8 detection rules reference this catalog entry. View catalog entry.Kusto (8)
- Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device T1021,T1021.001,T1555,T1555.004,T1606
- Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device T1021,T1021.001,T1555,T1555.004,T1606
- Hunt Device Discovery Subnet Ranges
- Hunt for ADWS requests from unknown devices T1018,T1021,T1021.002,T1069,T1069.002,T1087
- Hunt for Defender for Identity NNR issues
- Hunt for devices organized by subnet
- Hunt for RDP sessions to unmanaged and non TPM devices T1021,T1021.001
- RDP Nesting severity medium T1021