Defender-DeviceNetworkInfo

ActionType	Title	Sample	Rule
any	Device network configuration	Y	Y

any: Device network configuration

Table: DeviceNetworkInfo

Fields #

Name	Description	Rules
`Timestamp`
`DeviceId`
`DeviceName`
`NetworkAdapterName`
`MacAddress`
`NetworkAdapterType`
`NetworkAdapterStatus`		1 detection rule
`TunnelType`
`ConnectedNetworks`
`DnsAddresses`
`IPv4Dhcp`
`IPv6Dhcp`
`DefaultGateways`
`IPAddresses`
`ReportId`
`NetworkAdapterVendor`
`OnboardingStatus`
`NetworkAdapterDnsSuffix`

Example Event #

{
  "ConnectedNetworks": [
    {
      "Name": "Network 2",
      "Description": "Network",
      "IsConnectedToInternet": false,
      "Category": "Private"
    }
  ],
  "DefaultGateways": [
    "10.2.10.254"
  ],
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "DnsAddresses": [
    "127.0.0.1",
    "10.2.10.11"
  ],
  "IPAddresses": [
    {
      "IPAddress": "10.2.10.11",
      "SubnetPrefix": 24,
      "AddressType": "Private"
    }
  ],
  "MacAddress": "BC-24-11-41-F2-58",
  "NetworkAdapterName": "{2A7BD48E-DDC6-4641-9F41-682F29F1D76C}",
  "NetworkAdapterStatus": "Up",
  "NetworkAdapterType": "Ethernet",
  "NetworkAdapterVendor": "Proxmox Server Solutions GmbH",
  "ReportId": 639211684813537060,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:02:26.4772765Z",
  "TunnelType": "None"
}

Detection Patterns #

Detect Suspicious Ncrypt Dll

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphEdges any: Exposure graph edgesORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

3 rules

Kusto

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Defender-DeviceInfo any: Device informationORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceNetworkInfo any: Device network configuration

1 rule

Kusto

Hunt for ADWS requests from unknown devices (source)

Robbe Van den Daele

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`OnboardingStatus` (kusto rule field)	ne	`Onboarded`	4 rules	kusto
`ActionType` (kusto rule field)	eq	`ConnectionSuccess`	3 rules	kusto
`ActionType` (kusto rule field)	ne	`ListeningConnectionCreated`	1 rule	kusto
`ActionType` (kusto rule field)	starts_with	`AppControl`	2 rules	kusto
`DestinationPort` (kusto rule field)	eq	`3389`	3 rules	kusto
`DestinationPort` (kusto rule field)	in	`135`	1 rule	kusto
`NodeLabel` (kusto rule field)	eq	`device`	3 rules	kusto
`TpmActivated` (kusto rule field)	ne	`true`	3 rules	kusto
`TpmEnabled` (kusto rule field)	ne	`true`	3 rules	kusto
`TpmSupported` (kusto rule field)	ne	`true`	3 rules	kusto
`parent_process_name` (kusto rule field)	ne	`microsoft.tri.sensor.exe`	3 rules	kusto
`type` (kusto rule field)	eq	`DeviceInventoryId`	3 rules	kusto
`DestinationHostname` (kusto rule field)	eq	`login.microsoftonline.com`	2 rules	kusto
`file_name` (kusto rule field)	eq	`ncrypt.dll`	2 rules	kusto
`ClientIP` (kusto rule field)	is_not_null		1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

RDP Nesting source medium: Query detects potential lateral movement within a network by identifying when an RDP connection (EventID 4624, LogonType 10) is made to an initial system, followed by a subsequent RDP connection from that system to another, using the same account within a 60-minute window. To reduce false positives, it excludes scenarios where the same account has made 5 or more connections to the same set of computers in the previous 7 days. This approach focuses on highlighting unusual RDP behaviour that suggests lateral movement, which is often associated with attacker tactics during a network breach.T1021
Hunt Device Discovery Subnet Ranges source: This KQL query helps you identify which subnet ranges are behind the Microsoft Defender for Endpoint Device Discovery 'Monitored Networks' page. By using this query you can investigate if all of your corporate networks are being monitored and change monitored states effectivly. More information can be found in the references.
Hunt for devices organized by subnet source: This rule helps you organize devices by subnet in your networks. By doing this, you can identify how many not-onboarded devices, devices not supporting MDE containment, and types of devices live in your subnet ranges.

Show 1 more (4 total) on the rules page

Defender-DeviceNetworkInfo

any: Device network configuration

Fields #

Example Event #

Detection Patterns #

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Kusto

Common Indicators #

Detection Rules #

Kusto #

References #