPolicyAudited: AppControl Code Integrity policy (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityPolicyBlocked: AppControl Code Integrity policy (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegrityPolicyLoaded: AppControl Code Integrity policy loaded

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlCodeIntegritySigningInformation: AppControl Code Integrity signing information

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "AppControlCodeIntegritySigningInformation",
  "AdditionalFields": {
    "IssuerName": "Unknown",
    "NotValidAfter": "0001-01-01T00:00:00",
    "NotValidBefore": "0001-01-01T00:00:00",
    "PublisherName": "Unknown",
    "SignatureType": "Unsigned or verification has not been attempted",
    "TotalSignatureCount": 0,
    "ValidatedSigningLevel": "Not yet checked",
    "VerificationError": "Successfully verified signature",
    "Signature": 0,
    "Hash": "d4e5d78e6e6800abf07ee7241336bcef20c81a76",
    "Flags": 0,
    "PolicyBits": 0,
    "EtwActivityId": "8fbbb2c3-2150-0009-c4e9-bb8f5021dd01"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5697,
  "ReportId@odata.type": "#Int64",
  "SHA1": "d4e5d78e6e6800abf07ee7241336bcef20c81a76",
  "Timestamp": "2026-08-01T08:17:07.9499575Z"
}

References #

AppControlExecutableAudited: AppControl executable (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlExecutableBlocked: AppControl executable (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlPackagedAppAudited: AppControl packaged app (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlPackagedAppBlocked: AppControl packaged app (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlPolicyApplied: AppControl policy applied

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "AppControlPolicyApplied",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"appidpolicyconverter.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T01:08:27.7477852Z",
  "InitiatingProcessFileName": "appidpolicyconverter.exe",
  "InitiatingProcessFileSize": 163840,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\appidpolicyconverter.exe",
  "InitiatingProcessId": 4772,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "bc0664d032fe58e5d307b9ff7d6ab0e2",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:17.7717067Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 2616,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "bdbf3a4326cdea4a2063d3f94de229d4d05b262c",
  "InitiatingProcessSHA256": "2a429fb1aa72c723957b40b648e927653d0c497a985489fa5b0e59737356bb83",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394477422",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "AppID Policy Converter Task",
  "InitiatingProcessVersionInfoInternalFileName": "AppIDPolicyConverter.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "AppIDPolicyConverter.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.2849",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5208,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T01:08:27.953971Z"
}

References #

AppControlScriptAudited: AppControl script (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppControlScriptBlocked: AppControl script (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AppGuardBrowseToUrl: Application Guard browse to URL

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AppGuardContainerId`
`RemoteUrl`
`InitiatingProcessFileName`

References #

AppGuardCreateContainer: Application Guard container created

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AppGuardContainerId`
`InitiatingProcessFileName`

References #

AppGuardLaunchedWithUrl: Application Guard launched with URL

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AppGuardContainerId`
`RemoteUrl`
`InitiatingProcessFileName`

References #

AppGuardResumeContainer: Application Guard container resumed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AppGuardContainerId`
`InitiatingProcessFileName`

References #

AppGuardStopContainer: Application Guard container stopped

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AppGuardContainerId`
`InitiatingProcessFileName`

References #

AppGuardSuspendContainer: Application Guard container suspended

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AppGuardContainerId`
`InitiatingProcessFileName`

References #

AppLockerBlockExecutable: AppLocker blocked executable

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`

References #

AppLockerBlockPackagedApp: AppLocker blocked packaged app

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`

References #

AppLockerBlockPackagedAppInstallation: AppLocker blocked packaged app installation

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`

References #

AppLockerBlockScript: AppLocker blocked script

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`

References #

ControlFlowGuardViolation: Control Flow Guard violation

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`AdditionalFields`

References #

ExploitGuardAcgAudited: Exploit Guard ACG (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "ExploitGuardAcgAudited",
  "AdditionalFields": {
    "IsAudit": true
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"dwexgtest.exe\"",
  "InitiatingProcessCreationTime": "2026-07-23T01:31:07.5217439Z",
  "InitiatingProcessFileName": "dwexgtest.exe",
  "InitiatingProcessFileSize": 4096,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\dw-mitig-lab\\dwexgtest.exe",
  "InitiatingProcessId": 7992,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 22452738,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "31f41c2f97d84d98e46cdd21e177e918",
  "InitiatingProcessParentCreationTime": "2026-07-23T01:31:06.5715553Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wsmprovhost.exe",
  "InitiatingProcessParentId": 10288,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "42920f5b555dec20bb478103e7c3829a2ea0041a",
  "InitiatingProcessSHA256": "0df80c88be2fae7fc12cb76ad07d1817fa697e446c93c8d9ea16cd0202d766dc",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208164047",
  "InitiatingProcessVersionInfoFileDescription": " ",
  "InitiatingProcessVersionInfoInternalFileName": "dwexgtest.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "dwexgtest.exe",
  "InitiatingProcessVersionInfoProductVersion": "0.0.0.0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 4178,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T01:31:07.675509Z"
}

References #

ExploitGuardAcgEnforced: Exploit Guard ACG (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardChildProcessAudited: Exploit Guard child process (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "ExploitGuardChildProcessAudited",
  "AdditionalFields": {
    "ChildCommandLine": "\"cmd.exe\" /c exit",
    "IsAudit": true
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "cmd.exe",
  "FolderPath": "C:\\Windows\\SYSTEM32",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"dwexgtest.exe\" spawn",
  "InitiatingProcessCreationTime": "2026-07-23T01:31:05.7465151Z",
  "InitiatingProcessFileName": "dwexgtest.exe",
  "InitiatingProcessFileSize": 4096,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\dw-mitig-lab\\dwexgtest.exe",
  "InitiatingProcessId": 12620,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 22452738,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "31f41c2f97d84d98e46cdd21e177e918",
  "InitiatingProcessParentCreationTime": "2026-07-23T01:31:04.8243481Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wsmprovhost.exe",
  "InitiatingProcessParentId": 12816,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "42920f5b555dec20bb478103e7c3829a2ea0041a",
  "InitiatingProcessSHA256": "0df80c88be2fae7fc12cb76ad07d1817fa697e446c93c8d9ea16cd0202d766dc",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208164042",
  "InitiatingProcessVersionInfoFileDescription": " ",
  "InitiatingProcessVersionInfoInternalFileName": "dwexgtest.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "dwexgtest.exe",
  "InitiatingProcessVersionInfoProductVersion": "0.0.0.0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ProcessCommandLine": "\"cmd.exe\" /c exit",
  "ReportId": 4165,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T01:31:06.4663637Z"
}

References #

ExploitGuardChildProcessBlocked: Exploit Guard child process (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardEafViolationAudited: Exploit Guard EAF violation (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardEafViolationBlocked: Exploit Guard EAF violation (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardIafViolationAudited: Exploit Guard IAF violation (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardIafViolationBlocked: Exploit Guard IAF violation (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardLowIntegrityImageAudited: Exploit Guard low-integrity image (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "ExploitGuardLowIntegrityImageAudited",
  "AdditionalFields": {
    "IsAudit": true
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "dwnoop.dll",
  "FolderPath": "\\ProgramData\\dw-mitig-lab",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"dwexgtest.exe\" load C:\\ProgramData\\dw-mitig-lab\\dwnoop.dll",
  "InitiatingProcessCreationTime": "2026-07-23T01:31:12.7818236Z",
  "InitiatingProcessFileName": "dwexgtest.exe",
  "InitiatingProcessFileSize": 4096,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\dw-mitig-lab\\dwexgtest.exe",
  "InitiatingProcessId": 11684,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 22452738,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "31f41c2f97d84d98e46cdd21e177e918",
  "InitiatingProcessParentCreationTime": "2026-07-23T01:31:11.7747399Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wsmprovhost.exe",
  "InitiatingProcessParentId": 7956,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "42920f5b555dec20bb478103e7c3829a2ea0041a",
  "InitiatingProcessSHA256": "0df80c88be2fae7fc12cb76ad07d1817fa697e446c93c8d9ea16cd0202d766dc",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208164055",
  "InitiatingProcessVersionInfoFileDescription": " ",
  "InitiatingProcessVersionInfoInternalFileName": "dwexgtest.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "dwexgtest.exe",
  "InitiatingProcessVersionInfoProductVersion": "0.0.0.0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 4209,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T01:31:13.1017459Z"
}

