Defender-ExposureGraphNodes

ActionType	Title	Sample	Rule
any	Exposure graph nodes	Y	Y

any: Exposure graph nodes

Table: ExposureGraphNodes

Fields #

Name	Description
`NodeId`
`NodeLabel`
`NodeName`
`Categories`
`NodeProperties`
`EntityIds`

Example Event #

{
  "Categories": [
    "AI",
    "ai_model"
  ],
  "Categories@odata.type": "#Collection(String)",
  "EntityIds": [
    {
      "type": "AiModelNameAndVersion",
      "id": "name=microsoft-phi-1-5;version=8"
    }
  ],
  "EntityIds@odata.type": "#Collection(String)",
  "NodeId": "1a2a38317dcd488f9918c9dfa8c4c44f",
  "NodeLabel": "baseModel",
  "NodeName": "microsoft-phi-1-5 version 8",
  "NodeProperties": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "rawData": {
      "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
      "aiModelMetadata": {
        "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
        "baseModelName": "",
        "baseModelVersion": "",
        "collectionType": "",
        "createdBy": "azureml-msr",
        "creationTime": "0001-01-01T00:00:00.0000000Z",
        "depricationDate": "0001-01-01T00:00:00.0000000Z",
        "modelName": "microsoft-phi-1-5",
        "modelVersion": "8",
        "type": "AiModelMetadata"
      }
    }
  }
}

Detection Patterns #

Detect Suspicious Ncrypt Dll

Defender-DeviceEvents any: Defender eventORDefender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphEdges any: Exposure graph edgesORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

3 rules

Kusto

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious Ncrypt Dll

Defender-DeviceNetworkEvents ConnectionSuccess: Connection succeededORDefender-DeviceNetworkInfo any: Device network configurationORDefender-ExposureGraphNodes any: Exposure graph nodes

3 rules

Kusto

Hunt for RDP sessions to unmanaged and non TPM devices (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device (source)

Robbe Van den Daele

Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device (source)

Robbe Van den Daele

Initial Access: Exploit Public-Facing Application

Defender-DeviceNetworkEvents InboundConnectionAccepted: Inbound connection acceptedORDefender-DeviceTvmSoftwareVulnerabilities any: Software vulnerabilities on devicesORDefender-DeviceTvmSoftwareVulnerabilitiesKB any: Vulnerability knowledge baseORDefender-ExposureGraphNodes any: Exposure graph nodes

1 rule

Kusto

Hunt for public remotly exploitable devices (with high EPSS) (source)

Robbe Van den Daele

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type` (kusto rule field)	eq	`DeviceInventoryId`	5 rules	kusto
`TpmActivated` (kusto rule field)	ne	`true`	4 rules	kusto
`TpmEnabled` (kusto rule field)	ne	`true`	4 rules	kusto
`TpmSupported` (kusto rule field)	ne	`true`	4 rules	kusto
`ActionType` (kusto rule field)	contains	`inboundconnection`	1 rule	kusto
`ActionType` (kusto rule field)	eq	`ConnectionSuccess`	3 rules	kusto
`ActionType` (kusto rule field)	in	`ExecuteToolByGateway`	1 rule	kusto
`ActionType` (kusto rule field)	in	`ExecuteToolByMCPServer`	1 rule	kusto
`ActionType` (kusto rule field)	starts_with	`AppControl`	2 rules	kusto
`DestinationPort` (kusto rule field)	eq	`3389`	3 rules	kusto
`NodeLabel` (kusto rule field)	eq	`device`	3 rules	kusto
`OnboardingStatus` (kusto rule field)	ne	`Onboarded`	3 rules	kusto
`parent_process_name` (kusto rule field)	ne	`microsoft.tri.sensor.exe`	3 rules	kusto
`DestinationHostname` (kusto rule field)	eq	`login.microsoftonline.com`	2 rules	kusto
`file_name` (kusto rule field)	eq	`ncrypt.dll`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Hunt for local AI Agent activity with Agent Info source: This query allows you to find the activity a local AI Agent performed via the CloudAppEvents table using the AgentsInfo and ExposureGraphNodes table.
Hunt for Defender for Identity not installed but eligible source: This query shows you which servers are eligible for Defender for identity but does not have the Defender for Identity agent installed. The query seach the eligible servers via Defender for Endpoint (requirement for this query to work), and is based on the server roles that MDE recongnizes.
Hunt for accounts with leaked credentials source: This query searches for accounts where Exposure Management detected leaked credentials. This query is correlated with the IdentityInfo table, mainly because you can easily create a detection of this rule if you would like to.

Show 2 more (5 total) on the rules page

References #

Microsoft Defender XDR: advanced hunting reference

Defender-ExposureGraphNodes

any: Exposure graph nodes

Fields #

Example Event #

Detection Patterns #

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Detect Suspicious Ncrypt Dll

Kusto

Initial Access: Exploit Public-Facing Application

Kusto

Common Indicators #

Detection Rules #

Kusto #

Related Events #

References #