Defender-DeviceProcessEvents

ActionType	Title	Sample	Rule
any	Process activity	Y	Y
ProcessCreated	Process created	Y	Y
OpenProcess	Process handle opened	N	N

any: Process activity

Table: DeviceProcessEvents

Fields #

Name	Description	Rules
`DeviceId`
`DeviceName`
`Timestamp`
`ActionType`
`FileName`		22 detection rules
`FolderPath`
`SHA1`
`SHA256`		1 detection rule
`MD5`
`ProcessId`
`ProcessCommandLine`
`AccountName`
`AccountDomain`
`InitiatingProcessFileName`		14 detection rules
`InitiatingProcessFolderPath`
`InitiatingProcessSHA256`
`InitiatingProcessCommandLine`
`InitiatingProcessAccountName`
`InitiatingProcessAccountDomain`
`InitiatingProcessParentFileName`		2 detection rules

Example Event #

{
  "AccountDomain": "nt authority",
  "AccountName": "network service",
  "AccountSid": "S-1-5-20",
  "ActionType": "ProcessCreated",
  "CreatedProcessSessionId": 0,
  "CreatedProcessSessionId@odata.type": "#Int64",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "MpCmdRun.exe",
  "FileSize": 1893920,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26060.3008-0\\MpCmdRun.exe",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"MsMpEng.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:40.6829454Z",
  "InitiatingProcessFileName": "msmpeng.exe",
  "InitiatingProcessFileSize": 290704,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.26060.3008-0\\msmpeng.exe",
  "InitiatingProcessId": 4580,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "bfa930edc3aea262d3a74e71263f6e41",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d94df701fb5f2e89d902e8bcef19b8d52a12b65a",
  "InitiatingProcessSHA256": "35979bf35eea166dd17d81b50ceae41043e4ae1082f4ed25383adffd9d88de4a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessSignatureStatus": "Valid",
  "InitiatingProcessSignerType": "OsVendor",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873058",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Antimalware Service Executable",
  "InitiatingProcessVersionInfoInternalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "4.18.26060.3008",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 996,
  "LogonId@odata.type": "#Int64",
  "MD5": "50748135411ab2227a961757d96fb456",
  "ProcessCommandLine": "\"MpCmdRun.exe\" GetDeviceTicket -AccessKey 3474F9D5-96F4-6236-8080-E8299426B055 ",
  "ProcessCreationTime": "2026-08-01T09:19:44.5639533Z",
  "ProcessId": 10356,
  "ProcessId@odata.type": "#Int64",
  "ProcessIntegrityLevel": "System",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ProcessUniqueId": "9851624184879170",
  "ProcessVersionInfoCompanyName": "Microsoft Corporation",
  "ProcessVersionInfoFileDescription": "Microsoft Malware Protection Command Line Utility",
  "ProcessVersionInfoInternalFileName": "MpCmdRun",
  "ProcessVersionInfoOriginalFileName": "MpCmdRun.exe",
  "ProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "ProcessVersionInfoProductVersion": "4.18.26060.3008",
  "ReportId": 14402,
  "ReportId@odata.type": "#Int64",
  "SHA1": "b92bf73d510217422e180fd7a09dafe6410f90e0",
  "SHA256": "556d0de327089f436d461486b953a97dbd26c458c2c4f01d59d6d4217025cf26",
  "Timestamp": "2026-08-01T09:19:44.570542Z"
}

Detection Patterns #

Defender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

4 rules

Kusto

Regsvr32 Rundll32 with Anomalous Parent Process (source)

Detect Msiexec executing DLL network connections (source)

Robbe Van den Daele

DCOM Lateral Movement (source)

Show 1 more (4 total) on the rules page

Defender-DeviceProcessEvents any: Process activityORProcessCreated: Process created

3 rules

Kusto

SQL Server spawning suspicious child process (source)

FalconForce

Unsigned Windows System Binary (source)

FalconForce

PRT Credential Stealing (source)

FalconForce

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents any: Network activityORInboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceProcessEvents any: Process activity

