Defender-DeviceEvents any

Kusto (10)

• Detect device token stealing with WDAC T1212, T1528, T1539, T1606, T1606.001
• Detect LolDriver drop or load from unknown or unsigned process T1068
• Detect Suspicious ncrypt.dll usage by CLI tool or unknown process T1555, T1555.004, T1606
• Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce T1555, T1555.004, T1606
• Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
• Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
• Office ASR rule triggered from browser spawned office process. severity medium T1566, T1566.002
• SUNSPOT malware hashes severity medium T1554
• TEARDROP memory-only dropper severity high T1027, T1059, T1543
• Windows host username encoded in base64 web request severity medium T1041, T1071, T1071.001