Defender-ExposureGraphEdges

ActionType	Title	Sample	Rule
any	Exposure graph edges	Y	Y

any: Exposure graph edges

Table: ExposureGraphEdges

Fields #

Name	Description
`EdgeId`
`EdgeLabel`
`SourceNodeId`
`SourceNodeName`
`SourceNodeLabel`
`SourceNodeCategories`
`TargetNodeId`
`TargetNodeName`
`TargetNodeLabel`
`TargetNodeCategories`
`EdgeProperties`

Example Event #

{
  "EdgeId": "00000000-0000-0000-0000-000000000001_CB5887B0C1018BF3993BCEA65E1D089F",
  "EdgeLabel": "has role on",
  "EdgeProperties": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "rawData": {
      "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
      "acl": {
        "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
        "controlTypes": [
          "allValidatedRights",
          "writeDacl",
          "writeOwner"
        ],
        "controlTypes@odata.type": "#Collection(String)",
        "type": "ACL"
      }
    }
  },
  "SourceNodeCategories": [
    "environmentAzure",
    "environmentCloud",
    "identities",
    "identity",
    "user_group"
  ],
  "SourceNodeCategories@odata.type": "#Collection(String)",
  "SourceNodeId": "a159cbf029ed4312aa433c99287a23c6",
  "SourceNodeLabel": "group",
  "SourceNodeName": "Domain Admins",
  "TargetNodeCategories": [
    "environmentAzure",
    "environmentCloud",
    "identities",
    "identity",
    "user_group"
  ],
  "TargetNodeCategories@odata.type": "#Collection(String)",
  "TargetNodeId": "6df54631f61243e3a11c531f4819d990",
  "TargetNodeLabel": "group",
  "TargetNodeName": "Schema Admins"
}

Detection Patterns #

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphEdges any: Exposure graph edgesORDefender-ExposureGraphNodes any: Exposure graph nodes

1 rule

Kusto

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`TpmActivated` (kusto rule field)	ne	`true`	2 rules	kusto
`TpmEnabled` (kusto rule field)	ne	`true`	2 rules	kusto
`TpmSupported` (kusto rule field)	ne	`true`	2 rules	kusto
`type` (kusto rule field)	eq	`DeviceInventoryId`	2 rules	kusto
`ActionType` (kusto rule field)	starts_with	`AppControl`	1 rule	kusto
`DestinationHostname` (kusto rule field)	eq	`login.microsoftonline.com`	1 rule	kusto
`NodeLabel` (kusto rule field)	eq	`device`	1 rule	kusto
`OnboardingStatus` (kusto rule field)	ne	`Onboarded`	1 rule	kusto
`file_name` (kusto rule field)	eq	`ncrypt.dll`	1 rule	kusto
`parent_process_name` (kusto rule field)	ne	`microsoft.tri.sensor.exe`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Hunt for critical credentials on devices with non-critical accounts source: In most organizations normal user accounts or accounts with low risk permissions have less security controls enabled. This because there are less security controls needed in order to minize the risk vectors that come with these accounts. If these accounts are used on devices where critical account credentials are also present, the critical user account can be compromised more easily when the device is accessed by an adversary via the non-critical user account. Because of this, a Privileged Access Workstation should be used which serves as a dedicated workstation for the critical accounts. By doing this, the critical user account cannot be compromised via a unhardened device.T1078
Hunt for critical credentials on non Credential Guard enabled devices source: This query searches for devices that does not have Credential Guard enabled but contains critical credentials. The output shows for how many users each non Credential Guard device has credentials, together with the list of users being exposed.
Hunt for critical credentials on non-TPM enabled devices source: This query searches for devices that does not have a TPM (Trusted Platform Module) enabled but contains critical credentials. The output shows for how many users each non-TPM device has credentials, together with the rules why each user is considered a critical user.

Show 1 more (4 total) on the rules page

References #

Microsoft Defender XDR: advanced hunting reference