3 rules

Kusto

DCOM Lateral Movement (source)

SMB/Windows Admin Shares (source)

Detect Unknown process launched via WinRM (source)

Robbe Van den Daele

Lateral Movement: Windows Remote Management

Defender-DeviceNetworkEvents InboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceProcessEvents any: Process activity

2 rules

Kusto

SMB/Windows Admin Shares (source)

Detect Unknown process launched via WinRM (source)

Robbe Van den Daele

Defender-DeviceFileEvents any: File activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Ingress Tool Transfer - Certutil (source)

Show All Detection Patterns

Execution: Exploitation for Client Execution

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activityORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devices

1 rule

Kusto

Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 (source)

Persistence: Windows Service

Defender-DeviceFileEvents any: File activityORDefender-DeviceImageLoadEvents any: Image loadORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Rare Process as a Service (source)

Persistence: Compromise Host Software Binary

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileModified: File modifiedORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Potential Build Process Compromise - MDE (source)

Stealth: Create Process with Token

Defender-DeviceLogonEvents any: Logon activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Access Token Manipulation - Create Process with Token (source)

Lateral Movement: Remote Desktop Protocol

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Remote Desktop Protocol - SharpRDP (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`file_name` (kusto rule field)	eq	`powershell.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`cmd.exe`	4 rules	kusto
`file_name` (kusto rule field)	in	`at.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`bitsadmin.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`certutil.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`cmstp.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`cscript.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`installutil.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`mavinject.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`msbuild.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`mshta.exe`	3 rules	kusto
`file_name` (kusto rule field)	in	`msiexec.exe`	3 rules	kusto
`ActionType` (kusto rule field)	eq	`InboundConnectionAccepted`	3 rules	kusto
`ActionType` (kusto rule field)	eq	`processcreated`	3 rules	kusto
`IntegrityLevel` (kusto rule field)	eq	`High`	3 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

SUNBURST suspicious SolarWinds child processes source medium: Identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
Audit policy manipulation using auditpol utility source medium: This detects attempts to manipulate audit policies using auditpol command. This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks. The process name in each data source is commented out as an adversary could rename it. It is advisable to keep process name commented but if the results show unrelated false positives, users may want to uncomment it. Refer to auditpol syntax: https://docs.microsoft.com/windows-server/administration/windows-commands/auditpol
Refer to our M365 blog for details on use during the Solorigate attack: https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/T1204
Dev-0228 File Path Hashes November 2021 source high: This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity. The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.T1003, T1569

Show 17 more (51 total) on the rules page

ProcessCreated: Process created

Table: DeviceProcessEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA256`
`ProcessCommandLine`
`AccountName`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

Example Event #

{
  "AccountDomain": "nt authority",
  "AccountName": "network service",
  "AccountSid": "S-1-5-20",
  "ActionType": "ProcessCreated",
  "CreatedProcessSessionId": 0,
  "CreatedProcessSessionId@odata.type": "#Int64",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "MpCmdRun.exe",
  "FileSize": 1893920,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26060.3008-0\\MpCmdRun.exe",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"MsMpEng.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:40.6829454Z",
  "InitiatingProcessFileName": "msmpeng.exe",
  "InitiatingProcessFileSize": 290704,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.26060.3008-0\\msmpeng.exe",
  "InitiatingProcessId": 4580,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "bfa930edc3aea262d3a74e71263f6e41",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d94df701fb5f2e89d902e8bcef19b8d52a12b65a",
  "InitiatingProcessSHA256": "35979bf35eea166dd17d81b50ceae41043e4ae1082f4ed25383adffd9d88de4a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessSignatureStatus": "Valid",
  "InitiatingProcessSignerType": "OsVendor",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873058",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Antimalware Service Executable",
  "InitiatingProcessVersionInfoInternalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "4.18.26060.3008",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 996,
  "LogonId@odata.type": "#Int64",
  "MD5": "50748135411ab2227a961757d96fb456",
  "ProcessCommandLine": "\"MpCmdRun.exe\" GetDeviceTicket -AccessKey 3474F9D5-96F4-6236-8080-E8299426B055 ",
  "ProcessCreationTime": "2026-08-01T09:19:44.5639533Z",
  "ProcessId": 10356,
  "ProcessId@odata.type": "#Int64",
  "ProcessIntegrityLevel": "System",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ProcessUniqueId": "9851624184879170",
  "ProcessVersionInfoCompanyName": "Microsoft Corporation",
  "ProcessVersionInfoFileDescription": "Microsoft Malware Protection Command Line Utility",
  "ProcessVersionInfoInternalFileName": "MpCmdRun",
  "ProcessVersionInfoOriginalFileName": "MpCmdRun.exe",
  "ProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "ProcessVersionInfoProductVersion": "4.18.26060.3008",
  "ReportId": 14402,
  "ReportId@odata.type": "#Int64",
  "SHA1": "b92bf73d510217422e180fd7a09dafe6410f90e0",
  "SHA256": "556d0de327089f436d461486b953a97dbd26c458c2c4f01d59d6d4217025cf26",
  "Timestamp": "2026-08-01T09:19:44.570542Z"
}

