Defender-DeviceNetworkEvents

ActionType	Title	Sample	Rule
any	Network activity	Y	Y
ConnectionSuccess	Connection succeeded	Y	Y
ConnectionFailed	Connection failed	Y	Y
InboundConnectionAccepted	Inbound connection accepted	Y	Y
ListeningConnectionCreated	Listening connection created	Y	Y
ConnectionRequest	Connection request	N	Y
DnsConnectionInspected	DNS connection inspected	Y	N
ConnectionAttempt	Connection attempt	Y	Y
ConnectionFound	Connection found	Y	N
NetworkSignatureInspected	Network signature inspected	Y	Y
ConnectionAcknowledged	Connection acknowledged	Y	N
FtpConnectionInspected	FTP connection inspected	N	N
HttpConnectionInspected	HTTP connection inspected	Y	N
IcmpConnectionInspected	ICMP connection inspected	Y	N
InboundInternetScanInspected	Inbound internet scan inspected	N	N
NtlmAuthenticationInspected	NTLM authentication inspected	Y	N
SmtpConnectionInspected	SMTP connection inspected	N	N
SshConnectionInspected	SSH connection inspected	N	N
SslConnectionInspected	SSL connection inspected	Y	N
KerberosConnectionInspected	Kerberos connection inspected	Y	N

any: Network activity

Table: DeviceNetworkEvents

Fields #

Name	Description	Rules
`DeviceId`
`Timestamp`
`ActionType`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`LocalIP`
`LocalPort`
`Protocol`
`InitiatingProcessFileName`		3 detection rules
`InitiatingProcessCommandLine`

Example Event #

{
  "ActionType": "ConnectionSuccess",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "network service",
  "InitiatingProcessAccountSid": "S-1-5-20",
  "InitiatingProcessCommandLine": "svchost.exe -k NetworkService -p",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.0752007Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 1540,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872980",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 50334,
  "Protocol": "TcpV4",
  "RemoteIP": "203.0.113.10",
  "RemotePort": 80,
  "RemoteUrl": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e129dbb8d60525cc",
  "ReportId": 14416,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:28:25.0297813Z"
}

Detection Patterns #

Defender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

4 rules

Kusto

Regsvr32 Rundll32 with Anomalous Parent Process (source)

Detect Msiexec executing DLL network connections (source)

Robbe Van den Daele

DCOM Lateral Movement (source)

Show 1 more (4 total) on the rules page

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents any: Network activityORInboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceProcessEvents any: Process activity

2 rules

Kusto

DCOM Lateral Movement (source)

SMB/Windows Admin Shares (source)

Defender-DeviceInfo any: Device informationORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceNetworkInfo any: Device network configuration

1 rule

Kusto

Hunt for ADWS requests from unknown devices (source)

Robbe Van den Daele

Stealth: Regsvr32

Defender-DeviceImageLoadEvents any: Image loadORDefender-DeviceNetworkEvents any: Network activity

1 rule

Kusto

Regsvr32 Rundll32 Image Loads Abnormal Extension (source)

Credential Access: Name Resolution Poisoning and SMB Relay

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORConnectionAttempt: Connection attempt

1 rule

Kusto

NTLM Relay Attack (source)

FalconForce

Show All Detection Patterns

Defender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeeded

1 rule

Kusto

ADWS Connection from Unexpected Binary (source)

FalconForce

Execution: Exploitation for Client Execution

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activityORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devices

1 rule

Kusto

Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 (source)

Execution: User Execution

Defender-DeviceFileEvents FileCreated: File createdORFileRenamed: File renamedORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious office child process created (source)

