edr:mde DeviceProcessEvents
DeviceProcessEvents
Stands in for win:sysmon 1 (full), win:security 4688 (full), linux:auditd EXECVE (full), linux:auditd SYSCALL:execve (full), linux:sysmon 1 (full)
- Log source
- Microsoft Defender for Endpoint device tables
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Defender for Endpoint onboarded; advanced hunting tables, exportable with the streaming API to Event Hubs or storage.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Microsoft Sentinel 54
Why this tier
ATT&CK via equivalence to win:sysmon 1; ATT&CK via equivalence to win:security 4688; ATT&CK via equivalence to linux:auditd EXECVE
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Microsoft Sentinel 54
- Access Token Manipulation - Create Process with Token
- Account Creation
- Audit policy manipulation using auditpol utility
- Bitsadmin Activity
- CertUtil Used for File Download (Living off the Land)
- Clearing of forensic evidence from event logs using wevtutil
- DCOM Lateral Movement
- DEV-0270 New User Creation
- Deletion of data on multiple drives using cipher exe
- Detect Suspicious Commands Initiated by Webserver Processes
- Detecting UAC bypass - ChangePK and SLUI registry tampering
- Detecting UAC bypass - elevated COM interface
- Detecting UAC bypass - modify Windows Store settings
- Dev-0228 File Path Hashes November 2021
- Dev-0270 Malicious Powershell usage
- Dev-0270 Registry IOC - September 2022
- Dev-0270 WMIC Discovery
- Disable or Modify Windows Defender
- Disabling Security Services via Registry
- Doppelpaymer Stop Services
- DopplePaymer Procdump
- Email access via active sync
- Exchange Worker Process Making Remote Call
- Execution of software vulnerable to webp buffer overflow of CVE-2023-4863
- Identify Mango Sandstorm powershell commands
- Ingress Tool Transfer - Certutil
- Java Executing cmd to run Powershell
- LSASS Credential Dumping with Procdump
- LaZagne Credential Theft
- Match Legitimate Name or Location - 2
- Office Apps Launching Wscipt
- Oracle suspicious command execution
- PHP Worker Process Spawning Shell/Recon Tool
- Potential Build Process Compromise - MDE
- PowerShell Encoded Command Execution (Living off the Land)
- Probable AdFind Recon Tool Usage
- Qakbot Campaign Self Deletion
- Qakbot Discovery Activies
- Rare Process as a Service
- Regsvr32 Rundll32 Image Loads Abnormal Extension
- Regsvr32 Rundll32 with Anomalous Parent Process
- Remote Desktop Protocol - SharpRDP
- Rename System Utilities
- SMB/Windows Admin Shares
- SUNBURST suspicious SolarWinds child processes
- Security Service Registry ACL Modification
- Shadow Copy Deletions
- Stopping multiple processes using taskkill
- Suspicious parentprocess relationship - Office child processes.
- Trusted Developer Utilities Proxy Execution
- Unusual identity creation using exchange powershell
- WMI Spawning Suspicious Child Process (Living off the Land)
- Zinc Actor IOCs files - October 2022
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022