8 detection rules reference this event. View event page.Kusto (8)
- Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
- Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
- Hunt Device Discovery Subnet Ranges
- Hunt for ADWS requests from unknown devices T1018, T1021, T1021.002, T1069, T1069.002, T1087
- Hunt for Defender for Identity NNR issues
- Hunt for devices organized by subnet
- Hunt for RDP sessions to unmanaged and non TPM devices T1021, T1021.001
- RDP Nesting severity medium T1021