product

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is an enterprise endpoint security platform used to prevent, detect, investigate, and respond to advanced threats.

productsMDECurrent

Relationships

Microsoft Defender for Endpoint P1
Required or related licenselicense Microsoft Defender for Endpoint P2
Required or related licenselicense Attack Surface Reduction
Capabilitycapability Endpoint Detection and Response
Capabilitycapability Automated Investigation and Response
Capabilitycapability Advanced Hunting
Capabilitycapability Microsoft Defender Unified RBAC
Capabilitycapability Threat and Vulnerability Management
Capabilitycapability DeviceProcessEvents
Produced or queried tabletable DeviceEvents
Produced or queried tabletable DeviceFileEvents
Produced or queried tabletable DeviceNetworkEvents
Produced or queried tabletable DeviceRegistryEvents
Produced or queried tabletable DeviceLogonEvents
Produced or queried tabletable DeviceImageLoadEvents
Produced or queried tabletable DeviceInfo
Produced or queried tabletable Microsoft Defender for Endpoint APIs
Related APIapi Microsoft Defender for Endpoint Indicators API
Related APIapi Microsoft Graph Security API
Related APIapi Legacy Microsoft Defender XDR APIs
Related APIapi

Related KQL

Detect file modification bursts by process

Summarize high-volume file create/modify activity by device, account, and initiating process as a ransomware-style triage signal.

detection candidate

advancedendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceFileEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let minimumEvents = {minimum_events};
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| summarize FileEvents=count(), Extensions=make_set(tolower(extract(@"\.([^.\\]+)$", 1, FolderPath)), 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileEvents >= minimumEvents
| order by FileEvents desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from ransomware TTP themes into a generic file-burst query for modeled MDE tables.

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template

advancedthreat-intelligenceendpoint

Run surface: Sentinel Logs
Required tables: ThreatIntelIndicators DeviceNetworkEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.

Review suspicious PowerShell process launches

Find PowerShell process executions with common download, encoded-command, hidden-window, or bypass indicators.

detection candidate

intermediateendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceProcessEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let suspiciousTerms = dynamic(["-enc", "encodedcommand", "downloadstring", "invoke-webrequest", "iex", "-w hidden", "bypass"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousTerms)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountUpn, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from endpoint and ransomware hunting themes with common PowerShell indicators.