FalconForce

Persistence: Windows Service

Defender-DeviceFileEvents any: File activityORDefender-DeviceImageLoadEvents any: Image loadORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Rare Process as a Service (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`ConnectionSuccess`	3 rules	kusto
`ActionType` (kusto rule field)	ne	`ListeningConnectionCreated`	4 rules	kusto
`DestinationHostname` (kusto rule field)	contains	`domains`	2 rules	kusto
`DestinationHostname` (kusto rule field)	is_not_null		3 rules	kusto
`InitiatingProcessSHA256` (kusto rule field)	eq	`sha256hashes`	3 rules	kusto
`ValidUntil` (kusto rule field)	is_null		3 rules	kusto
`sha256` (kusto rule field)	contains	`sha256hashes`	3 rules	kusto
`Category` (kusto rule field)	eq	`AzureFirewallApplicationRule`	2 rules	kusto
`ClientIP` (kusto rule field)	eq	`IPList`	2 rules	kusto
`DestinationHost` (kusto rule field)	contains	`domains`	2 rules	kusto
`DestinationHost` (kusto rule field)	is_not_null		2 rules	kusto
`DestinationHostName` (kusto rule field)	contains	`domains`	2 rules	kusto
`DestinationIP` (kusto rule field)	eq	`IPList`	2 rules	kusto
`DestinationIp` (kusto rule field)	is_not_null		2 rules	kusto
`DeviceNetworkEvents_TimeGenerated` (kusto rule field)	cross_field_compare	`ExpirationDateTime`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

IP address of Windows host encoded in web request source medium: This detection will identify network requests in HTTP proxy data that contains Base64 encoded IP addresses. After identifying candidates the query joins with DeviceNetworkEvents to idnetify any machine within the network using that IP address. Alerts indicate that the IP address of a machine within your network was seen with it's IP address base64 encoded in an outbound web request. This method of egressing the IP was seen used in POLONIUM's RunningRAT tool, however the detection is generic.T1041, T1071, T1071.001
Europium - Hash and IP IOCs - September 2022 source high: Identifies a match across various data feeds for hashes and IP IOC related to Europium Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-governmentT1003, T1071
Mercury - Domain, Hash and IP IOCs - August 2022 source high: Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/T1071

Show 17 more (20 total) on the rules page

ConnectionSuccess: Connection succeeded

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ConnectionSuccess",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "network service",
  "InitiatingProcessAccountSid": "S-1-5-20",
  "InitiatingProcessCommandLine": "svchost.exe -k NetworkService -p",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:39.0752007Z",
  "InitiatingProcessFileName": "svchost.exe",
  "InitiatingProcessFileSize": 79920,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe",
  "InitiatingProcessId": 1540,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "8ec922c7a58a8701ab481b7be9644536",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "3f64c98f22da277a07cab248c44c56eedb796a81",
  "InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872980",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services",
  "InitiatingProcessVersionInfoInternalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "svchost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.1",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 50334,
  "Protocol": "TcpV4",
  "RemoteIP": "203.0.113.10",
  "RemotePort": 80,
  "RemoteUrl": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e129dbb8d60525cc",
  "ReportId": 14416,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:28:25.0297813Z"
}

Detection Patterns #

Detect Suspicious Ncrypt Dll

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphEdges any: Exposure graph edgesORDefender-ExposureGraphNodes any: Exposure graph nodes

4 rules

Kusto

Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Show 1 more (4 total) on the rules page

Detect Suspicious Ncrypt Dll

4 rules

Kusto

Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Show 1 more (4 total) on the rules page

Detect Suspicious Ncrypt Dll

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeeded

3 rules

Kusto

Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Defender-DeviceFileEvents FileCreated: File createdORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORConnectionFailed: Connection failedORConnectionRequest: Connection requestORConnectionAttempt: Connection attempt

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Show All Detection Patterns

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORConnectionFailed: Connection failedORConnectionRequest: Connection requestORConnectionAttempt: Connection attempt

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Defender-DeviceEvents CreateRemoteThreadApiCall: CreateRemoteThread API callORNtAllocateVirtualMemoryRemoteApiCall: Remote virtual memory allocationORMemoryRemoteProtect: Remote virtual memory protection changeORNtMapViewOfSectionRemoteApiCall: Remote section mapORQueueUserApcRemoteApiCall: Remote APC queuedORSetThreadContextRemoteApiCall: Remote thread context changeORNtAllocateVirtualMemoryApiCall: NtAllocateVirtualMemory API callORNtProtectVirtualMemoryApiCall: NtProtectVirtualMemory API callORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeeded

