Labs References Blog

Detection rules › By event

Defender-ExposureGraphNodes

Event	Rules
any	9

any

9 detection rules reference this event. View event page.

Kusto (9)

Detect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
Detect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device T1021, T1021.001, T1555, T1555.004, T1606
Hunt for accounts with leaked credentials
Hunt for critical credentials on non Credential Guard enabled devices
Hunt for critical credentials on non-TPM enabled devices
Hunt for Defender for Identity not installed but eligible
Hunt for local AI Agent activity with Agent Info
Hunt for public remotly exploitable devices (with high EPSS) T1190
Hunt for RDP sessions to unmanaged and non TPM devices T1021, T1021.001