Detection rules › By catalog entry

Defender-DeviceNetworkEvents

Catalog entry	Rules
any	31
ConnectionSuccess	16
ConnectionFailed	2
InboundConnectionAccepted	6
ListeningConnectionCreated	3
ConnectionRequest	2
ConnectionAttempt	3
NetworkSignatureInspected	2

any

31 detection rules reference this catalog entry. View catalog entry.

Kusto (31)

[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 severity high T1546
ADWS Connection from Unexpected Binary T1087,T1087.002,T1119
DCOM Lateral Movement severity medium T1021,T1021.003
Detect Msiexec executing DLL network connections T1218,T1218.007
Europium - Hash and IP IOCs - September 2022 severity high T1003,T1071
Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 severity informational T1203
Hunt for ADWS requests from unknown devices T1018,T1021,T1021.002,T1069,T1069.002,T1087
Hunt for Defender for Identity NNR issues
Hunt MDE with GSA events
IP address of Windows host encoded in web request severity medium T1041,T1071,T1071.001
Mercury - Domain, Hash and IP IOCs - August 2022 severity high T1071
NTLM Relay Attack T1187,T1557,T1557.001
Potential Kerberos Relaying Activity - MDE
Rare Process as a Service severity medium T1543,T1543.003
Regsvr32 Rundll32 Image Loads Abnormal Extension severity high T1218,T1218.010,T1218.011
Regsvr32 Rundll32 with Anomalous Parent Process severity high T1218,T1218.010,T1218.011
Scheduled Task - Suspicious Network Connection
SMB/Windows Admin Shares severity medium T1021,T1021.002
Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint)
Star Blizzard C2 Domains August 2022 severity high T1566
Suspicious Network Beacons - Microsoft Defender for Endpoint Aggregated Reports
Suspicious Network Beacons - Microsoft Defender(MDE/M365D)
Suspicious Network Connections - Supply Chain Attack
Suspicious office child process created T1204
TI Map Domain Entity to DeviceNetworkEvents severity medium T1071
TI Map Domain Entity to DeviceNetworkEvents severity medium T1071
TI Map IP Entity to DeviceNetworkEvents severity medium T1071
TI Map IP Entity to DeviceNetworkEvents severity medium T1071
TI Map URL Entity to DeviceNetworkEvents severity medium T1071
TI Map URL Entity to DeviceNetworkEvents severity medium T1071
Zinc Actor IOCs files - October 2022 severity high T1546

ConnectionSuccess

16 detection rules reference this catalog entry. View catalog entry.

Kusto (16)

ConnectionFailed

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

InboundConnectionAccepted

6 detection rules reference this catalog entry. View catalog entry.

Kusto (6)

ListeningConnectionCreated

3 detection rules reference this catalog entry. View catalog entry.

Kusto (3)

ConnectionRequest

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

ConnectionAttempt

3 detection rules reference this catalog entry. View catalog entry.

Kusto (3)

NetworkSignatureInspected

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

Back to all Defender-DeviceNetworkEvents catalog entries