References #

ExploitGuardLowIntegrityImageBlocked: Exploit Guard low-integrity image (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardNetworkProtectionAudited: Exploit Guard Network Protection (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`RemoteUrl`
`RemoteIP`
`AdditionalFields`

References #

ExploitGuardNetworkProtectionBlocked: Exploit Guard Network Protection (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`RemoteUrl`
`RemoteIP`
`AdditionalFields`

References #

ExploitGuardNonMicrosoftSignedAudited: Exploit Guard non-Microsoft signed image (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardNonMicrosoftSignedBlocked: Exploit Guard non-Microsoft signed image (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "ExploitGuardNonMicrosoftSignedBlocked",
  "AdditionalFields": {
    "IsAudit": false
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "rpcFireWall.dll",
  "FolderPath": "\\Windows\\System32",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"OpenHandleCollector.exe\" ",
  "InitiatingProcessCreationTime": "2026-08-01T08:15:35.2265366Z",
  "InitiatingProcessFileName": "OpenHandleCollector.exe",
  "InitiatingProcessFileSize": 1696056,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\microsoft\\windows defender advanced threat protection\\datacollection\\8839.16303704.0.16303704-4b96f2c9f5db19279947c6a0df09015eeaa745c1\\openhandlecollector.exe",
  "InitiatingProcessId": 4452,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "39459e53e28c2143b25a874316a4512a",
  "InitiatingProcessParentCreationTime": "2026-08-01T08:15:30.4504791Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
  "InitiatingProcessParentId": 5340,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "2db8d47c58dfdc4ac9ce43712742b1dd8e779b2c",
  "InitiatingProcessSHA256": "c4aab935ae4f1366edfb8b08f43a16c31d380c413e57ded6d4a390865bc9d5de",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184873521",
  "InitiatingProcessVersionInfoCompanyName": "OpenHandleCollector",
  "InitiatingProcessVersionInfoFileDescription": "OpenHandleCollector",
  "InitiatingProcessVersionInfoInternalFileName": "OpenHandleCollector.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "OpenHandleCollector.exe",
  "InitiatingProcessVersionInfoProductName": "OpenHandleCollector",
  "InitiatingProcessVersionInfoProductVersion": "1.0.0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5546,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:15:37.036959Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

TEARDROP memory-only dropper source high: Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82fT1027, T1059, T1543

References #

ExploitGuardRopExploitAudited: Exploit Guard ROP exploit (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardRopExploitBlocked: Exploit Guard ROP exploit (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardSharedBinaryAudited: Exploit Guard shared binary load (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardSharedBinaryBlocked: Exploit Guard shared binary load (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

ExploitGuardWin32SystemCallAudited: Exploit Guard Win32k system-call (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

Example Event #

{
  "ActionType": "ExploitGuardWin32SystemCallAudited",
  "AdditionalFields": {
    "IsAudit": true
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"notepad.exe\" ",
  "InitiatingProcessCreationTime": "2026-07-23T01:31:08.7165216Z",
  "InitiatingProcessFileName": "notepad.exe",
  "InitiatingProcessFileSize": 360448,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\notepad.exe",
  "InitiatingProcessId": 8156,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 22452738,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "d43b8f81cebb77c7d7c21846cc9fc38e",
  "InitiatingProcessParentCreationTime": "2026-07-23T01:31:07.7331328Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wsmprovhost.exe",
  "InitiatingProcessParentId": 8244,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "e324bfd9c8c132442fbc1016e578a0f4cb25c068",
  "InitiatingProcessSHA256": "49f096cbf9337b0a80bde835d29be41bc9371057c4ff6c72f8a36158c29cfa3a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208164051",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Notepad",
  "InitiatingProcessVersionInfoInternalFileName": "Notepad",
  "InitiatingProcessVersionInfoOriginalFileName": "NOTEPAD.EXE",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.5415",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 4187,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T01:31:08.8309777Z"
}

References #

ExploitGuardWin32SystemCallBlocked: Exploit Guard Win32k system-call (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`InitiatingProcessFileName`
`FileName`
`FolderPath`
`AdditionalFields`

References #

AntivirusDefinitionsUpdateFailed: Antivirus definitions update failed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

References #

AntivirusDefinitionsUpdated: Antivirus definitions updated

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

References #

AntivirusDetection: Antivirus detection

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "AntivirusDetection",
  "AdditionalFields": {
    "ThreatName": "Virus:Win32/MpTest!amsi",
    "WasExecutingWhileDetected": true,
    "Action": 0,
    "SignatureName": "Virus:Win32/MpTest!amsi",
    "IsConcrete": true,
    "ReportSource": "WindowsDefender"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "amsistream-164F9B3E796F5D0301CFB16964324BCC",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "9941085f1843956f2ec3cc89060beaaa",
  "ReportId": 1920636245,
  "ReportId@odata.type": "#Int64",
  "SHA1": "de608f5e186081ff474c9d0c2b36a258e1d5d61b",
  "Timestamp": "2026-07-23T04:47:09.1679Z"
}

References #

AntivirusEmergencyUpdatesInstalled: Antivirus emergency updates installed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

References #

AntivirusError: Antivirus error

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

References #

AntivirusMalwareActionFailed: Antivirus malware action failed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`AdditionalFields`

References #

AntivirusMalwareBlocked: Antivirus malware blocked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AntivirusScanCancelled: Antivirus scan cancelled

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

Example Event #

{
  "ActionType": "AntivirusScanCancelled",
  "AdditionalFields": {
    "Domain": "NT AUTHORITY",
    "ScanId": "{58F6D2FD-3A7E-40D6-B58C-182CE2BC483E}",
    "ScanParametersIndex": "1",
    "ScanTypeIndex": "Quick",
    "User": "SYSTEM"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"MsMpEng.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:25.907956Z",
  "InitiatingProcessFileName": "msmpeng.exe",
  "InitiatingProcessFileSize": 290704,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.26060.3008-0\\msmpeng.exe",
  "InitiatingProcessId": 3776,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "bfa930edc3aea262d3a74e71263f6e41",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:12.0633947Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1232,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d94df701fb5f2e89d902e8bcef19b8d52a12b65a",
  "InitiatingProcessSHA256": "35979bf35eea166dd17d81b50ceae41043e4ae1082f4ed25383adffd9d88de4a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394477174",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Antimalware Service Executable",
  "InitiatingProcessVersionInfoInternalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "4.18.26060.3008",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 6479,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T01:12:38.5137192Z"
}

References #

AntivirusScanCompleted: Antivirus scan completed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

Example Event #

{
  "ActionType": "AntivirusScanCompleted",
  "AdditionalFields": {
    "Domain": "NT AUTHORITY",
    "ScanId": "{54CFC4F1-20B2-40E8-953A-15EE5E5AA948}",
    "ScanParametersIndex": "1",
    "ScanTypeIndex": "Quick",
    "User": "SYSTEM"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"MsMpEng.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:25.907956Z",
  "InitiatingProcessFileName": "msmpeng.exe",
  "InitiatingProcessFileSize": 290704,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.26060.3008-0\\msmpeng.exe",
  "InitiatingProcessId": 3776,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "bfa930edc3aea262d3a74e71263f6e41",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:12.0633947Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1232,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d94df701fb5f2e89d902e8bcef19b8d52a12b65a",
  "InitiatingProcessSHA256": "35979bf35eea166dd17d81b50ceae41043e4ae1082f4ed25383adffd9d88de4a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394477174",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Antimalware Service Executable",
  "InitiatingProcessVersionInfoInternalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "4.18.26060.3008",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 24274,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T04:21:58.0652744Z"
}