1 rule

Kusto

ADWS Connection from Process Injection Target (source)

FalconForce

Credential Access: Name Resolution Poisoning and SMB Relay

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORConnectionAttempt: Connection attempt

1 rule

Kusto

NTLM Relay Attack (source)

FalconForce

Defender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeeded

1 rule

Kusto

ADWS Connection from Unexpected Binary (source)

FalconForce

Execution: User Execution

1 rule

Kusto

Suspicious office child process created (source)

FalconForce

Defense Impairment: Modify Authentication Process

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeeded

1 rule

Kusto

Rouge RDP: Suspicious File Creation (source)

Cyb3rMonk

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`ConnectionSuccess`	11 rules	kusto
`ActionType` (kusto rule field)	in	`connectionattempt`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionfailed`	2 rules	kusto
`ActionType` (kusto rule field)	starts_with	`AppControl`	3 rules	kusto
`DestinationPort` (kusto rule field)	eq	`3389`	4 rules	kusto
`DestinationPort` (kusto rule field)	in	`445`	3 rules	kusto
`DestinationHostname` (kusto rule field)	eq	`login.microsoftonline.com`	3 rules	kusto
`NodeLabel` (kusto rule field)	eq	`device`	3 rules	kusto
`OnboardingStatus` (kusto rule field)	ne	`Onboarded`	3 rules	kusto
`TpmActivated` (kusto rule field)	ne	`true`	3 rules	kusto
`TpmEnabled` (kusto rule field)	ne	`true`	3 rules	kusto
`TpmSupported` (kusto rule field)	ne	`true`	3 rules	kusto
`file_name` (kusto rule field)	eq	`ncrypt.dll`	3 rules	kusto
`parent_process_name` (kusto rule field)	ne	`microsoft.tri.sensor.exe`	3 rules	kusto
`type` (kusto rule field)	eq	`DeviceInventoryId`	3 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

SUNBURST network beacons source medium: Identifies SolarWinds SUNBURST domain beacon IOCs in DeviceNetworkEvents References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82fT1059, T1195, T1546
Suspicious Network Beacons - Microsoft Defender(MDE/M365D) source: Below query detects suspicious beaconing activity by analyzing DeviceNetworkEvents data.↳ also matches any: Network activity
Potential Kerberos Relaying Activity - MDE source: The below query detects potential Kerberos relaying event chain generated by KrbRelay.↳ also matches any: Network activity, ListeningConnectionCreated: Listening connection created

Show 2 more (5 total) on the rules page

ConnectionFailed: Connection failed

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ConnectionFailed",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "spoolsv.exe",
  "InitiatingProcessCreationTime": "2026-08-01T01:02:25.79631Z",
  "InitiatingProcessFileName": "spoolsv.exe",
  "InitiatingProcessFileSize": 888832,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\spoolsv.exe",
  "InitiatingProcessId": 4564,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "16606819f6aab105221ab02b5d4dd7a2",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:12.0633947Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1232,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "9b2bd60bf0c302fdb7cc1c3cec3c1e9caeb3f803",
  "InitiatingProcessSHA256": "f6c4f2d9b408783fee17f260b6b9002806f5305543c8f3161fa0e3ca87588fc5",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394477133",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Spooler SubSystem App",
  "InitiatingProcessVersionInfoInternalFileName": "spoolsv.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "spoolsv.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.4294",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "::1",
  "LocalIPType": "Loopback",
  "LocalPort": 51310,
  "Protocol": "Tcp",
  "RemoteIP": "::1",
  "RemoteIPType": "Loopback",
  "RemotePort": 389,
  "ReportId": 1057911,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:02:28.2177291Z"
}

Detection Patterns #

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORConnectionFailed: Connection failedORConnectionRequest: Connection requestORConnectionAttempt: Connection attempt

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`connectionattempt`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionfailed`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionrequest`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionsuccess`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`445`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`5985`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`5986`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`135`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`22`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`3389`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`5900`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	is_not_null		1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`1000`	1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`customscripthandler.exe`	1 rule	kusto

InboundConnectionAccepted: Inbound connection accepted

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`LocalIP`
`LocalPort`
`RemoteIP`
`Protocol`

