edr:mde DeviceEvents
DeviceEvents
Stands in for win:sysmon 22 (partial), win:sysmon 6 (partial), win:sysmon 8 (partial), win:sysmon 10 (partial), win:sysmon 17 (full), win:sysmon 18 (full), win:sysmon 19 (partial), win:sysmon 20 (partial), win:sysmon 21 (partial), win:powershell 4104 (partial), win:security 4698 (partial), win:system 7045 (partial), win:security 4732 (partial), win:security 4720 (partial)
- Log source
- Microsoft Defender for Endpoint device tables
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Defender for Endpoint onboarded; advanced hunting tables, exportable with the streaming API to Event Hubs or storage.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Microsoft Sentinel 15
Why this tier
ATT&CK via equivalence to win:sysmon 17
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Microsoft Sentinel 15
- Azure VM Run Command operations executing a unique PowerShell script
- Dataverse - Terminated employee exfiltration to USB drive
- Execution of software vulnerable to webp buffer overflow of CVE-2023-4863
- Files Copied to USB Drives
- Lumen TI IPAddress in DeviceEvents
- Mass Download & copy to USB device by single user
- Office ASR rule triggered from browser spawned office process.
- Possible Phishing with CSL and Network Sessions
- Prestige ransomware IOCs Oct 2022
- SUNSPOT malware hashes
- Service Accounts Performing Remote PS
- TEARDROP memory-only dropper
- Windows host username encoded in base64 web request
- Zinc Actor IOCs files - October 2022
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022