Defender-DeviceNetworkInfo

any: Device network configuration

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table: DeviceNetworkInfo

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ConnectedNetworks`	2 detection rules	Kusto
`DeviceName`	1 detection rule	Kusto
`NetworkAdapterStatus`	1 detection rule	Kusto

Representative record #

{
  "ConnectedNetworks": [
    {
      "Name": "Network 2",
      "Description": "Network",
      "IsConnectedToInternet": false,
      "Category": "Private"
    }
  ],
  "DefaultGateways": [
    "10.2.10.254"
  ],
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "DnsAddresses": [
    "127.0.0.1",
    "10.2.10.11"
  ],
  "IPAddresses": [
    {
      "IPAddress": "10.2.10.11",
      "SubnetPrefix": 24,
      "AddressType": "Private"
    }
  ],
  "MacAddress": "BC-24-11-41-F2-58",
  "NetworkAdapterName": "{2A7BD48E-DDC6-4641-9F41-682F29F1D76C}",
  "NetworkAdapterStatus": "Up",
  "NetworkAdapterType": "Ethernet",
  "NetworkAdapterVendor": "Proxmox Server Solutions GmbH",
  "ReportId": 639211684813537060,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:02:26.4772765Z",
  "TunnelType": "None"
}

Detection Patterns #

Detect Suspicious Ncrypt Dll

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphEdges any: Exposure graph edgesORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

3 rules

Kusto

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Defender-DeviceInfo any: Device informationORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceNetworkInfo any: Device network configuration

1 rule

Kusto

Hunt for ADWS requests from unknown devices (source)

Robbe Van den Daele

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

RDP Nesting source medium: Query detects potential lateral movement within a network by identifying when an RDP connection (EventID 4624, LogonType 10) is made to an initial system, followed by a subsequent RDP connection from that system to another, using the same account within a 60-minute window. To reduce false positives, it excludes scenarios where the same account has made 5 or more connections to the same set of computers in the previous 7 days. This approach focuses on highlighting unusual RDP behaviour that suggests lateral movement, which is often associated with attacker tactics during a network breach.T1021
Hunt Device Discovery Subnet Ranges source: This KQL query helps you identify which subnet ranges are behind the Microsoft Defender for Endpoint Device Discovery 'Monitored Networks' page. By using this query you can investigate if all of your corporate networks are being monitored and change monitored states effectivly. More information can be found in the references.
Hunt for devices organized by subnet source: This rule helps you organize devices by subnet in your networks. By doing this, you can identify how many not-onboarded devices, devices not supporting MDE containment, and types of devices live in your subnet ranges.

Show 1 more (4 total) on the rules page

Defender-DeviceNetworkInfo

any: Device network configuration

Detection Fields #

Representative record #

Detection Patterns #

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Kusto

Detection Rules #

Kusto #

References #