References #

AntivirusScanFailed: Antivirus scan failed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

References #

AntivirusTroubleshootModeEvent: Antivirus troubleshoot mode state change

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

References #

ControlledFolderAccessViolationAudited: Controlled folder access violation (audited)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

Example Event #

{
  "ActionType": "ControlledFolderAccessViolationAudited",
  "AdditionalFields": {
    "IsAudit": true,
    "RuleId": "5737d832-9e2c-4922-9623-48a220290dcb"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "dwh_cfa",
  "FolderPath": "C:\\Windows\\TEMP",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-07-23T00:05:54.1903138Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFileSize": 65536,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
  "InitiatingProcessId": 3296,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 13511747,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:36.8481467Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 1284,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9570149208163322",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
  "InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "378e99507c40ac1c4efa6d37a71ac706",
  "ReportId": 3296,
  "ReportId@odata.type": "#Int64",
  "SHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "SHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "Timestamp": "2026-07-23T00:06:02.3976177Z"
}

References #

ControlledFolderAccessViolationBlocked: Controlled folder access violation (blocked)

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

References #

FirewallInboundConnectionBlocked: Firewall inbound connection blocked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "FirewallInboundConnectionBlocked",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCreationTime": "2026-07-19T17:22:23.4983439Z",
  "InitiatingProcessFileName": "ntoskrnl.exe",
  "InitiatingProcessFileSize": 12080544,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\ntoskrnl.exe",
  "InitiatingProcessId": 4,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "7f51b4fec9c32bcb910365ce68ae492e",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "a92ba6de8966d5b1f0866951832e8ca62ebe6129",
  "InitiatingProcessSHA256": "3255a69b65c23e1356b247aa8c05e93f6a4868268c878952af60c520d887596b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9288674231451649",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "NT Kernel & System",
  "InitiatingProcessVersionInfoInternalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.6060",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.255",
  "LocalPort": 138,
  "RemoteIP": "10.2.10.11",
  "RemotePort": 138,
  "ReportId": 50549,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-22T21:45:38.0603033Z"
}

References #

FirewallInboundConnectionToAppBlocked: Firewall inbound connection to app blocked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "FirewallInboundConnectionToAppBlocked",
  "AdditionalFields": {
    "Profiles": "(null)"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessCreationTime": "2026-03-17T19:08:54.6711979Z",
  "InitiatingProcessFileName": "microsoft.identityserver.servicehost.exe",
  "InitiatingProcessFolderPath": "C:\\windows\\adfs",
  "InitiatingProcessMD5": "37eda1260ab9e389427b04ba2ea837f9",
  "InitiatingProcessSHA1": "e07c665a9707c197d4f8febffe7117f492ed0cbc",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 3024,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T01:05:02.7172671Z"
}

References #

FirewallOutboundConnectionBlocked: Firewall outbound connection blocked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`InitiatingProcessFileName`
`AdditionalFields`

Example Event #

{
  "ActionType": "FirewallOutboundConnectionBlocked",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "network service",
  "InitiatingProcessAccountSid": "S-1-5-20",
  "InitiatingProcessCommandLine": "svchost.exe -k NetworkService -p",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.0752007Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 1540,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184872980",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 61865,
  "RemoteIP": "203.0.113.10",
  "RemotePort": 80,
  "ReportId": 14032,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T07:29:01.9365966Z"
}

References #

FirewallServiceStopped: Firewall service stopped

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`

References #

NetworkProtectionUserBypassEvent: Network protection user bypass

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`InitiatingProcessFileName`
`AdditionalFields`

References #

NetworkShareObjectAccessChecked: Network share object access checked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`AccountName`
`AccountDomain`
`AdditionalFields`

References #

NetworkShareObjectAdded: Network share object added

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`AccountName`
`AccountDomain`
`AdditionalFields`

References #

NetworkShareObjectDeleted: Network share object deleted

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`AccountName`
`AccountDomain`
`AdditionalFields`

References #

NetworkShareObjectModified: Network share object modified

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`AccountName`
`AccountDomain`
`AdditionalFields`

References #

SmartScreenAppWarning: SmartScreen app warning

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`SHA256`
`InitiatingProcessFileName`
`AdditionalFields`

References #

SmartScreenExploitWarning: SmartScreen exploit warning

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`InitiatingProcessFileName`
`AdditionalFields`

References #

SmartScreenUrlWarning: SmartScreen URL warning

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`InitiatingProcessFileName`
`AdditionalFields`

References #

SmartScreenUserOverride: SmartScreen user override

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`FileName`
`InitiatingProcessFileName`
`AdditionalFields`

References #

AccountCheckedForBlankPassword: Account checked for blank password

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

References #

AuditPolicyModification: Audit policy modified

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "domainadmin",
  "AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "ActionType": "AuditPolicyModification",
  "AdditionalFields": {
    "AuditPolicyChanges": "%%8449, %%8451",
    "CategoryId": "%%8279",
    "SubcategoryGuid": "0cce923e-69ae-11d9-bed3-505054503030",
    "SubcategoryId": "%%14083"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"auditpol.exe\" /set /category:* /success:enable /failure:enable",
  "InitiatingProcessCreationTime": "2026-08-01T08:19:21.7545711Z",
  "InitiatingProcessFileName": "auditpol.exe",
  "InitiatingProcessFileSize": 57344,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\auditpol.exe",
  "InitiatingProcessId": 2636,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 9053762,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "24267a44ee6ff87e41500ce0ca87b405",
  "InitiatingProcessParentCreationTime": "2026-08-01T08:19:19.2153723Z",
  "InitiatingProcessParentFileName": "wsmprovhost.exe",
  "InitiatingProcessParentId": 8484,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "2e7a083a4f32519d13481f439034bb9ca3bf5b00",
  "InitiatingProcessSHA256": "cdeff13f4ef1f7dd953d4496d253f6e7dddf53d60d0797f66fc249cdf4aada8b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184873552",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Audit Policy Program",
  "InitiatingProcessVersionInfoInternalFileName": "auditpol",
  "InitiatingProcessVersionInfoOriginalFileName": "AUDITPOL.EXE",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 9053762,
  "LogonId@odata.type": "#Int64",
  "ReportId": 5771,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:23.450189Z"
}

References #

BitLockerAuditCompleted: BitLocker audit completed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

BluetoothPolicyTriggered: Bluetooth policy triggered

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

BrowserLaunchedToOpenUrl: Browser launched to open URL

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "BrowserLaunchedToOpenUrl",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW invsvc -cv:WL0XVRkSk0afYRMr.0.1.2",
  "InitiatingProcessCreationTime": "2026-08-01T08:04:33.530343Z",
  "InitiatingProcessFileName": "compattelrunner.exe",
  "InitiatingProcessFileSize": 346456,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\compattelrunner.exe",
  "InitiatingProcessId": 2136,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "72c24d2783bb0dc8aa0e211d317d6fc3",
  "InitiatingProcessParentCreationTime": "2026-08-01T08:02:24.3140058Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 2276,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "f46b6c098f3c01fe326f38d23f484b8d88a1ad01",
  "InitiatingProcessSHA256": "5a439de9b2bc4b0f094db118ef1f12f3dec67795d10b3e3e901db3cdd55dc821",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184873421",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft Compatibility Telemetry",
  "InitiatingProcessVersionInfoInternalFileName": "CompatTelRunner.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "CompatTelRunner.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.5983",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "RemoteUrl": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Kits\\Windows Performance Toolkit\\Windows Performance Recorder.lnk",
  "ReportId": 4167,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:04:54.3182479Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`DestinationHostname` (kusto rule field)	is_not_null		1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Possible Phishing with CSL and Network Sessions source medium: This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. If your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.T1102, T1566

