Detection rules › By catalog entry

Defender-DeviceEvents

Catalog entry	Rules
any	20
PowerShellCommand	2
AmsiScriptContent	1
CreateRemoteThreadApiCall	4
NamedPipeEvent	2
UserAccountAddedToLocalGroup	1
OpenProcessApiCall	1
ProcessPrimaryTokenModified	1
LdapSearch	2
ClrUnbackedModuleLoaded	1
AsrUntrustedExecutableAudited	1
DriverLoad	2
NtAllocateVirtualMemoryRemoteApiCall	3
MemoryRemoteProtect	2
NtMapViewOfSectionRemoteApiCall	3
QueueUserApcRemoteApiCall	4
SetThreadContextRemoteApiCall	4
AsrUntrustedExecutableBlocked	1
ExploitGuardNonMicrosoftSignedBlocked	1
BrowserLaunchedToOpenUrl	1
NtAllocateVirtualMemoryApiCall	1
NtProtectVirtualMemoryApiCall	1
ReadProcessMemoryApiCall	1
UsbDriveMounted	3
UserAccountCreated	1
UserAccountModified	1

any

20 detection rules reference this catalog entry. View catalog entry.

Kusto (20)

PowerShellCommand

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

Service Accounts Performing Remote PS severity high T1210
Suspicious Powershell Commandlet Executed severity medium T1059

AmsiScriptContent

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Deimos Component Execution severity high T1005,T1020,T1059

CreateRemoteThreadApiCall

4 detection rules reference this catalog entry. View catalog entry.

Kusto (4)

NamedPipeEvent

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

C2-NamedPipe severity high T1105
Suspicious named pipes severity medium T1055,T1559

UserAccountAddedToLocalGroup

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Local Admin Group Changes severity high T1098

OpenProcessApiCall

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

LSASS Dumping using Debug Privileges T1003,T1003.001,T1106

ProcessPrimaryTokenModified

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

LSASS Dumping using Debug Privileges T1003,T1003.001,T1106

LdapSearch

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

ADFS DKM Master Key Export severity medium T1005
LDAP reconnaissance via search filters T1018,T1033,T1069,T1069.002,T1087,T1087.002

ClrUnbackedModuleLoaded

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Script Interpreter Loading DotNet Assembly From Memory T1059,T1059.005,T1059.007,T1218,T1218.005,T1218.014

AsrUntrustedExecutableAudited

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

ASR Rare and Untrusted Executables

DriverLoad

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

NtAllocateVirtualMemoryRemoteApiCall

3 detection rules reference this catalog entry. View catalog entry.

Kusto (3)

MemoryRemoteProtect

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

NtMapViewOfSectionRemoteApiCall

3 detection rules reference this catalog entry. View catalog entry.

Kusto (3)

QueueUserApcRemoteApiCall

4 detection rules reference this catalog entry. View catalog entry.

Kusto (4)

SetThreadContextRemoteApiCall

4 detection rules reference this catalog entry. View catalog entry.

Kusto (4)

AsrUntrustedExecutableBlocked

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

ASR Rare and Untrusted Executables

ExploitGuardNonMicrosoftSignedBlocked

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

TEARDROP memory-only dropper severity high T1027,T1059,T1543

BrowserLaunchedToOpenUrl

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Possible Phishing with CSL and Network Sessions severity medium T1102,T1566

NtAllocateVirtualMemoryApiCall

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

ADWS Connection from Process Injection Target T1055,T1055.002,T1087,T1087.002,T1119

NtProtectVirtualMemoryApiCall

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

ADWS Connection from Process Injection Target T1055,T1055.002,T1087,T1087.002,T1119

ReadProcessMemoryApiCall

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Process Injection Initiated By MMC T1055,T1218,T1218.014

UsbDriveMounted

3 detection rules reference this catalog entry. View catalog entry.

Kusto (3)

Dataverse - Terminated employee exfiltration to USB drive severity high T1052
Files Copied to USB Drives severity high T1041
Mass Download & copy to USB device by single user severity medium T1052

UserAccountCreated

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Local Admin Group Changes severity high T1098

UserAccountModified

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Local Admin Group Changes severity high T1098

Back to all Defender-DeviceEvents catalog entries