Example Event #

{
  "ActionType": "InboundConnectionAccepted",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:23.4789618Z",
  "InitiatingProcessFileName": "ntoskrnl.exe",
  "InitiatingProcessFileSize": 12080544,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\ntoskrnl.exe",
  "InitiatingProcessId": 4,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "7f51b4fec9c32bcb910365ce68ae492e",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "a92ba6de8966d5b1f0866951832e8ca62ebe6129",
  "InitiatingProcessSHA256": "3255a69b65c23e1356b247aa8c05e93f6a4868268c878952af60c520d887596b",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184872961",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "NT Kernel & System",
  "InitiatingProcessVersionInfoInternalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "ntkrnlmp.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.6060",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "::ffff:10.2.10.21",
  "LocalIPType": "FourToSixMapping",
  "LocalPort": 5986,
  "Protocol": "Tcp",
  "RemoteIP": "::ffff:10.2.20.61",
  "RemoteIPType": "FourToSixMapping",
  "RemotePort": 48428,
  "ReportId": 5592,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:16:59.4820229Z"
}

Detection Patterns #

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents any: Network activityORInboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceProcessEvents any: Process activity

2 rules

Kusto

SMB/Windows Admin Shares (source)

Detect Unknown process launched via WinRM (source)

Robbe Van den Daele

Lateral Movement: Windows Remote Management

Defender-DeviceNetworkEvents InboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceProcessEvents any: Process activity

2 rules

Kusto

SMB/Windows Admin Shares (source)

Detect Unknown process launched via WinRM (source)

Robbe Van den Daele

Initial Access: Exploit Public-Facing Application

Defender-DeviceNetworkEvents InboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devicesORDefender-DeviceTvmSoftwareVulnerabilitiesKB any: Vulnerability knowledge baseORDefender-ExposureGraphNodes any: Exposure graph nodes

1 rule

Kusto

Hunt for public remotly exploitable devices (with high EPSS) (source)

Robbe Van den Daele

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	contains	`inboundconnection`	2 rules	kusto
`ActionType` (kusto rule field)	eq	`InboundConnectionAccepted`	3 rules	kusto
`RemoteIPType` (kusto rule field)	eq	`Public`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`1000`	1 rule	kusto
`ResourceType` (kusto rule field)	eq	`azurefirewalls`	1 rule	kusto
`file_name` (kusto rule field)	in	`agentexecutor.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`appvlp.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`at.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`atbroker.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`bash.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`bginfo.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`bitsadmin.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`cdb.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`certreq.exe`	1 rule	kusto
`file_name` (kusto rule field)	in	`certutil.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Log4j vulnerability exploit aka Log4Shell IP IOC source high: Identifies a match across various data feeds for IP IOCs related to the Log4j vulnerability exploit aka Log4Shell described in CVE-2021-44228. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228T1071
Potential Lateral Movement via MSI ODBC Driver Install over DCOM source: Detects Potential Lateral Movement via MSI Custom Actions to install ODBC Driver over DCOM remotely.
Hunt for public facing devices via DeviceNetworkEvents source: Find public facing devices via the DeviceNetworkEvents table.T1190

