Defender-DeviceProcessEvents

ActionType	Title	Sample	Rule
ProcessCreated	Process created	Y	Y
OpenProcess	Process handle opened	N	N

ProcessCreated: Process created

Table: DeviceProcessEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ActionType`	8 detection rules	Kusto
`FileName`	4 detection rules	Kusto
`InitiatingProcessCommandLine`	3 detection rules	Kusto
`FolderPath`	2 detection rules	Kusto
`InitiatingProcessFileName`	2 detection rules	Kusto
`InitiatingProcessParentFileName`	2 detection rules	Kusto
`InitiatingProcessSHA1`	1 detection rule	Kusto
`ProcessCommandLine`	1 detection rule	Kusto
`ProcessVersionInfoOriginalFileName`	1 detection rule	Kusto
`SHA1`	1 detection rule	Kusto

Example Event #

{
  "AccountDomain": "nt authority",
  "AccountName": "network service",
  "AccountSid": "S-1-5-20",
  "ActionType": "ProcessCreated",
  "CreatedProcessSessionId": 0,
  "CreatedProcessSessionId@odata.type": "#Int64",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "MpCmdRun.exe",
  "FileSize": 1893920,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26060.3008-0\\MpCmdRun.exe",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"MsMpEng.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:40.6829454Z",
  "InitiatingProcessFileName": "msmpeng.exe",
  "InitiatingProcessFileSize": 290704,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.26060.3008-0\\msmpeng.exe",
  "InitiatingProcessId": 4580,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "bfa930edc3aea262d3a74e71263f6e41",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d94df701fb5f2e89d902e8bcef19b8d52a12b65a",
  "InitiatingProcessSHA256": "35979bf35eea166dd17d81b50ceae41043e4ae1082f4ed25383adffd9d88de4a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessSignatureStatus": "Valid",
  "InitiatingProcessSignerType": "OsVendor",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873058",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Antimalware Service Executable",
  "InitiatingProcessVersionInfoInternalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "4.18.26060.3008",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 996,
  "LogonId@odata.type": "#Int64",
  "MD5": "50748135411ab2227a961757d96fb456",
  "ProcessCommandLine": "\"MpCmdRun.exe\" GetDeviceTicket -AccessKey 3474F9D5-96F4-6236-8080-E8299426B055 ",
  "ProcessCreationTime": "2026-08-01T09:19:44.5639533Z",
  "ProcessId": 10356,
  "ProcessId@odata.type": "#Int64",
  "ProcessIntegrityLevel": "System",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ProcessUniqueId": "9851624184879170",
  "ProcessVersionInfoCompanyName": "Microsoft Corporation",
  "ProcessVersionInfoFileDescription": "Microsoft Malware Protection Command Line Utility",
  "ProcessVersionInfoInternalFileName": "MpCmdRun",
  "ProcessVersionInfoOriginalFileName": "MpCmdRun.exe",
  "ProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "ProcessVersionInfoProductVersion": "4.18.26060.3008",
  "ReportId": 14402,
  "ReportId@odata.type": "#Int64",
  "SHA1": "b92bf73d510217422e180fd7a09dafe6410f90e0",
  "SHA256": "556d0de327089f436d461486b953a97dbd26c458c2c4f01d59d6d4217025cf26",
  "Timestamp": "2026-08-01T09:19:44.570542Z"
}

Detection Patterns #

Defender-DeviceProcessEvents any: Process activityORProcessCreated: Process created

3 rules

Kusto

SQL Server spawning suspicious child process (source)

FalconForce

Unsigned Windows System Binary (source)

FalconForce

PRT Credential Stealing (source)

FalconForce

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileRenamed: File renamedORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious MSC File Launched (source)

FalconForce

Execution: User Execution

Defender-DeviceFileEvents FileCreated: File createdORFileRenamed: File renamedORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORDefender-DeviceProcessEvents ProcessCreated: Process created

1 rule

Kusto

Suspicious office child process created (source)

FalconForce

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`ProcessCreated`	4 rules	kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

