Labs References Blog

Detection rules › By event

Defender-ExposureGraphEdges

Event	Rules
any	5

any

5 detection rules reference this event. View event page.

Kusto (5)

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
Hunt for critical credentials on devices with non-critical accounts T1078
Hunt for critical credentials on non Credential Guard enabled devices
Hunt for critical credentials on non-TPM enabled devices
Hunt for privilege escalation paths with high ACLs T1078