References #

BruteForceActivityDetected: Brute force activity detected

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`RemoteIP`
`AdditionalFields`

References #

CertificateServicesApprovedCertificateRequest: Certificate Services approved certificate request

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "domainadmin",
  "ActionType": "CertificateServicesApprovedCertificateRequest",
  "AdditionalFields": {
    "RequestId": "48",
    "Requester": "ludus\\domainadmin",
    "Attributes": "\ncdc:JD-DC01-2022.ludus.domain\nrmd:JD-DC01-2022.ludus.domain\n\nccm:JD-DC01-2022.ludus.domain",
    "Disposition": "3",
    "SubjectKeyIdentifier": "3b 0a 55 f6 7a 47 5a 7a 4b 9d af 3f ba cf e0 d4 6c ec 6e 6c",
    "Subject": "CN=domainadmin, CN=Users, DC=ludus, DC=domain",
    "SubjectAlternativeName": "Other Name:\n     Principal Name=domainadmin@ludus.domain\r\n",
    "CertificateTemplate": "User",
    "SerialNumber": "6100000030c2e7d08bc9eb7bd7000000000030",
    "AuthenticationService": "NTLM",
    "AuthenticationLevel": "Privacy",
    "DCOMorRPC": "DCOM"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 206618,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T04:50:01.1091295Z"
}

References #

CertificateServicesLoadedTemplate: Certificate Services loaded template

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "CertificateServicesLoadedTemplate",
  "AdditionalFields": {
    "TemplateInternalName": "Administrator",
    "TemplateVersion": "4.1",
    "TemplateSchemaVersion": "1",
    "TemplateOID": " ",
    "TemplateDSObjectFQDN": "CN=Administrator,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ludus,DC=domain",
    "DCDNSName": "JD-DC01-2022.ludus.domain",
    "TemplateContent": "\nflags = 0x1023a (66106)\n  CT_FLAG_ADD_EMAIL -- 0x2\n  CT_FLAG_PUBLISH_TO_DS -- 0x8\n  CT_FLAG_EXPORTABLE_KEY -- 0x10 (16)\n  CT_FLAG_AUTO_ENROLLMENT -- 0x20 (32)\n  CT_FLAG_ADD_TEMPLATE_NAME -- 0x200 (512)\n  CT_FLAG_IS_DEFAULT -- 0x10000 (65536)\n\nmsPKI-Private-Key-Flag = 0x10 (16)\n  CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 0x10 (16)\n  CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0x0\n  TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0x0\n  TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0x0\n\nmsPKI-Certificate-Name-Flag = 0xa6000000 (2785017856)\n  CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 0x2000000 (33554432)\n  CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL -- 0x4000000 (67108864)\n  CT_FLAG_SUBJECT_REQUIRE_EMAIL -- 0x20000000 (536870912)\n  CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 0x80000000 (2147483648)\n\nmsPKI-Enrollment-Flag = 0x29 (41)\n  CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 0x1\n  CT_FLAG_PUBLISH_TO_DS -- 0x8\n  CT_FLAG_AUTO_ENROLLMENT -- 0x20 (32)\n\nmsPKI-Template-Schema-Version = 1\n\nrevision = 4\n\nmsPKI-Template-Minor-Revision = 1\n\npKIDefaultKeySpec = 1\n\npKIExpirationPeriod = 1 Years\n\npKIOverlapPeriod = 6 Weeks\n\ncn = Administrator\n\ndistinguishedName = Administrator\n\npKIKeyUsage = a0\n\ndisplayName = Administrator\n\ntemplateDescription = User\n\npKIExtendedKeyUsage =\n  203.0.113.10.4.1.311.10.3.1 Microsoft Trust List Signing\n  203.0.113.10.4.1.311.10.3.4 Encrypting File System\n  203.0.113.10.203.0.113.10.4 Secure Email\n  203.0.113.10.203.0.113.10.2 Client Authentication\n\npKIDefaultCSPs =\n  Microsoft Enhanced Cryptographic Provider v1.0\n  Microsoft Base Cryptographic Provider v1.0\n\nmsPKI-Supersede-Templates =\n\nmsPKI-RA-Policies =\n\nmsPKI-RA-Application-Policies =\n\nmsPKI-Certificate-Policy =\n\nmsPKI-Certificate-Application-Policy =\n\npKICriticalExtensions =\n  203.0.113.10 Key Usage\n",
    "SecurityDescriptor": "O:S-1-5-21-1006758700-2167138679-1475694448-519G:S-1-5-21-1006758700-2167138679-1475694448-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1006758700-2167138679-1475694448-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1006758700-2167138679-1475694448-519)(A;;LCRPLORC;;;AU)\n\nAllow\tludus\\Domain Admins\n\tEnroll\nAllow\tludus\\Enterprise Admins\n\tEnroll\nAllow(0x000f00ff)\tludus\\Domain Admins\n\tFull Control\nAllow(0x000f00ff)\tludus\\Enterprise Admins\n\tFull Control\nAllow(0x00020094)\tNT AUTHORITY\\Authenticated Users\n\tRead\n"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 206593,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T04:50:01.0107999Z"
}

References #

CertificateServicesReceivedCertificateRequest: Certificate Services received certificate request

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "domainadmin",
  "ActionType": "CertificateServicesReceivedCertificateRequest",
  "AdditionalFields": {
    "RequestId": "48",
    "Requester": "ludus\\domainadmin",
    "Attributes": "\ncdc:JD-DC01-2022.ludus.domain\nrmd:JD-DC01-2022.ludus.domain\n\nccm:JD-DC01-2022.ludus.domain",
    "CertificateTemplate": "User",
    "RequestOSVersion": "10.0.20348.2",
    "RequestCSPProvider": "Microsoft Enhanced Cryptographic Provider v1.0",
    "RequestClientInfo": "\n\tClientId: 0x5\n\tUser: ludus\\domainadmin\n\tMachine: JD-DC01-2022.ludus.domain\n\tProcess: wsmprovhost.exe",
    "AuthenticationService": "NTLM",
    "AuthenticationLevel": "Privacy",
    "DCOMorRPC": "DCOM"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 206491,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T04:50:00.5750471Z"
}

References #

CredentialsBackup: Credentials backed up

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

DeviceBootAttestationInfo: Device boot attestation info

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

DirectoryServiceObjectCreated: Directory Service object created

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "DirectoryServiceObjectCreated",
  "AdditionalFields": {
    "DSName": "ludus.domain",
    "ObjectClass": "groupPolicyContainer",
    "ObjectDN": "CN={7741B396-B5B8-4AD4-ABD2-654E62F72C1B},CN=Policies,CN=System,DC=ludus,DC=domain"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessLogonId": 467547745,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 307669,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-26T01:17:28.5808186Z"
}

References #

DirectoryServiceObjectModified: Directory Service object modified

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

References #

DnsQueryResponse: DNS query response

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "DnsQueryResponse",
  "AdditionalFields": {
    "DnsQueryString": "download.windowsupdate.com",
    "DnsQueryResult": [
      {
        "DnsQueryType": "CNAME",
        "Result": "download.windowsupdate.com.delivery.microsoft.com"
      },
      {
        "DnsQueryType": "CNAME",
        "Result": "wu-f-net.trafficmanager.net"
      },
      {
        "DnsQueryType": "CNAME",
        "Result": "cl-glcb907925.globalcdn.co"
      },
      {
        "DnsQueryType": "NS",
        "Result": "gns1.globalcdn.co"
      },
      {
        "DnsQueryType": "NS",
        "Result": "gns2.globalcdn.media"
      }
    ],
    "ClientProcessName": "NisSrv.exe",
    "ClientProcessId": "9348"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "network service",
  "InitiatingProcessAccountSid": "S-1-5-20",
  "InitiatingProcessCommandLine": "svchost.exe -k NetworkService -p",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.4619378Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 948,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184872994",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 4591,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:06:29.3962068Z"
}

