detection.wiki

Defender-ExposureGraphNodes

any: Exposure graph nodes

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
ExposureGraphNodes

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

NameRulesVendors
NodeLabel1 detection ruleKusto

Representative record #

{
  "Categories": [
    "AI",
    "ai_model"
  ],
  "Categories@odata.type": "#Collection(String)",
  "EntityIds": [
    {
      "type": "AiModelNameAndVersion",
      "id": "name=microsoft-phi-1-5;version=8"
    }
  ],
  "EntityIds@odata.type": "#Collection(String)",
  "NodeId": "1a2a38317dcd488f9918c9dfa8c4c44f",
  "NodeLabel": "baseModel",
  "NodeName": "microsoft-phi-1-5 version 8",
  "NodeProperties": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "rawData": {
      "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
      "aiModelMetadata": {
        "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
        "baseModelName": "",
        "baseModelVersion": "",
        "collectionType": "",
        "createdBy": "azureml-msr",
        "creationTime": "0001-01-01T00:00:00.0000000Z",
        "depricationDate": "0001-01-01T00:00:00.0000000Z",
        "modelName": "microsoft-phi-1-5",
        "modelVersion": "8",
        "type": "AiModelMetadata"
      }
    }
  }
}

Detection Patterns #

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

  • Hunt for local AI Agent activity with Agent Info source: This query allows you to find the activity a local AI Agent performed via the CloudAppEvents table using the AgentsInfo and ExposureGraphNodes table.
  • Hunt for Defender for Identity not installed but eligible source: This query shows you which servers are eligible for Defender for identity but does not have the Defender for Identity agent installed. The query seach the eligible servers via Defender for Endpoint (requirement for this query to work), and is based on the server roles that MDE recongnizes.
  • Hunt for accounts with leaked credentials source: This query searches for accounts where Exposure Management detected leaked credentials. This query is correlated with the IdentityInfo table, mainly because you can easily create a detection of this rule if you would like to.

Show 2 more (5 total) on the rules page

References #