Detection rules › By catalog entry

Defender-DeviceLogonEvents

Catalog entry	Rules
any	5
LogonSuccess	6
LogonFailed	1

any

5 detection rules reference this catalog entry. View catalog entry.

Kusto (5)

LogonSuccess

6 detection rules reference this catalog entry. View catalog entry.

Kusto (6)

Detect service account login on new device T1021,T1021.001,T1021.002,T1021.003,T1021.006
NTLM Relay Attack T1187,T1557,T1557.001
Password Spraying severity medium T1110,T1110.003
Potentially Relayed NTLM Authentication - Microsoft Defender for Endpoint
Remote Desktop Protocol - SharpRDP severity medium T1021,T1021.001
Service Accounts Performing Remote PS severity high T1210

LogonFailed

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Password Spraying severity medium T1110,T1110.003

Back to all Defender-DeviceLogonEvents catalog entries