References #

DpapiAccessed: DPAPI accessed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "DpapiAccessed",
  "AdditionalFields": {
    "CallerProcessID": 3780,
    "Flags": "CRYPTPROTECT_UI_FORBIDDEN & CRYPTPROTECT_LOCAL_MACHINE",
    "MasterKeyGUID": "cb39d085-fd7f-4553-8b32-3c3a870aa6e7",
    "OperationType": "SPCryptUnprotect",
    "ProtectionFlags": "CRYPTPROTECT_LOCAL_MACHINE",
    "ReturnValue": 0
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileSize": 2918,
  "FileSize@odata.type": "#Int64",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "wmiprvse.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T09:32:33.3639393Z",
  "InitiatingProcessFileName": "wmiprvse.exe",
  "InitiatingProcessFileSize": 507904,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wbem\\wmiprvse.exe",
  "InitiatingProcessId": 3780,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "90815c0783bc9f9f6d96862c25c192bf",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:15.7271138Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1512,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "4d70bdf57f36cd27925fbda50b4cad05d0ccb64f",
  "InitiatingProcessSHA256": "1792731e030b7fe35a7eb21c9f907eae6e4ac381de918003f2709185c4ce0a5a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394480683",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "WMI Provider Host",
  "InitiatingProcessVersionInfoInternalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1060991,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:32:33.5904775Z"
}

References #

ExternalDeviceConnected: External device connected

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

ExternalDeviceDisconnected: External device disconnected

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

FileTimestampModificationEvent: File timestamp modified

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`InitiatingProcessFileName`

References #

GetAsyncKeyStateApiCall: GetAsyncKeyState API call

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

References #

GetClipboardData: GetClipboardData API call

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

References #

LogonRightsSettingEnabled: Logon rights setting enabled

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

References #

NtAllocateVirtualMemoryApiCall: NtAllocateVirtualMemory API call

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

Example Event #

{
  "ActionType": "NtAllocateVirtualMemoryApiCall",
  "AdditionalFields": {
    "BaseAddress": 140723302821888,
    "RegionSize": 126976,
    "ProtectionMask": 64
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "local service",
  "InitiatingProcessAccountSid": "S-1-5-19",
  "InitiatingProcessCommandLine": "powershell.exe -ExecutionPolicy AllSigned -NoProfile -NonInteractive -Command \"& {if ($ExecutionContext.SessionState.LanguageMode -eq 'FullLanguage') {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8}else {chcp 65001}; &  'C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\8839.16303704.0.16303704-5f5096cb0103a544770ceb0d48a57218d4681b26\\efc69106-6fc1-423a-94ef-221e65a28f09.ps1' }\"",
  "InitiatingProcessCreationTime": "2026-08-01T09:07:58.3560941Z",
  "InitiatingProcessFileName": "powershell.exe",
  "InitiatingProcessFileSize": 450560,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
  "InitiatingProcessId": 12916,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 997,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "dd6f4b7818a253887b8ea86515f6fb7d",
  "InitiatingProcessParentCreationTime": "2026-08-01T09:07:47.890028Z",
  "InitiatingProcessParentFileName": "SenseIR.exe",
  "InitiatingProcessParentId": 10648,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3e72bef25a1cd88c502421e3d50a8eb4c6bd1226",
  "InitiatingProcessSHA256": "38f4384643b3fa0de714d2367b712c2e0fa1c89e2cfd131ae6b831ad962b1033",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394480647",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Windows PowerShell",
  "InitiatingProcessVersionInfoInternalFileName": "POWERSHELL",
  "InitiatingProcessVersionInfoOriginalFileName": "PowerShell.EXE",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.2849",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1061109,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:32:54.0301084Z"
}

Detection Patterns #

1 rule

Kusto

ADWS Connection from Process Injection Target (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`createremotethreadapicall`	1 rule	kusto
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	1 rule	kusto
`ActionType` (kusto rule field)	in	`ntallocatevirtualmemoryremoteapicall`	1 rule	kusto
`ActionType` (kusto rule field)	in	`ntmapviewofsectionremoteapicall`	1 rule	kusto
`ActionType` (kusto rule field)	in	`queueuserapcremoteapicall`	1 rule	kusto
`ActionType` (kusto rule field)	in	`setthreadcontextremoteapicall`	1 rule	kusto
`file_name` (kusto rule field)	is_not_null		1 rule	kusto

References #

NtProtectVirtualMemoryApiCall: NtProtectVirtualMemory API call

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

Example Event #

{
  "ActionType": "NtProtectVirtualMemoryApiCall",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"SDXHelper.exe\" -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T08:02:30.4049218Z",
  "InitiatingProcessFileName": "sdxhelper.exe",
  "InitiatingProcessFileSize": 313624,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files\\microsoft office\\root\\office16\\sdxhelper.exe",
  "InitiatingProcessId": 8944,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "c7a9f17a886814ce7919796448937a82",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:36.1647611Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1288,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "a6e03c89f96546aa3920415b71cb51a9352ef731",
  "InitiatingProcessSHA256": "9a20c81bfcd9ad39be7d554203b3058b6ecf5716a4a0626f6099e92578ff1f1d",
  "InitiatingProcessSessionId": 1,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184873375",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft Office SDX Helper",
  "InitiatingProcessVersionInfoInternalFileName": "SDXHELPER",
  "InitiatingProcessVersionInfoOriginalFileName": "SDXHELPER.EXE",
  "InitiatingProcessVersionInfoProductName": "Microsoft Office",
  "InitiatingProcessVersionInfoProductVersion": "16.0.17932.20884",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1700,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:02:53.3069895Z"
}

Detection Patterns #

1 rule

Kusto

ADWS Connection from Process Injection Target (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`memoryremoteprotect`	1 rule	kusto

References #

PTraceDetected: PTrace detected

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

References #

PasswordChangeAttempt: Password change attempt

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

References #

PlistPropertyModified: Plist property modified

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

PnpDeviceAllowed: PnP device allowed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

PnpDeviceBlocked: PnP device blocked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

PnpDeviceConnected: PnP device connected

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "PnpDeviceConnected",
  "AdditionalFields": {
    "ClassName": "PrintQueue",
    "ClassId": "1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc",
    "DeviceId": "SWD\\PRINTENUM\\{168BE9DE-0227-4550-B53B-19B1BFDED2AA}",
    "DeviceDescription": "Fax",
    "VendorIds": [
      "PRINTENUM\\microsoftmicrosoft_s7d14",
      "PRINTENUM\\LocalPrintQueue",
      "microsoftmicrosoft_s7d14"
    ]
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "jd-dc01-2022$",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 26,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T01:02:28.2634338Z"
}

References #

PrintJobBlocked: Print job blocked

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

ProcessCreatedUsingWmiQuery: Process created using WMI query

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ProcessCreatedUsingWmiQuery",
  "AdditionalFields": {
    "ClientMachine": "jd-win11-22h2-1",
    "IsRemoteMachine": false
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5982,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:41.6669172Z"
}