ListeningConnectionCreated: Listening connection created

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`LocalIP`
`LocalPort`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ListeningConnectionCreated",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "silentConfig",
  "InitiatingProcessCreationTime": "2026-08-01T08:03:14.4564803Z",
  "InitiatingProcessFileName": "onedrive.sync.service.exe",
  "InitiatingProcessFileSize": 958824,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files\\microsoft onedrive\\26.108.0607.0002\\onedrive.sync.service.exe",
  "InitiatingProcessId": 4008,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessMD5": "fee3b832738170231cce3a3786255fcc",
  "InitiatingProcessParentCreationTime": "2026-08-01T08:02:22.9601643Z",
  "InitiatingProcessParentFileName": "OneDriveStandaloneUpdater.exe",
  "InitiatingProcessParentId": 1524,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "cca7a5db29e641d055964c56c40639752ee587ee",
  "InitiatingProcessSHA256": "c19e82597361c901ec1378203476953e227c0fa0589448bf065e2026b9330af1",
  "InitiatingProcessSessionId": 1,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873396",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Microsoft OneDrive Sync Service",
  "InitiatingProcessVersionInfoInternalFileName": "Client Application",
  "InitiatingProcessVersionInfoOriginalFileName": "OneDrive.Sync.Service.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft OneDrive Sync Service",
  "InitiatingProcessVersionInfoProductVersion": "26.108.0607.0002",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "::1",
  "LocalPort": 42050,
  "Protocol": "TcpV6",
  "ReportId": 1882,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:03:18.2539581Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`ListeningConnectionCreated`	3 rules	kusto
`ActionType` (kusto rule field)	eq	`ConnectionSuccess`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`NamedPipeEvent`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`ProcessCreated`	1 rule	kusto
`DestinationIp` (kusto rule field)	is_not_null		1 rule	kusto
`DestinationPort` (kusto rule field)	in	`389`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`636`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`chrome.exe`	1 rule	kusto
`parent_process_name` (kusto rule field)	in	`msedge.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potential Kerberos Relaying Activity - MDE source: The below query detects potential Kerberos relaying event chain generated by KrbRelay.↳ also matches any: Network activity, ConnectionSuccess: Connection succeeded
Silent Enabling of Chrome DevTools Protocol source: CDP-Enable-BOF enables Chrome DevTools Protocol by injecting code into the main browser process that hasn't started with the --remote-debugging-port. This enables access to the current user's cookies and credential data without triggering any EDR detections that often monitors the --remote-debugging-port command line parameter.
The query below detects when a Chrome/Edge process that doesn't have the --remote-debugging-port parameter in its command line creates a listening port (remote debugging port). This behavior is normal when chromedriver/msedgedriver starts Chrome/Edge (used in automation workflows).
Detection Opportunities for Certighost (CVE-2026-54121) source

ConnectionRequest: Connection request

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`Protocol`

Detection Patterns #

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORConnectionFailed: Connection failedORConnectionRequest: Connection requestORConnectionAttempt: Connection attempt

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	in	`connectionattempt`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionfailed`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionrequest`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionsuccess`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`445`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`5985`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`5986`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`135`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`22`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`3389`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`5900`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	is_not_null		1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`1000`	1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`customscripthandler.exe`	1 rule	kusto

DnsConnectionInspected: DNS connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`RemoteIP`
`Protocol`

Example Event #

{
  "ActionType": "DnsConnectionInspected",
  "AdditionalFields": {
    "direction": "Out",
    "trans_id": "59777",
    "query": "203.0.113.10.in-addr.arpa",
    "qclass": "1",
    "qclass_name": "C_INTERNET",
    "qtype": "12",
    "qtype_name": "PTR",
    "rcode": "3",
    "uid": "CUEMHp2Rts8bFPR0H9",
    "rcode_name": "NXDOMAIN",
    "AA": "false",
    "TC": "false",
    "RD": "true",
    "RA": "false",
    "rejected": "false",
    "ts": "134300497761197320"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 57469,
  "Protocol": "Udp",
  "RemoteIP": "10.2.10.11",
  "RemotePort": 53,
  "ReportId": 14406,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:23:02.1498305Z"
}

ConnectionAttempt: Connection attempt

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ConnectionAttempt",
  "AdditionalFields": {
    "direction": "In",
    "Source Mac": "bc:24:11:9a:4d:c2",
    "Destination Mac": "bc:24:11:22:5b:57",
    "Tcp Flags": 2,
    "Packet Size": 74
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 5986,
  "Protocol": "TcpV4",
  "RemoteIP": "10.2.20.61",
  "RemotePort": 48428,
  "ReportId": 5639,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:17:01.5483472Z"
}

Detection Patterns #

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORConnectionFailed: Connection failedORConnectionRequest: Connection requestORConnectionAttempt: Connection attempt

2 rules

Kusto

Detect process drops via Azure Custom Script Extension performing lateral movement (source)

Robbe Van den Daele

Detect Unknown process using SMB or WinRM (source)