Masquerading Renamed executables of interest source: This query searches for the original file name of a set of binaries that is known to be used by attackers. The OriginalFileName field is then matched to the actual file name. Where there isn't a match the results are returned, indicating the file has been renamed. The original file name field is derived from the PE header of the executable, which is the name of the binary during compilation.T1036, T1036.003
Persistence Via Scheduled Tasks source: This query identifies binaries that run as a scheduled task, by looking at the parent process command line. Of the identified binaries running as scheduled tasks it finds suspicious binaries by looking at the file signature and global prevalence.T1053, T1053.005
Potential Kerberos Relaying Activity - MDE source: The below query detects potential Kerberos relaying event chain generated by KrbRelay.↳ also matches any: Process activity

OpenProcess: Process handle opened

Table: DeviceProcessEvents

any: Process activity

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table: DeviceProcessEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`InitiatingProcessFileName`	33 detection rules	Kusto
`FileName`	32 detection rules	Kusto
`ProcessCommandLine`	28 detection rules	Kusto
`InitiatingProcessCommandLine`	17 detection rules	Kusto
`InitiatingProcessParentFileName`	9 detection rules	Kusto
`FolderPath`	6 detection rules	Kusto
`ActionType`	4 detection rules	Kusto
`ProcessIntegrityLevel`	4 detection rules	Kusto
`AccountName`	3 detection rules	Kusto
`InitiatingProcessFolderPath`	2 detection rules	Kusto
`ProcessVersionInfoOriginalFileName`	2 detection rules	Kusto
`SHA1`	2 detection rules	Kusto
`SHA256`	2 detection rules	Kusto
`DeviceName`	1 detection rule	Kusto
`InitiatingProcessSHA256`	1 detection rule	Kusto

Representative record #

{
  "AccountDomain": "nt authority",
  "AccountName": "network service",
  "AccountSid": "S-1-5-20",
  "ActionType": "ProcessCreated",
  "CreatedProcessSessionId": 0,
  "CreatedProcessSessionId@odata.type": "#Int64",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "MpCmdRun.exe",
  "FileSize": 1893920,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26060.3008-0\\MpCmdRun.exe",
  "InitiatingProcessAccountDomain": "nt authority",
  "InitiatingProcessAccountName": "system",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "\"MsMpEng.exe\"",
  "InitiatingProcessCreationTime": "2026-08-01T00:56:40.6829454Z",
  "InitiatingProcessFileName": "msmpeng.exe",
  "InitiatingProcessFileSize": 290704,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.26060.3008-0\\msmpeng.exe",
  "InitiatingProcessId": 4580,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessLogonId": 0,
  "InitiatingProcessLogonId@odata.type": "#Int64",
  "InitiatingProcessMD5": "bfa930edc3aea262d3a74e71263f6e41",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:34.7240107Z",
  "InitiatingProcessParentFileName": "services.exe",
  "InitiatingProcessParentId": 1084,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "d94df701fb5f2e89d902e8bcef19b8d52a12b65a",
  "InitiatingProcessSHA256": "35979bf35eea166dd17d81b50ceae41043e4ae1082f4ed25383adffd9d88de4a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessSignatureStatus": "Valid",
  "InitiatingProcessSignerType": "OsVendor",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873058",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Antimalware Service Executable",
  "InitiatingProcessVersionInfoInternalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "MsMpEng.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "4.18.26060.3008",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "IsProcessRemoteSession": 0,
  "IsProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 996,
  "LogonId@odata.type": "#Int64",
  "MD5": "50748135411ab2227a961757d96fb456",
  "ProcessCommandLine": "\"MpCmdRun.exe\" GetDeviceTicket -AccessKey 3474F9D5-96F4-6236-8080-E8299426B055 ",
  "ProcessCreationTime": "2026-08-01T09:19:44.5639533Z",
  "ProcessId": 10356,
  "ProcessId@odata.type": "#Int64",
  "ProcessIntegrityLevel": "System",
  "ProcessTokenElevation": "TokenElevationTypeDefault",
  "ProcessUniqueId": "9851624184879170",
  "ProcessVersionInfoCompanyName": "Microsoft Corporation",
  "ProcessVersionInfoFileDescription": "Microsoft Malware Protection Command Line Utility",
  "ProcessVersionInfoInternalFileName": "MpCmdRun",
  "ProcessVersionInfoOriginalFileName": "MpCmdRun.exe",
  "ProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "ProcessVersionInfoProductVersion": "4.18.26060.3008",
  "ReportId": 14402,
  "ReportId@odata.type": "#Int64",
  "SHA1": "b92bf73d510217422e180fd7a09dafe6410f90e0",
  "SHA256": "556d0de327089f436d461486b953a97dbd26c458c2c4f01d59d6d4217025cf26",
  "Timestamp": "2026-08-01T09:19:44.570542Z"
}