References #

ReadProcessMemoryApiCall: ReadProcessMemory API call

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

Example Event #

{
  "AccountDomain": "nt authority",
  "AccountName": "system",
  "AccountSid": "S-1-5-18",
  "ActionType": "ReadProcessMemoryApiCall",
  "AdditionalFields": {
    "TotalBytesCopied": 435408
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileName": "lsass.exe",
  "FileSize": 84128,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\Windows\\System32",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "network service",
  "InitiatingProcessAccountSid": "S-1-5-20",
  "InitiatingProcessCommandLine": "wmiprvse.exe -secured -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:32.9324028Z",
  "InitiatingProcessFileName": "WmiPrvSE.exe",
  "InitiatingProcessFileSize": 507904,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wbem\\wmiprvse.exe",
  "InitiatingProcessId": 3504,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "90815c0783bc9f9f6d96862c25c192bf",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:15.7271138Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1512,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "4d70bdf57f36cd27925fbda50b4cad05d0ccb64f",
  "InitiatingProcessSHA256": "1792731e030b7fe35a7eb21c9f907eae6e4ac381de918003f2709185c4ce0a5a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7318349394477227",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "WMI Provider Host",
  "InitiatingProcessVersionInfoInternalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "4be1e4f6c6468a28dc00ffd4b8d412b3",
  "ProcessCreationTime": "2026-08-01T01:02:12.199103Z",
  "ProcessId": 1244,
  "ProcessId@odata.type": "#Int64",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ReportId": 1061110,
  "ReportId@odata.type": "#Int64",
  "SHA1": "3add8d4abe6365d614055a741e24ebcd9e0492ec",
  "Timestamp": "2026-08-01T09:32:54.045656Z"
}

Detection Patterns #

Stealth: Process Injection

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORReadProcessMemoryApiCall: ReadProcessMemory API call

1 rule

Kusto

Process Injection Initiated By MMC (source)

FalconForce

References #

RemoteDesktopConnection: Remote Desktop connection

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`RemoteIP`
`AdditionalFields`

References #

RemoteWmiOperation: Remote WMI operation

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

RemovableStorageFileEvent: Removable storage file event

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`InitiatingProcessFileName`

References #

RemovableStoragePolicyTriggered: Removable storage policy triggered

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

SafeDocFileScan: Safe Documents file scanned

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`InitiatingProcessFileName`

References #

ScheduledTaskDisabled: Scheduled task disabled

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

ScheduledTaskEnabled: Scheduled task enabled

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

ScreenshotTaken: Screenshot taken

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

SecurityGroupCreated: Security group created

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "SecurityGroupCreated",
  "AdditionalFields": {
    "GroupName": "dwh_sec_g1",
    "GroupDomainName": "JD-WIN11-22H2-1",
    "GroupSid": "S-1-5-21-3407486967-1585450050-1838039599-1751"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5832,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:26.1459544Z"
}

References #

SecurityGroupDeleted: Security group deleted

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "SecurityGroupDeleted",
  "AdditionalFields": {
    "GroupName": "dwh_sec_bfdbb12bb9f9_g1",
    "GroupDomainName": "JD-WIN11-22H2-1",
    "GroupSid": "S-1-5-21-3407486967-1585450050-1838039599-1752"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 16338901,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 7989,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T02:22:54.8419929Z"
}

References #

SecurityLogCleared: Security log cleared

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "SecurityLogCleared",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessLogonId": 37004418,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 6131,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T04:50:39.3979859Z"
}

References #

SensitiveFileRead: Sensitive file read

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`InitiatingProcessFileName`

References #

ServiceInstalled: Service installed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ServiceInstalled",
  "AdditionalFields": {
    "ServiceName": "dwh_sec_svc",
    "ServiceType": 16,
    "ServiceStartType": 3,
    "ServiceAccount": "LocalSystem"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "cmd.exe",
  "FolderPath": "C:\\Windows\\System32",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T08:19:24.3062443Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFileSize": 65536,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
  "InitiatingProcessId": 9640,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:36.1647611Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1288,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184873556",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
  "InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ProcessCommandLine": "C:\\Windows\\System32\\cmd.exe /c exit",
  "ReportId": 5942,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:38.9467331Z"
}

References #

ShellLinkCreateFileEvent: Shell link (LNK) file created

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA1`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ShellLinkCreateFileEvent",
  "AdditionalFields": {
    "FileSizeInBytes": 2422,
    "VolumeGuidPath": "\\\\?\\Volume{ce657ebb-70c7-4b8b-a13f-ff11b9725249}",
    "IsOnRemovableMedia": false,
    "ShellLinkIconPath": "C:\\Program Files (x86)\\Microsoft\\Copilot\\Application\\mscopilot.exe",
    "ShellLinkRunAsAdmin": false,
    "ShellLinkWorkingDirectory": "C:\\Program Files (x86)\\Microsoft\\Copilot\\Application",
    "ShellLinkShowCommand": "SW_SHOWNORMAL"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "Copilot.lnk",
  "FolderPath": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"setup.exe\" --mscopilot --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1",
  "InitiatingProcessCreationTime": "2026-08-01T08:06:36.4428938Z",
  "InitiatingProcessFileName": "setup.exe",
  "InitiatingProcessFileSize": 5379912,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files (x86)\\microsoft\\edgeupdate\\install\\{35da5bc7-df19-4f12-8c18-35b7de79ac5b}\\edgemitmp_112ff.tmp\\setup.exe",
  "InitiatingProcessId": 2620,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 999,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "5dc33a5a93a238e9a8bb4bbd386b711b",
  "InitiatingProcessParentCreationTime": "2026-08-01T08:05:30.1773334Z",
  "InitiatingProcessParentFileName": "setup.exe",
  "InitiatingProcessParentId": 4356,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3ff14fb636c40c3d988713cbb59df4a38240a7a3",
  "InitiatingProcessSHA256": "18572bcabd8ada30a2ca9388f3769bcfad950ea115ebebecfa39c28874f25bec",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9851624184873447",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft Edge Installer",
  "InitiatingProcessVersionInfoInternalFileName": "setup_exe",
  "InitiatingProcessVersionInfoOriginalFileName": "setup.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft Edge Installer",
  "InitiatingProcessVersionInfoProductVersion": "150.0.4078.96",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "MD5": "c21b4a2cf303a93d82776f703c072946",
  "ProcessCreationTime": "2026-04-14T17:20:13.258233Z",
  "ReportId": 4957,
  "ReportId@odata.type": "#Int64",
  "SHA1": "0c2b5e5d9458289c93af6363614247739428814d",
  "SHA256": "98349fc38b3750cfc37dc9b97d283d2b1e04eefba9620cf4dbaca0ffd1e5784b",
  "Timestamp": "2026-08-01T08:06:36.8133847Z"
}

References #

TamperingAttempt: Tampering attempt

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "TamperingAttempt",
  "AdditionalFields": {
    "TamperingAction": "RegistryModification",
    "Status": "Blocked",
    "Target": "SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Real-Time Protection\\\\DisableRealtimeMonitoring",
    "TamperingAttemptedValue": "1"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "local service",
  "InitiatingProcessAccountSid": "S-1-5-19",
  "InitiatingProcessCommandLine": "wmiprvse.exe -secured -Embedding",
  "InitiatingProcessCreationTime": "2026-07-22T21:24:41.633799Z",
  "InitiatingProcessFileName": "WmiPrvSE.exe",
  "InitiatingProcessFileSize": 516096,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wbem\\wmiprvse.exe",
  "InitiatingProcessId": 11400,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 997,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "7528ccabaccd5c1748e63e192097472a",
  "InitiatingProcessParentCreationTime": "2026-07-19T17:22:31.5783232Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 1304,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "91180ed89976d16353404ac982a422a707f2ae37",
  "InitiatingProcessSHA256": "196cabed59111b6c4bbf78c84a56846d96cbbc4f06935a4fd4e6432ef0ae4083",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "9288674231517529",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "WMI Provider Host",
  "InitiatingProcessVersionInfoInternalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "Wmiprvse.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "RegistryKey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Real-Time Protection",
  "RegistryValueName": "DisableRealtimeMonitoring",
  "ReportId": 50209,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-22T21:25:27.7291836Z"
}