Robbe Van den Daele

Credential Access: Name Resolution Poisoning and SMB Relay

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORConnectionAttempt: Connection attempt

1 rule

Kusto

NTLM Relay Attack (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`DestinationPort` (kusto rule field)	in	`445`	3 rules	kusto
`DestinationPort` (kusto rule field)	in	`5985`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`5986`	2 rules	kusto
`DestinationPort` (kusto rule field)	in	`135`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`22`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`3389`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`5900`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`80`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`LogonSuccess`	1 rule	kusto
`ActionType` (kusto rule field)	in	`connectionattempt`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionfailed`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionrequest`	2 rules	kusto
`ActionType` (kusto rule field)	in	`connectionsuccess`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	is_not_null		1 rule	kusto
`Protocol` (kusto rule field)	eq	`NTLM`	1 rule	kusto

ConnectionFound: Connection found

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ConnectionFound",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessFileName": "OneDriveSetup.exe",
  "InitiatingProcessFolderPath": "C:\\Program Files\\Microsoft OneDrive\\StandaloneUpdater\\OneDriveSetup.exe",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "::ffff:10.2.10.21",
  "LocalPort": 56414,
  "Protocol": "Tcp",
  "RemoteIP": "::ffff:203.0.113.10",
  "RemotePort": 443,
  "ReportId": 2180127561,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:03:15.1962246Z"
}

NetworkSignatureInspected: Network signature inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`AdditionalFields`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "NetworkSignatureInspected",
  "AdditionalFields": {
    "SignatureName": "Kerberos_TGS_REQ",
    "SignatureMatchedContent": "%05¢%03%02%01%0C",
    "SamplePacketContent": [
      "u~%0F_%80.ãÂ%02óºl¶Âaºç÷>%7Fc%10ÃêìÞó§VQ×>´%17F%1D>%0C¼í`%01o@%90¸ÑTâòï÷4%1A%03\"ì²%0AóhBMïß%99Óh%15ô%0A\tÐ$é3,ÒZ%01òrî¯6%8F/ÀÚJ%80+`üô×Òca%1C!¶Cx¥%8D«µ1Z%99ã¿%07·LJ¦xôè?Ñvß^%9D2¯Û%1E2öï%1A½%1CZÁùaýáÂÚ%1FnÂ?ö%99i¼%0AÍ; %1E+èG}ü*47T?ph%12L%88 Ñ%80±-¹ç¥ ú%02õØFp%99%081ù±S´Õ,%8D%10§%00ÊîR}%9Dcÿ¡,X*þ%10o3àèëáÜÐU²åÍ>R«%9Dº¸u!%7FY-=%03©,¡u´òÐU¶Þaø×f/%1B%0AÊ^Vd&%90)Á¹G»È!pöb®{kw¢%17Ò%07aøühiÁi·þxè|ØÏI¼%9DoÄÖ%1Ds%99û*Ç%0BÚÅÍÈæ7\\%0D%98=¥¨4%1DÉqg%11K6yÂÇØÍÕ5%13'îvtý$p%0DE0wnI+P%1FJ%0Aq%11\\áåxÞ_Áâ.%88±àæ¯D¹%8DC%1FÛ³]S&z®yY£ôÊMYþg%0D¬Æ%0B¢;M%81ó8¾ÉåÜô~åäk(%88WÌ¡Ýq>%8D>%133c*%15%08ú%08wà4oýC5%88¦ÛÁ%17%00Ùâ%99H<b@tß4Pßgè¦%7FlÐoS½¾Ðà,ë^¹6%0C&Ä%8Dú%14 H|»<©võ%00%0ESÆfô%019éçu#xì.é%0B9±ÁQ%1F´:,%7F%17GP³ªÒ×%0FLò%06s%13%01õ%08ÜRIF%7Fo%01?ã%02QÂöï%0E¶±k%11¡O%1Aõ%88ÂÀ%13Ï/Ûì%01P¤%81 0%81%9D %03%02%01%12¢%81%04%81HVýn aZð=<8%05ïùn%80\" KHiáhÐPl^aCý¾Ñý¾¥áLñC_\"zÓ¼%9D%07ùiÅ¿£¡«ø¹6þ²*ÚCÖ³A%026ÌWrF%1B¾üÓj{%08%115%9D'%19É¹ÇË%04\\ãNVé°%0BôÀÄóø4+%12@G%7F%1D%06!t%1F8Éé%15ê½ºìÍ-e%1E%0AïQ½ãìÉ©.Ä¥%0DòáÁ^_0%15¡%04%02%02%00§"
    ]
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 57967,
  "RemoteIP": "10.2.10.11",
  "RemotePort": 88,
  "ReportId": 14289,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:56:53.3394202Z"
}

