Microsoft Defender XDR

Description

Microsoft Defender XDR is a unified, natively integrated, pre- and post-breach enterprise defense suite that protects endpoint, identity, email, and applications and helps you detect, prevent, investigate, and automatically respond to sophisticated threats. Microsoft Defender XDR suite includes: - Microsoft Defender for Endpoint - Microsoft Defender for Identity - Microsoft Defender for Office 365 - Threat & Vulnerability Management - Microsoft Defender for Cloud Apps For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220004&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Declared permissions

read and write permissions.

Workspace

Workspace

License

M365 E5, M365 A5 or any other Microsoft Defender XDR eligible license.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Connect incidents & alerts

Connect Microsoft Defender XDR incidents to your Microsoft Sentinel. Incidents will appear in the incidents queue.

Connect events

Related content

Links established from declared identifiers and solution manifests.

Analytics rules149

Access Token Manipulation - Create Process with TokenMedium Account CreationMedium ADFS DKM Master Key ExportMedium Anomaly found in Network Session Traffic (ASIM Network Session schema)Medium ASR Bypassing Writing Executable ContentMedium Audit policy manipulation using auditpol utilityMedium AV detections related to Dev-0530 actorsHigh AV detections related to Europium actorsHigh AV detections related to Hive RansomwareHigh AV detections related to SpringShell VulnerabilityHigh AV detections related to Tarrask malwareHigh AV detections related to Ukraine threatsHigh AV detections related to Zinc actorsHigh Azure VM Run Command operations executing a unique PowerShell scriptMedium Bitsadmin ActivityMedium C2-NamedPipeHigh CertUtil Used for File Download (Living off the Land)High Clearing of forensic evidence from event logs using wevtutilHigh COM Registry Key Modified to Point to File in Color Profile FolderMedium Component Object Model Hijacking - Vault7 trickMedium Cross-Cloud Password Spray detectionMedium Cross-Cloud Suspicious user activity observed in GCP EnvourmentMedium Dataverse - Terminated employee exfiltration over emailHigh Dataverse - Terminated employee exfiltration to USB driveHigh DCOM Lateral MovementMedium Defender Alert EvidenceHigh Deimos Component ExecutionHigh Deletion of data on multiple drives using cipher exeMedium Detect .NET runtime being loaded in JScript for code executionMedium Detect Malicious Usage of Recovery Tools to Delete Backup FilesHigh Detect port misuse by anomaly based detection (ASIM Network Session schema)Medium Detect port misuse by static threshold (ASIM Network Session schema)Medium Detect Potential Kerberoast ActivitiesMedium Detect Print Processors Registry Driver Key Creation/ModificationMedium Detect Registry Run Key Creation/ModificationMedium Detect Suspicious Commands Initiated by Webserver ProcessesHigh Detect Windows Allow Firewall Rule Addition/ModificationMedium Detect Windows Update Disabled from RegistryMedium Detecting UAC bypass - ChangePK and SLUI registry tamperingMedium Detecting UAC bypass - elevated COM interfaceMedium Detecting UAC bypass - modify Windows Store settingsMedium Dev-0228 File Path Hashes November 2021High Dev-0270 Malicious Powershell usageHigh DEV-0270 New User CreationHigh Dev-0270 Registry IOC - September 2022High Dev-0270 WMIC DiscoveryHigh Dev-0530 File Extension RenameHigh Disable or Modify Windows DefenderMedium Disabling Security Services via RegistryMedium Doppelpaymer Stop ServicesHigh DopplePaymer ProcdumpHigh Email access via active syncMedium Europium - Hash and IP IOCs - September 2022High Excessive number of failed connections from a single source (ASIM Network Session schema)Medium Exchange Worker Process Making Remote CallMedium Execution of software vulnerable to webp buffer overflow of CVE-2023-4863Informational Files Copied to USB DrivesHigh GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)Medium Hijack Execution Flow - DLL Side-LoadingMedium Identify Mango Sandstorm powershell commandsHigh Identify SysAid Server web shell creationHigh Ingress