detection.wiki

Defender-ExposureGraphEdges

any: Exposure graph edges

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
ExposureGraphEdges

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

NameRulesVendors
EdgeLabel1 detection ruleKusto
SourceNodeLabel1 detection ruleKusto
SourceNodeName1 detection ruleKusto
TargetNodeName1 detection ruleKusto

Representative record #

{
  "EdgeId": "00000000-0000-0000-0000-000000000001_CB5887B0C1018BF3993BCEA65E1D089F",
  "EdgeLabel": "has role on",
  "EdgeProperties": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "rawData": {
      "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
      "acl": {
        "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
        "controlTypes": [
          "allValidatedRights",
          "writeDacl",
          "writeOwner"
        ],
        "controlTypes@odata.type": "#Collection(String)",
        "type": "ACL"
      }
    }
  },
  "SourceNodeCategories": [
    "environmentAzure",
    "environmentCloud",
    "identities",
    "identity",
    "user_group"
  ],
  "SourceNodeCategories@odata.type": "#Collection(String)",
  "SourceNodeId": "a159cbf029ed4312aa433c99287a23c6",
  "SourceNodeLabel": "group",
  "SourceNodeName": "Domain Admins",
  "TargetNodeCategories": [
    "environmentAzure",
    "environmentCloud",
    "identities",
    "identity",
    "user_group"
  ],
  "TargetNodeCategories@odata.type": "#Collection(String)",
  "TargetNodeId": "6df54631f61243e3a11c531f4819d990",
  "TargetNodeLabel": "group",
  "TargetNodeName": "Schema Admins"
}

Detection Patterns #

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

  • Hunt for critical credentials on devices with non-critical accounts source: In most organizations normal user accounts or accounts with low risk permissions have less security controls enabled. This because there are less security controls needed in order to minize the risk vectors that come with these accounts. If these accounts are used on devices where critical account credentials are also present, the critical user account can be compromised more easily when the device is accessed by an adversary via the non-critical user account. Because of this, a Privileged Access Workstation should be used which serves as a dedicated workstation for the critical accounts. By doing this, the critical user account cannot be compromised via a unhardened device.T1078
  • Hunt for critical credentials on non Credential Guard enabled devices source: This query searches for devices that does not have Credential Guard enabled but contains critical credentials. The output shows for how many users each non Credential Guard device has credentials, together with the list of users being exposed.
  • Hunt for critical credentials on non-TPM enabled devices source: This query searches for devices that does not have a TPM (Trusted Platform Module) enabled but contains critical credentials. The output shows for how many users each non-TPM device has credentials, together with the rules why each user is considered a critical user.

Show 1 more (4 total) on the rules page

References #