Detection rules › By event

Defender-DeviceEvents

Event	Rules
any	19
PowerShellCommand	2
AmsiScriptContent	1
CreateRemoteThreadApiCall	4
NamedPipeEvent	2
UserAccountAddedToLocalGroup	1
OpenProcessApiCall	1
ProcessPrimaryTokenModified	1
LdapSearch	2
ClrUnbackedModuleLoaded	1
AsrUntrustedExecutableAudited	1
DriverLoad	2
NtAllocateVirtualMemoryRemoteApiCall	3
MemoryRemoteProtect	2
NtMapViewOfSectionRemoteApiCall	3
QueueUserApcRemoteApiCall	4
SetThreadContextRemoteApiCall	4
AsrUntrustedExecutableBlocked	1
ExploitGuardNonMicrosoftSignedBlocked	1
BrowserLaunchedToOpenUrl	1
NtAllocateVirtualMemoryApiCall	1
NtProtectVirtualMemoryApiCall	1
ReadProcessMemoryApiCall	1
UsbDriveMounted	3
UserAccountCreated	1
UserAccountModified	1

any

19 detection rules reference this event. View event page.

Kusto (19)

[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 severity high T1546
Azure VM Run Command operations executing a unique PowerShell script severity medium T1059, T1059.001, T1570
Detect device token stealing with WDAC T1212, T1528, T1539, T1606, T1606.001
Detect LolDriver drop or load from unknown or unsigned process T1068
Detect Suspicious ncrypt.dll usage by CLI tool or unknown process T1555, T1555.004, T1606
Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce T1555, T1555.004, T1606
Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 severity informational T1203
Lumen TI IPAddress in DeviceEvents severity medium T1071
Microsoft Recommended Driver Block List
Office ASR rule triggered from browser spawned office process. severity medium T1566, T1566.002
Potential Kerberos Relaying Activity - MDE
Prestige ransomware IOCs Oct 2022 severity high T1203
Process Injection From Untrusted Process T1055, T1055.002, T1106
SUNSPOT malware hashes severity medium T1554
Suspicious named pipes severity medium T1055, T1559
Windows host username encoded in base64 web request severity medium T1041, T1071, T1071.001
Zinc Actor IOCs files - October 2022 severity high T1546

PowerShellCommand

2 detection rules reference this event. View event page.

Kusto (2)

Service Accounts Performing Remote PS severity high T1210
Suspicious Powershell Commandlet Executed severity medium T1059

AmsiScriptContent

1 detection rules reference this event. View event page.

Kusto (1)

Deimos Component Execution severity high T1005, T1020, T1059

CreateRemoteThreadApiCall

4 detection rules reference this event. View event page.

Kusto (4)

NamedPipeEvent

2 detection rules reference this event. View event page.

Kusto (2)

C2-NamedPipe severity high T1105
Suspicious named pipes severity medium T1055, T1559

UserAccountAddedToLocalGroup

1 detection rules reference this event. View event page.

Kusto (1)

Local Admin Group Changes severity high T1098

OpenProcessApiCall

1 detection rules reference this event. View event page.

Kusto (1)

LSASS Dumping using Debug Privileges T1003, T1003.001, T1106

ProcessPrimaryTokenModified

1 detection rules reference this event. View event page.

Kusto (1)

LSASS Dumping using Debug Privileges T1003, T1003.001, T1106

LdapSearch

2 detection rules reference this event. View event page.

Kusto (2)

ADFS DKM Master Key Export severity medium T1005
LDAP reconnaissance via search filters T1018, T1033, T1069, T1069.002, T1087, T1087.002

ClrUnbackedModuleLoaded

1 detection rules reference this event. View event page.

Kusto (1)

Script Interpreter Loading DotNet Assembly From Memory T1059, T1059.005, T1059.007, T1218, T1218.005, T1218.014

AsrUntrustedExecutableAudited

1 detection rules reference this event. View event page.

Kusto (1)

ASR Rare and Untrusted Executables

DriverLoad

2 detection rules reference this event. View event page.

Kusto (2)

NtAllocateVirtualMemoryRemoteApiCall

3 detection rules reference this event. View event page.

Kusto (3)

MemoryRemoteProtect

2 detection rules reference this event. View event page.

Kusto (2)

NtMapViewOfSectionRemoteApiCall

3 detection rules reference this event. View event page.

Kusto (3)

QueueUserApcRemoteApiCall

4 detection rules reference this event. View event page.

Kusto (4)

SetThreadContextRemoteApiCall

4 detection rules reference this event. View event page.

Kusto (4)

AsrUntrustedExecutableBlocked

1 detection rules reference this event. View event page.

Kusto (1)

ASR Rare and Untrusted Executables

ExploitGuardNonMicrosoftSignedBlocked

1 detection rules reference this event. View event page.

Kusto (1)

TEARDROP memory-only dropper severity high T1027, T1059, T1543

BrowserLaunchedToOpenUrl

1 detection rules reference this event. View event page.

Kusto (1)

Possible Phishing with CSL and Network Sessions severity medium T1102, T1566

NtAllocateVirtualMemoryApiCall

1 detection rules reference this event. View event page.

Kusto (1)

ADWS Connection from Process Injection Target T1055, T1055.002, T1087, T1087.002, T1119

NtProtectVirtualMemoryApiCall

1 detection rules reference this event. View event page.

Kusto (1)

ADWS Connection from Process Injection Target T1055, T1055.002, T1087, T1087.002, T1119

ReadProcessMemoryApiCall

1 detection rules reference this event. View event page.

Kusto (1)

Process Injection Initiated By MMC T1055, T1218, T1218.014

UsbDriveMounted

3 detection rules reference this event. View event page.

Kusto (3)

Dataverse - Terminated employee exfiltration to USB drive severity high T1052
Files Copied to USB Drives severity high T1041
Mass Download & copy to USB device by single user severity medium T1052

UserAccountCreated

1 detection rules reference this event. View event page.

Kusto (1)

Local Admin Group Changes severity high T1098

UserAccountModified

1 detection rules reference this event. View event page.

Kusto (1)

Local Admin Group Changes severity high T1098