Tool Transfer - CertutilLow IP address of Windows host encoded in web requestMedium Java Executing cmd to run PowershellHigh LaZagne Credential TheftMedium Local Admin Group ChangesHigh Log4j vulnerability exploit aka Log4Shell IP IOCHigh LSASS Credential Dumping with ProcdumpHigh Lumen TI IPAddress in DeviceEventsMedium Mass Download & copy to USB device by single userMedium Match Legitimate Name or Location - 2Medium Mercury - Domain, Hash and IP IOCs - August 2022High Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data FactoryHigh MosaicLoaderHigh Network Port Sweep from External Network (ASIM Network Session schema)High Office Apps Launching WsciptMedium Office ASR rule triggered from browser spawned office process.Medium Oracle suspicious command executionMedium Password SprayingMedium PE file dropped in Color Profile FolderMedium Port scan detected (ASIM Network Session schema)Medium Possible Phishing with CSL and Network SessionsMedium Potential beaconing activity (ASIM Network Session schema)Low Potential Build Process Compromise - MDEMedium Potential Ransomware activity related to Cobalt StrikeHigh Power Apps - Multiple users access a malicious link after launching new appHigh PowerShell Encoded Command Execution (Living off the Land)Medium Prestige ransomware IOCs Oct 2022High Preview - TI map Domain entity to Cloud App EventsMedium Preview - TI map Email entity to Cloud App EventsMedium Preview - TI map IP entity to Cloud App EventsMedium Preview - TI map URL entity to Cloud App EventsMedium Probable AdFind Recon Tool UsageHigh Process Creation with Suspicious CommandLine ArgumentsMedium Qakbot Campaign Self DeletionMedium Qakbot Discovery ActiviesMedium Rare Process as a ServiceMedium Regsvr32 Rundll32 Image Loads Abnormal ExtensionHigh Regsvr32 Rundll32 with Anomalous Parent ProcessHigh Remote Desktop Protocol - SharpRDPMedium Remote File Creation with PsExecHigh Rename System UtilitiesMedium Security Service Registry ACL ModificationHigh Service Accounts Performing Remote PSHigh Shadow Copy DeletionsMedium SMB/Windows Admin SharesMedium Solorigate Defender DetectionsHigh Star Blizzard C2 Domains August 2022High Stopping multiple processes using taskkillMedium Successful AWS Console Login from IP Address Observed Conducting Password SprayMedium SUNBURST and SUPERNOVA backdoor hashesHigh SUNBURST network beaconsMedium SUNBURST suspicious SolarWinds child processesMedium SUNSPOT malware hashesMedium Suspicious AWS console logins by credential access alertsMedium Suspicious named pipesMedium Suspicious parentprocess relationship - Office child processes.Medium Suspicious Powershell Commandlet ExecutedMedium Suspicious Process Injection from Office applicationMedium Suspicious VM Instance Creation Activity DetectedMedium TEARDROP memory-only dropperHigh TI Map Domain entity to Cloud App EventsMedium TI Map Domain Entity to DeviceNetworkEventsMedium TI Map Domain Entity to DeviceNetworkEventsMedium TI Map Domain entity to EmailEventsMedium TI Map Domain entity to EmailUrlInfoMedium TI Map Email entity to Cloud App EventsMedium TI Map Email entity to EmailEventsMedium TI map File Hash to DeviceFileEvents EventMedium TI Map File Hash to DeviceFileEvents EventMedium TI Map IP entity to Cloud App EventsMedium TI Map IP Entity to DeviceNetworkEventsMedium TI Map IP Entity to DeviceNetworkEventsMedium TI Map IP entity to Network Session Events (ASIM Network Session schema)Medium TI map IP entity to Network Session Events (ASIM Network Session schema)Medium TI Map URL entity to Cloud App EventsMedium TI Map URL Entity to DeviceNetworkEventsMedium TI Map URL Entity to DeviceNetworkEventsMedium TI Map URL Entity to EmailUrlInfoMedium TI Map URL Entity to UrlClickEventsMedium TI Map URL Entity to UrlClickEventsMedium Trusted Developer Utilities Proxy ExecutionMedium Unusual identity creation using exchange powershellHigh Unusual Volume of file deletion by usersHigh Windows host username encoded in base64 web requestMedium WMI Spawning Suspicious Child Process (Living off the Land)High Zinc Actor IOCs files - October 2022High [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High [Deprecated] Explicit MFA DenyMedium