References #

UntrustedWifiConnection: Untrusted Wi-Fi connection

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

UsbDriveDriveLetterChanged: USB drive letter changed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

UsbDriveMounted: USB drive mounted

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "UsbDriveMounted",
  "AdditionalFields": {
    "DriveLetter": "D:",
    "BusType": 2,
    "ProductName": "QEMU QEMU DVD-ROM",
    "ProductRevision": "2.5+",
    "Volume": "\\\\?\\Volume{4b41a8d4-e67f-11f0-964b-806e6f6e6963}",
    "LoggedOnUsers": [
      ""
    ]
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 1058320,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:07:58.2043719Z"
}

Detection Patterns #

Exfiltration: Exfiltration Over C2 Channel

Defender-DeviceEvents UsbDriveMounted: USB drive mountedORDefender-DeviceFileEvents FileCreated: File created

1 rule

Kusto

Files Copied to USB Drives (source)

Exfiltration: Exfiltration Over Physical Medium

Defender-CloudAppEvents any: Cloud app activityORDefender-DeviceEvents UsbDriveMounted: USB drive mountedORDefender-DeviceFileEvents FileCreated: File createdORFileRenamed: File renamed

1 rule

Kusto

Mass Download & copy to USB device by single user (source)

Microsoft Security Research

Exfiltration: Exfiltration Over Physical Medium

Defender-DeviceEvents UsbDriveMounted: USB drive mountedORDefender-DeviceFileEvents any: File activityORDefender-DeviceInfo any: Device information

1 rule

Kusto

Dataverse - Terminated employee exfiltration to USB drive (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`UsbDriveMounted`	3 rules	kusto
`ActionType` (kusto rule field)	eq	`FileCreated`	1 rule	kusto
`ActionType` (kusto rule field)	in	`FileCreated`	1 rule	kusto
`Type` (kusto rule field)	eq	`account`	1 rule	kusto
`Type` (kusto rule field)	eq	`ip`	1 rule	kusto

References #

UsbDriveUnmounted: USB drive unmounted

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

References #

UserAccountCreated: User account created

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "jd-win11-22h2-1",
  "AccountName": "dwh_sec_u2",
  "AccountSid": "S-1-5-21-3407486967-1585450050-1838039599-1750",
  "ActionType": "UserAccountCreated",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5824,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:25.7853113Z"
}

Detection Patterns #

Persistence: Account Manipulation

1 rule

Kusto

Local Admin Group Changes (source)

References #

UserAccountDeleted: User account deleted

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "jd-win11-22h2-1",
  "AccountName": "dwh_sec_u2",
  "AccountSid": "S-1-5-21-3407486967-1585450050-1838039599-1750",
  "ActionType": "UserAccountDeleted",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 6258,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T01:20:28.1473422Z"
}

References #

UserAccountModified: User account modified

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "jd-win11-22h2-1",
  "AccountName": "dwh_sec_u1",
  "AccountSid": "S-1-5-21-3407486967-1585450050-1838039599-1749",
  "ActionType": "UserAccountModified",
  "AdditionalFields": {
    "SamAccountName": "dwh_sec_u1",
    "DisplayName": "DWH Sec",
    "HomeDirectory": "%%1793",
    "HomePath": "%%1793",
    "ScriptPath": "%%1793",
    "ProfilePath": "%%1793",
    "PasswordLastSet": "8/1/2026 8:19:25 AM",
    "PrimaryGroupId": "513",
    "OldUacValue": "0x14",
    "NewUacValue": "0x14",
    "UserAccountControl": "-",
    "UserParameters": "%%1793"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5909,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:32.1483936Z"
}

Detection Patterns #

Persistence: Account Manipulation

1 rule

Kusto

Local Admin Group Changes (source)

References #

UserAccountPasswordResetAttempt: User account password reset attempt

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AccountName`
`AccountDomain`
`AccountSid`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "AccountDomain": "jd-win11-22h2-1",
  "AccountName": "dwh_sec_u2",
  "AccountSid": "S-1-5-21-3407486967-1585450050-1838039599-1750",
  "ActionType": "UserAccountPasswordResetAttempt",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessLogonId": 9081705,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 5827,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:25.8110699Z"
}

References #

WmiBindEventFilterToConsumer: WMI EventFilter bound to consumer

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "WmiBindEventFilterToConsumer",
  "AdditionalFields": {
    "Consumer": "CommandLineEventConsumer=\"DW-Lab-Consumer\"",
    "Ess": "DW-Lab-Filter",
    "Namespace": "//./root/subscription",
    "PossibleCause": "Binding EventFilter: \ninstance of __EventFilter\n{\n\tCreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 44, 235, 1, 60, 119, 233, 43, 129, 112, 79, 245, 87, 81, 4, 0, 0};\n\tEventNamespace = \"root\\\\cimv2\";\n\tName = \"DW-Lab-Filter\";\n\tQuery = \"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='dw_never.exe'\";\n\tQueryLanguage = \"WQL\";\n};\nPerm. Consumer: \ninstance of CommandLineEventConsumer\n{\n\tCommandLineTemplate = \"cmd.exe /c exit\";\n\tCreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 44, 235, 1, 60, 119, 233, 43, 129, 112, 79, 245, 87, 81, 4, 0, 0};\n\tName = \"DW-Lab-Consumer\";\n};\n"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 4274,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T01:31:42.6740152Z"
}

References #

WriteToLsassProcessMemory: Write to LSASS process memory

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ProcessId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

References #

AsrLsassCredentialTheftWarnBypassed: ASR LSASS credential theft warn bypassed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ActionType`
`AdditionalFields`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

References #

AsrOfficeProcessInjectionWarnBypassed: ASR Office process injection warn bypassed

Table: DeviceEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ActionType`
`AdditionalFields`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

References #

TvmAxonTelemetryEvent: Threat and vulnerability management telemetry

Table: DeviceEvents

Fields #

Name	Description
`ActionType`
`Timestamp`
`DeviceId`
`DeviceName`
`ReportId`
`AdditionalFields`
`IsInitiatingProcessRemoteSession`
`IsProcessRemoteSession`