Detection Patterns #

Defender-DeviceProcessEvents any: Process activityORProcessCreated: Process created

3 rules

Kusto

SQL Server spawning suspicious child process (source)

FalconForce

Unsigned Windows System Binary (source)

FalconForce

PRT Credential Stealing (source)

FalconForce

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileRenamed: File renamedORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious MSC File Launched (source)

FalconForce

Execution: User Execution

Defender-DeviceFileEvents FileCreated: File createdORFileRenamed: File renamedORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious office child process created (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`processcreated`	6 rules	kusto
`ActionType` (kusto rule field)	eq	`ProcessCreated`	2 rules	kusto
`ActionType` (kusto rule field)	eq	`ConnectionSuccess`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`FileRenamed`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`ListeningConnectionCreated`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`NamedPipeEvent`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	is_null		1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`200`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`250`	1 rule	kusto
`sha1` (kusto rule field)	is_not_null		2 rules	kusto
`DestinationPort` (kusto rule field)	in	`389`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`636`	1 rule	kusto
`IsCertificateValid` (kusto rule field)	ne	`1`	1 rule	kusto
`OriginalFileName` (kusto rule field)	eq	`browsercore.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Masquerading Renamed executables of interest source: This query searches for the original file name of a set of binaries that is known to be used by attackers. The OriginalFileName field is then matched to the actual file name. Where there isn't a match the results are returned, indicating the file has been renamed. The original file name field is derived from the PE header of the executable, which is the name of the binary during compilation.T1036, T1036.003
Persistence Via Scheduled Tasks source: This query identifies binaries that run as a scheduled task, by looking at the parent process command line. Of the identified binaries running as scheduled tasks it finds suspicious binaries by looking at the file signature and global prevalence.T1053, T1053.005
Potential Kerberos Relaying Activity - MDE source: The below query detects potential Kerberos relaying event chain generated by KrbRelay.↳ also matches any: Process activity

OpenProcess: Process handle opened

Table: DeviceProcessEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`ProcessCommandLine`
`AccountName`
`InitiatingProcessFileName`
`InitiatingProcessCommandLine`

Defender-DeviceProcessEvents

any: Process activity

Fields #

Example Event #

Detection Patterns #

Kusto

Kusto

Lateral Movement: SMB/Windows Admin Shares

Kusto

Lateral Movement: Windows Remote Management

Kusto

Kusto

Execution: Exploitation for Client Execution

Kusto

Persistence: Windows Service

Kusto

Persistence: Compromise Host Software Binary

Kusto

Stealth: Create Process with Token

Kusto

Lateral Movement: Remote Desktop Protocol

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

ProcessCreated: Process created

Fields #

Example Event #

Detection Patterns #

Kusto

Kusto

Execution: User Execution

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

OpenProcess: Process handle opened

Fields #

References #