Defender-DeviceInfo

Kusto (21)

• [Deprecated] Explicit MFA Deny severity medium T1110
• AV detections related to Dev-0530 actors severity high T1486
• AV detections related to Europium actors severity high T1486
• AV detections related to Hive Ransomware severity high T1486
• AV detections related to SpringShell Vulnerability severity high T1190
• AV detections related to Tarrask malware severity high T1053
• AV detections related to Zinc actors severity high T1486
• Dataverse - Terminated employee exfiltration to USB drive severity high T1052
• DLL Hijacking: Loading from an Unusual Directory T1574,T1574.001,T1574.007,T1574.008,T1574.009
• Hunt devices supporting MDE Containment
• Hunt domains with Seamless SSO enabled in Entra ID Connect
• Hunt for ADWS requests from unknown devices T1018,T1021,T1021.002,T1069,T1069.002,T1087
• Hunt for compromised browser extensions T1176
• Hunt for devices organized by subnet
• Hunt for public facing devices and exposed ports over time T1190
• Hunt for public facing devices via public tag T1190
• Hunt MDE with GSA events
• Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory severity high T1190
• Potentially Relayed NTLM Authentication - Microsoft Defender for Endpoint
• Solorigate Defender Detections severity high T1195
• Suspicious Network Connections - Supply Chain Attack