detection.wiki

Defender-DeviceInfo

any: Device information

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
DeviceInfo

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

NameRulesVendors
OnboardingStatus2 detection rulesKusto
DeviceType1 detection ruleKusto
MergedToDeviceId1 detection ruleKusto
OSPlatform1 detection ruleKusto

Representative record #

{
  "AadDeviceId": "ef01b99d-7f4f-4ca5-a03c-956e8fa7f2a1",
  "ClientVersion": "10.8821.20348.4893",
  "ConnectivityType": "Streamlined",
  "DeviceCategory": "Endpoint",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "DeviceSubtype": "Server",
  "DeviceType": "Server",
  "DiscoverySources": {
    "Defender for Endpoint": "2026-07-26"
  },
  "DlpInfo": {
    "IsDlpConfigurationValid": false,
    "DlpPolicyLastModifiedTimeUTC": null,
    "IsDlpEnabled": false,
    "IsDefenderRealTimeProtectionEnabled": false,
    "IsDefenderBehaviorMonitoringEnabled": false,
    "HasDlpACBandwidthExceeded": false,
    "HasDlpValidUpn": true,
    "DlpUpn": "adminuser@example.onmicrosoft.com"
  },
  "ExclusionReason": "Other",
  "ExposureLevel": "None",
  "HardwareUuid": "0c0359a1-063e-4d10-92d2-ef9d69eef244",
  "IsAzureADJoined": 0,
  "IsAzureADJoined@odata.type": "#SByte",
  "IsExcluded": 1,
  "IsExcluded@odata.type": "#SByte",
  "IsTransient": 0,
  "IsTransient@odata.type": "#SByte",
  "JoinType": "Domain Joined",
  "LoggedOnUsers": [],
  "MachineGroup": "a",
  "OSArchitecture": "64-bit",
  "OSBuild": 20348,
  "OSBuild@odata.type": "#Int64",
  "OSDistribution": "WindowsServer2022",
  "OSPlatform": "WindowsServer2022",
  "OSVersion": "10.0",
  "OSVersionInfo": "21H2",
  "OnboardingStatus": "Onboarded",
  "OsBuildRevision": "4893",
  "PublicIP": "203.0.113.10",
  "ReportId": 639211220300838751,
  "ReportId@odata.type": "#Int64",
  "SensorHealthState": "Active",
  "Timestamp": "2026-07-30T19:09:04.276348Z"
}

Detection Patterns #

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
ProviderName (kusto rule field)eqMDATP1 rulekusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

  • AV detections related to Dev-0530 actors source high: This query looks for Microsoft Defender AV detections related to Dev-0530 actors. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.T1486
  • AV detections related to Europium actors source high: This query looks for Microsoft Defender AV detections related to Europium actor. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available. Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-governmentT1486
  • AV detections related to Hive Ransomware source high: This query looks for Microsoft Defender AV detections related to Hive Ransomware. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.T1486

Show 15 more (18 total) on the rules page

References #