Detection Patterns #

Defender-DeviceNetworkEvents NetworkSignatureInspected: Network signature inspectedORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devices

1 rule

Kusto

Detect CVE exploits on network for which a device is vulnerable (source)

Robbe Van den Daele

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

DumpGuard NTLM challenge detected source: With the DumpGuard tool, attackers are able to dump credetials via Remote Credential Guard on devices that have Credential Guard enabled. The creator of the DumpGuard tool purposely used a hard-coded NTLMv1 challenge into the tool, for easy detection. > [!WARNING] > Since the detection relies on a static IOC that can easily be changed in the source code, this detection has a low confidence score since it can be easily bypassed. However, if the detection hits it is almost 100% certain the alert will be TP. > Also take into account that the NetworkSignatureInspected ActionType in MDE is sampled, which means not very event will be logged.T1003, T1003.004

ConnectionAcknowledged: Connection acknowledged

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ConnectionAcknowledged",
  "AdditionalFields": {
    "Tcp Flags": 18,
    "direction": "In",
    "Source Mac": "bc:24:11:9a:4d:c2",
    "Destination Mac": "bc:24:11:22:5b:57",
    "Packet Size": 66
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 50326,
  "Protocol": "TcpV4",
  "RemoteIP": "203.0.113.10",
  "RemotePort": 443,
  "ReportId": 14405,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:23:00.1340831Z"
}

FtpConnectionInspected: FTP connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

HttpConnectionInspected: HTTP connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "HttpConnectionInspected",
  "AdditionalFields": {
    "direction": "Out",
    "host": "c.pki.goog",
    "method": "GET",
    "request_body_len": "0",
    "response_body_len": "0",
    "status_code": "304",
    "status_msg": "Not Modified",
    "tags": [],
    "trans_depth": "1",
    "uri": "/r/r1.crl",
    "user_agent": "Microsoft-CryptoAPI/10.0",
    "version": "1.1"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 50305,
  "Protocol": "Tcp",
  "RemoteIP": "203.0.113.10",
  "RemotePort": 80,
  "ReportId": 14365,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:05:01.4264095Z"
}

IcmpConnectionInspected: ICMP connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "IcmpConnectionInspected",
  "AdditionalFields": {
    "conn_state": "OTH",
    "duration": "240.71993613243103",
    "missed_bytes": "0",
    "orig_bytes": "288",
    "orig_ip_bytes": "540",
    "orig_pkts": "9",
    "resp_bytes": "288",
    "resp_ip_bytes": "540",
    "resp_pkts": "9",
    "uid": "CNFHMN3nctbhCAEgB"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "Protocol": "Icmp",
  "RemoteIP": "203.0.113.10",
  "ReportId": 1510,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:02:25.7216344Z"
}

InboundInternetScanInspected: Inbound internet scan inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

NtlmAuthenticationInspected: NTLM authentication inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "NtlmAuthenticationInspected",
  "AdditionalFields": {
    "direction": "Out",
    "username": "domainadmin",
    "hostname": "JD-WIN11-22H2-1",
    "domainname": "ludus",
    "server_nb_computer_name": "JD-DC01-2022",
    "server_nb_domain_name": "ludus",
    "server_dns_computer_name": "JD-DC01-2022.ludus.domain",
    "server_dns_domain_name": "ludus.domain",
    "server_tree_name": "ludus.domain",
    "uid": "C1udKP14UIrFMpCBbd",
    "success": "true",
    "server_version": "10.0 20348 15",
    "ts": "134300269608386840"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 59421,
  "Protocol": "Tcp",
  "RemoteIP": "10.2.10.11",
  "RemotePort": 445,
  "ReportId": 8693,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T03:02:44.060646Z"
}

