Detection rules › By event

Defender-DeviceLogonEvents

Event	Rules
any	5
LogonSuccess	6
LogonFailed	1

any

5 detection rules reference this event. View event page.

Kusto (5)

LogonSuccess

6 detection rules reference this event. View event page.

Kusto (6)

Detect service account login on new device T1021, T1021.001, T1021.002, T1021.003, T1021.006
NTLM Relay Attack T1187, T1557, T1557.001
Password Spraying severity medium T1110, T1110.003
Potentially Relayed NTLM Authentication - Microsoft Defender for Endpoint
Remote Desktop Protocol - SharpRDP severity medium T1021, T1021.001
Service Accounts Performing Remote PS severity high T1210

LogonFailed

1 detection rules reference this event. View event page.

Kusto (1)

Password Spraying severity medium T1110, T1110.003