Example Event #

{
  "ActionType": "TvmAxonTelemetryEvent",
  "AdditionalFields": {
    "BuildId": "1.5.0-0-14236710",
    "InfoAsJson": [
      {
        "timestamp": 1785546377580816300,
        "level": "WARN",
        "source": "sense_tvm::collection::file_indexer::drive_utils",
        "message": "Failed to get drive format for drive D: General { message: \"GetVolumeInformationW failed, error: WIN32_ERROR(21)\", source: None, location: Location { file: \"src\\\\collection\\\\file_indexer\\\\drive_utils.rs\", line: 46, column: 9 } }",
        "file": "src\\collection\\file_indexer\\drive_utils.rs",
        "line": 29
      },
      {
        "timestamp": 1785546411931523700,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Users\\localuser\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\\metadata. Error: General error: False positive: failed to parse candidate python library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546411937627800,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Users\\domainadmin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\\metadata. Error: General error: False positive: failed to parse candidate python library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412062572500,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Users\\domainadmin\\AppData\\Local\\Microsoft\\OneDrive\\EBWebView\\Crashpad\\metadata. Error: General error: False positive: failed to parse candidate python library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412077093900,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Users\\domainadmin\\AppData\\Local\\Microsoft\\Excel\\Metadata. Error: General error: False positive: failed to parse candidate python library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412086710400,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Users\\domainadmin\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\11111111-1111-1111-1111-111111111111_ADAL\\2\\EBWebView\\Crashpad\\metadata. Error: General error: False positive: failed to parse candidate python library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412136804700,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Users\\domainadmin\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\11111111-1111-1111-1111-111111111111_ADAL\\2\\0\\EBWebView\\Crashpad\\metadata. Error: General error: False positive: failed to parse candidate python library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412430793000,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Windows\\servicing\\LCU\\Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.4893.1.11\\amd64_windowsdeviceportal..ional-devicesplugin_31bf3856ad364e35_10.0.20348.2849_none_185ce1d5f6356957\\f\\package.json. Error: General error: False positive: failed to parse candidate node library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412433097100,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Windows\\servicing\\LCU\\Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.4893.1.11\\amd64_windowsdeviceportal-optional-powerplugin_31bf3856ad364e35_10.0.20348.2849_none_d7afa5ed455691e1\\f\\package.json. Error: General error: False positive: failed to parse candidate node library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412434536900,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Windows\\servicing\\LCU\\Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.4893.1.11\\amd64_windowsdeviceportal-optional-perception_31bf3856ad364e35_10.0.20348.2849_none_8476b08839d7f8d8\\f\\package.json. Error: General error: False positive: failed to parse candidate node library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412436770000,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Windows\\servicing\\LCU\\Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.4893.1.11\\amd64_windowsdeviceportal..onal-locationplugin_31bf3856ad364e35_10.0.20348.2849_none_b18da0d0a3e27363\\f\\package.json. Error: General error: False positive: failed to parse candidate node library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      },
      {
        "timestamp": 1785546412438239500,
        "level": "WARN",
        "source": "sense_tvm::collection::dev_libraries::dev_libraries_collector",
        "message": "Failed to parse file C:\\Windows\\servicing\\LCU\\Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.4893.1.11\\amd64_windowsdeviceportal..onal-xboxliveplugin_31bf3856ad364e35_10.0.20348.2849_none_f14f96c24e8bbf3f\\f\\package.json. Error: General error: False positive: failed to parse candidate node library file",
        "file": "src\\collection\\dev_libraries\\dev_libraries_collector.rs",
        "line": 57
      }
    ],
    "Name": "Log",
    "Timestamp": 1785546419,
    "ProcessId": 12656
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "ReportId": 4767,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T01:06:59.4408329Z"
}

References #

OtherAlertRelatedActivity: Other alert-related activity

Table: DeviceEvents

Fields #

Name	Description
`ActionType`
`Timestamp`
`DeviceId`
`DeviceName`
`InitiatingProcessSHA1`
`InitiatingProcessSHA256`
`InitiatingProcessFileName`
`InitiatingProcessFolderPath`
`InitiatingProcessId`
`InitiatingProcessCommandLine`
`InitiatingProcessAccountDomain`
`InitiatingProcessAccountName`
`InitiatingProcessAccountSid`
`InitiatingProcessParentFileName`
`ReportId`
`AdditionalFields`

Example Event #

{
  "ActionType": "OtherAlertRelatedActivity",
  "AdditionalFields": {
    "Description": "Defender prevented execution of 'Virus:Win32/MpTest!amsi' script launched by 'wsmprovhost.exe'"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-07-23T04:46:41.4009738Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFolderPath": "C:\\Windows\\System32\\wsmprovhost.exe",
  "InitiatingProcessId": 3008,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-07-22T22:04:36.8481467Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 1284,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "ReportId": 6103,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-23T04:47:04.6554163Z"
}

References #

ContainedUserLogonBlocked: Contained user logon blocked

Table: DeviceEvents

Fields #

Name	Description
`ActionType`
`Timestamp`
`DeviceId`
`DeviceName`
`AccountDomain`
`AccountName`
`AccountSid`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`LogonId`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`
`InitiatingProcessAccountName`
`ReportId`
`AdditionalFields`

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "domainadmin",
  "AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "ActionType": "ContainedUserLogonBlocked",
  "AdditionalFields": {
    "LogonType": "Network",
    "Protocol": "Kerberos"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "RemoteIP": "10.2.10.11",
  "RemotePort": 55040,
  "ReportId": 17767,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-26T01:09:53.5900591Z"
}

References #

ContainedUserSmbFileOpenBlocked: Contained user SMB file open blocked

Table: DeviceEvents

Fields #

Name	Description
`ActionType`
`Timestamp`
`DeviceId`
`DeviceName`
`AccountDomain`
`AccountName`
`AccountSid`
`FileName`
`FolderPath`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`
`ReportId`
`AdditionalFields`

Example Event #

{
  "AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "ActionType": "ContainedUserSmbFileOpenBlocked",
  "AdditionalFields": {
    "ShareName": "SYSVOL"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "FileName": "{7741B396-B5B8-4AD4-ABD2-654E62F72C1B}",
  "FolderPath": "\\Device\\HarddiskVolume1\\Windows\\SYSVOL\\sysvol\\ludus.domain\\Policies",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCreationTime": "2026-07-19T19:11:06.0818458Z",
  "InitiatingProcessFileName": "ntoskrnl.exe",
  "InitiatingProcessFileSize": 11584928,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\ntoskrnl.exe",
  "InitiatingProcessId": 4,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "281827db71491b867320e7cb0c8df80f",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "c8570e27cdf7e6ce1e627715ee9a659602010983",
  "InitiatingProcessSHA256": "fbdb6779ce30507e8f4cdb738017ced30495ecb93d145ccfc476eb5eb39b42f4",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessUniqueId": "7036874417766401",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "NT Kernel & System",
  "InitiatingProcessVersionInfoInternalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.4893",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "RemoteIP": "::1",
  "RemotePort": 55220,
  "ReportId": 307643,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-26T01:17:27.0174029Z"
}

References #

ContainedUserRpcAccessBlocked: Contained user RPC access blocked

Table: DeviceEvents

Fields #

Name	Description
`ActionType`
`Timestamp`
`DeviceId`
`DeviceName`
`AccountDomain`
`AccountName`
`AccountSid`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`
`InitiatingProcessAccountName`
`ReportId`
`AdditionalFields`

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "domainadmin",
  "AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "ActionType": "ContainedUserRpcAccessBlocked",
  "AdditionalFields": {
    "RpcInterfaceUuid": "e3514235-4b06-11d1-ab04-00c04fc2dcd2",
    "RpcInterfaceFriendlyName": "Directory Replication Service (DRS)"
  },
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessFileName": "lsass.exe",
  "InitiatingProcessId": 1268,
  "InitiatingProcessId@odata.type": "#Int64",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 467309262,
  "LogonId@odata.type": "#Int64",
  "RemoteIP": "::1",
  "RemotePort": 55181,
  "ReportId": 307127,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-07-26T01:16:28.9498116Z"
}

Defender-DeviceEvents

any: Defender event

Fields #

Example Event #

Detection Patterns #

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Kusto

Kusto

Kusto

Execution: Exploitation for Client Execution

Kusto

Persistence: Compromise Host Software Binary

Kusto

Privilege Escalation: Exploitation for Privilege Escalation

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

References #

PowerShellCommand: PowerShell command executed

Fields #

Example Event #

Detection Patterns #

Lateral Movement: Exploitation of Remote Services

Kusto

Common Indicators #

Detection Rules #

Kusto #

References #

AmsiScriptDetection: AMSI script detection

Fields #

Example Event #

References #

AmsiScriptContent: AMSI script content captured

Fields #

Detection Rules #

Kusto #

References #

CreateRemoteThreadApiCall: CreateRemoteThread API call

Fields #

Example Event #

Detection Patterns #

Process Injection

Kusto

Process Injection

Kusto

Process Injection

Kusto

Execution: User Execution

Kusto

Common Indicators #

References #

NamedPipeEvent: Named pipe event

Fields #

Example Event #

Detection Patterns #

Kusto

Common Indicators #

Detection Rules #

Kusto #

References #

UserAccountAddedToLocalGroup: User account added to local group

Fields #

Example Event #

Detection Patterns #

Persistence: Account Manipulation

Kusto

References #

UserAccountRemovedFromLocalGroup: User account removed from local group

Fields #

Example Event #

References #

AsrLsassCredentialTheftAudited: ASR: LSASS credential theft (audited)

Fields #