SmtpConnectionInspected: SMTP connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

SshConnectionInspected: SSH connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

SslConnectionInspected: SSL connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "SslConnectionInspected",
  "AdditionalFields": {
    "direction": "Out",
    "version": "TLSv12",
    "curve": "x25519",
    "server_name": "edr-cus3.us.endpoint.security.microsoft.com",
    "resumed": "false",
    "next_protocol": "http/1.1",
    "established": "true",
    "subject": "CN=*.endpoint.security.microsoft.com",
    "uid": "CXRdsI15OAFHAOcOyk",
    "issuer": "CN=Microsoft Secure Server CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US",
    "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "ts": "134300492242995840",
    "ja3": "091f51a7a1c3a4504a224cc081ce9cee",
    "ja3s": "00447ab319e9d94ba2b4c1248e155917",
    "ja4": "t12d1809h2_4b22cbed5bed_7af1ed941c26",
    "ja4s": "t1206h1_c02f_17136cd5846b"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 50314,
  "Protocol": "Tcp",
  "RemoteIP": "203.0.113.10",
  "RemotePort": 443,
  "ReportId": 14392,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:13:46.7211352Z"
}

KerberosConnectionInspected: Kerberos connection inspected

Table: DeviceNetworkEvents

Fields #

Name	Description
`ActionType`
`Timestamp`
`DeviceId`
`DeviceName`
`RemoteIP`
`RemotePort`
`LocalIP`
`LocalPort`
`Protocol`
`ReportId`
`AdditionalFields`
`IsInitiatingProcessRemoteSession`

Example Event #

{
  "ActionType": "KerberosConnectionInspected",
  "AdditionalFields": {
    "direction": "Out",
    "success": "true",
    "ticketHash": "0b5d1f6b94eb46028099a2f5273db987fb6e3e50de9d05f71b7dbea003bc32e4",
    "cipher": "aes256-cts-hmac-sha1-96",
    "requestType": "AP",
    "service": "cifs/JD-DC01-2022.ludus.domain/LUDUS.DOMAIN",
    "uid": "CIHVyA1HRLPnV44wb3",
    "ts": "134300457424733840"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LocalIP": "10.2.10.21",
  "LocalPort": 54559,
  "Protocol": "Kerberos",
  "RemoteIP": "10.2.10.11",
  "RemotePort": 445,
  "ReportId": 5578,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:15:45.2152731Z"
}

Defender-DeviceNetworkEvents

any: Network activity

Fields #

Example Event #

Detection Patterns #

Kusto

Lateral Movement: SMB/Windows Admin Shares

Kusto

Kusto

Stealth: Regsvr32

Kusto

Credential Access: Name Resolution Poisoning and SMB Relay

Kusto

Kusto

Execution: Exploitation for Client Execution

Kusto

Execution: User Execution

Kusto

Persistence: Windows Service

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

ConnectionSuccess: Connection succeeded

Fields #

Example Event #

Detection Patterns #

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Kusto

Lateral Movement: SMB/Windows Admin Shares

Kusto

Kusto

Credential Access: Name Resolution Poisoning and SMB Relay

Kusto

Kusto

Execution: User Execution

Kusto

Defense Impairment: Modify Authentication Process

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

ConnectionFailed: Connection failed

Fields #

Example Event #

Detection Patterns #

Kusto

Lateral Movement: SMB/Windows Admin Shares

Kusto

Common Indicators #

InboundConnectionAccepted: Inbound connection accepted

Fields #

Example Event #

Detection Patterns #

Lateral Movement: SMB/Windows Admin Shares

Kusto

Lateral Movement: Windows Remote Management

Kusto

Initial Access: Exploit Public-Facing Application

Kusto

Common Indicators #

Detection Rules #

Kusto #

ListeningConnectionCreated: Listening connection created

Fields #

Example Event #

Common Indicators #

Detection Rules #

Kusto #

Related Events #

ConnectionRequest: Connection request