Detection Patterns #

Defender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

4 rules

Kusto

Regsvr32 Rundll32 with Anomalous Parent Process (source)

Detect Msiexec executing DLL network connections (source)

Robbe Van den Daele

DCOM Lateral Movement (source)

Show 1 more (4 total) on the rules page

Defender-DeviceProcessEvents any: Process activityORProcessCreated: Process created

3 rules

Kusto

SQL Server spawning suspicious child process (source)

FalconForce

Unsigned Windows System Binary (source)

FalconForce

PRT Credential Stealing (source)

FalconForce

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents any: Network activityORInboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceProcessEvents any: Process activity

3 rules

Kusto

DCOM Lateral Movement (source)

SMB/Windows Admin Shares (source)

Detect Unknown process launched via WinRM (source)

Robbe Van den Daele

Lateral Movement: Windows Remote Management

Defender-DeviceNetworkEvents InboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceProcessEvents any: Process activity

2 rules

Kusto

SMB/Windows Admin Shares (source)

Detect Unknown process launched via WinRM (source)

Robbe Van den Daele

Defender-DeviceFileEvents any: File activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Ingress Tool Transfer - Certutil (source)

Show All Detection Patterns

Execution: Exploitation for Client Execution

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activityORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devices

1 rule

Kusto

Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 (source)

Persistence: Windows Service

Defender-DeviceFileEvents any: File activityORDefender-DeviceImageLoadEvents any: Image loadORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Rare Process as a Service (source)

Persistence: Compromise Host Software Binary

Defender-DeviceFileEvents any: File activityORFileCreated: File createdORFileModified: File modifiedORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Potential Build Process Compromise - MDE (source)

Stealth: Create Process with Token

Defender-DeviceLogonEvents any: Logon activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Access Token Manipulation - Create Process with Token (source)

Lateral Movement: Remote Desktop Protocol

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Remote Desktop Protocol - SharpRDP (source)

Common Indicators #

Field	Kind	Value	Rules	Vendors
`IntegrityLevel` (kusto rule field)	eq	`High`	3 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`add`	3 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`"HKLM\SOFTWARE\Policies\`	2 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`"reg"`	2 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`/add`	2 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`/d`	2 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`/f`	2 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`/t`	2 rules	kusto
`ParentCommandLine` (kusto rule field)	contains	`/v`	2 rules	kusto
`process_basename` (kusto rule field)	eq	`PowerShell.EXE`	3 rules	kusto
`ActionType` (kusto rule field)	eq	`ProcessCreated`	2 rules	kusto
`CommandLine` (kusto rule field)	contains	`-accepteula`	2 rules	kusto
`CommandLine` (kusto rule field)	contains	`-ma`	2 rules	kusto
`CommandLine` (kusto rule field)	contains	`add`	2 rules	kusto
`CommandLine` (kusto rule field)	contains	`lsass`	2 rules	kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

SUNBURST suspicious SolarWinds child processes source medium: Identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
Audit policy manipulation using auditpol utility source medium: This detects attempts to manipulate audit policies using auditpol command. This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks. The process name in each data source is commented out as an adversary could rename it. It is advisable to keep process name commented but if the results show unrelated false positives, users may want to uncomment it. Refer to auditpol syntax: https://docs.microsoft.com/windows-server/administration/windows-commands/auditpol
Refer to our M365 blog for details on use during the Solorigate attack: https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/T1204
Dev-0228 File Path Hashes November 2021 source high: This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity. The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.T1003, T1569

Show 17 more (51 total) on the rules page

Defender-DeviceProcessEvents

ProcessCreated: Process created

Detection Fields #

Example Event #

Detection Patterns #

Kusto

Kusto

Execution: User Execution

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

OpenProcess: Process handle opened

any: Process activity

Detection Fields #

Representative record #

Detection Patterns #

Kusto

Kusto

Lateral Movement: SMB/Windows Admin Shares

Kusto

Lateral Movement: Windows Remote Management

Kusto

Kusto

Execution: Exploitation for Client Execution

Kusto

Persistence: Windows Service

Kusto

Persistence: Compromise Host Software Binary

Kusto

Stealth: Create Process with Token

Kusto

Lateral Movement: Remote Desktop Protocol

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

References #