capability

Endpoint Detection and Response

Endpoint detection and response helps detect, investigate, and respond to advanced threats on endpoints.

capabilitiesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproduct Microsoft Defender for Endpoint P1
Required licenselicense Microsoft Defender for Endpoint P2
Required licenselicense DeviceEvents
Related tabletable DeviceProcessEvents
Related tabletable DeviceNetworkEvents
Related tabletable DeviceFileEvents
Related tabletable Microsoft Defender for Endpoint APIs
API accessapi Microsoft Graph Security API
API accessapi

Configuration Methods

Method	Support	Reference or Gap
Portal	Supported	Reference
PowerShell	Gap	No product-specific PowerShell automation surface is recorded for this capability yet.
REST API	Supported	Reference
Graph	Supported	Reference
ARM	Gap	No ARM resource is recorded for this capability.
Bicep	Gap	No Bicep resource is recorded for this capability.
Terraform	Gap	MDE onboarding and EDR settings are not ARM/Terraform resources. Automate onboarding packages and Intune/Graph policy outside Terraform.
GitHub Actions	Supported	Reference
Azure DevOps	Supported	Reference

Related KQL

Detect file modification bursts by process

Summarize high-volume file create/modify activity by device, account, and initiating process as a ransomware-style triage signal.

detection candidate

advancedendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceFileEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let minimumEvents = {minimum_events};
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| summarize FileEvents=count(), Extensions=make_set(tolower(extract(@"\.([^.\\]+)$", 1, FolderPath)), 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileEvents >= minimumEvents
| order by FileEvents desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from ransomware TTP themes into a generic file-burst query for modeled MDE tables.

Review suspicious PowerShell process launches

Find PowerShell process executions with common download, encoded-command, hidden-window, or bypass indicators.

detection candidate

intermediateendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceProcessEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let suspiciousTerms = dynamic(["-enc", "encodedcommand", "downloadstring", "invoke-webrequest", "iex", "-w hidden", "bypass"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousTerms)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountUpn, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from endpoint and ransomware hunting themes with common PowerShell indicators.