edr:mde
Microsoft Defender for Endpoint device tables
Advanced hunting Device* tables; keys are Table or Table:ActionType
- Host type
- EDR sensors (product telemetry, cross-platform)
- Tier, as a whole
- Recommended
- Cost class
- Paid tier
- Techniques
- 0
- Rules listed
- 379
- Events
- 24
Licensing
- License or service
- Defender for Endpoint P1/P2, Defender for Business, Microsoft 365 E5
- What is free
- Advanced hunting tables in the portal with the plan
- What costs
- Streaming API exports advanced hunting events to Event Hubs or an Azure storage account; Azure charges for those services; longer retention than the portal needs the export
- Notes
- Applies to Defender for Endpoint, Plan 1 and Defender for Business per the streaming API page
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
No ATT&CK analytic names this source.
Rules
Elastic 259
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- Alternate Data Stream Creation/Execution at Volume Root Directory
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install or Run Kali Linux via WSL
- AzCopy or Azure Storage Explorer Usage on Unusual Host
- Backup Deletion with Wbadmin
- Browser Extension Install
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Clearing Windows Console History
- Clearing Windows Event Logs
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command Shell Activity Started via RunDLL32
- Command and Scripting Interpreter via Windows Scripts
- Conhost Spawned By Suspicious Parent Process
- Control Panel Process with Unusual Arguments
- Creation of a Hidden Local User Account
- Creation or Modification of Domain Backup DPAPI private key
- Creation or Modification of Root Certificate
- Creation or Modification of a new GPO Scheduled Task or Service
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- Delete Volume USN Journal with Fsutil
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Disabling Windows Defender Security Settings via PowerShell
- Enable Host Network Discovery via Netsh
- Encrypting Files with WinRar or 7z
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Administrator Accounts
- Executable File Creation with Multiple Extensions
- Execution from Unusual Directory - Command Line
- Execution of COM object via Xwizard
- Execution via GitHub Actions Runner
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution via local SxS Shared Module
- Exporting Exchange Mailbox via PowerShell
- File with Right-to-Left Override Character (RTLO) Created/Executed
- First Time Seen Removable Device
- Full User-Mode Dumps Enabled System-Wide
- GenAI Process Compiling or Generating Executables
- GenAI Process Performing Encoding/Chunking Prior to Network Activity
- GenAI or MCP Server Child Process Execution
- Group Policy Discovery via Microsoft GPResult Utility
- IIS HTTP Logging Disabled
- Image File Execution Options Injection
- ImageLoad via Windows Update Auto Update Client
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Kirbi File Creation
- LSASS Memory Dump Creation
- LSASS Process Access via Windows API
- Lateral Movement via Startup Folder
- Local Account TokenFilter Policy Disabled
- MS Office Macro Security Registry Modifications
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Microsoft Defender XDR Alert External Alerts
- Microsoft Defender XDR Incident External Alerts
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft Exchange Server UM Writing Suspicious Files
- Microsoft Exchange Worker Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Microsoft Windows Defender Tampering
- Mimikatz Memssp Log File Detected
- Modification of AmsiEnable Registry Key
- Modification of Boot Configuration
- Modification of WDigest Security Provider
- Mofcomp Activity
- Mounting Hidden or WebDav Remote Shares
- Multiple Remote Management Tool Vendors on Same Host
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- NetSupport Manager Execution from an Unusual Path
- Netsh Helper DLL
- Network Logon Provider Registry Modification
- Network-Level Authentication (NLA) Disabled
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Newly Seen Commonly Abused Network Scanner
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- Outlook Home Page Registry Modification
- Peripheral Device Discovery
- Persistence via BITS Job Notify Cmdline
- Persistence via Hidden Run Key Detected
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via Scheduled Job Creation
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Persistent Scripts in the Startup Directory
- Port Forwarding Rule Addition
- Potential Application Shimming via Sdbinst
- Potential CVE-2025-33053 Exploitation
- Potential Credential Access via Windows Utilities
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration via Rclone
- Potential EDR-Freeze via WerFaultSecure Abuse
- Potential Entra ID PRT Extraction via BrowserCore
- Potential Escalation via Vulnerable MSI Repair
- Potential Evasion via Filter Manager
- Potential Execution via FileFix Phishing Attack
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential Foxmail Exploitation
- Potential IIS Web Shell File Creation
- Potential LSA Authentication Package Abuse
- Potential Local NTLM Relay via HTTP
- Potential Modification of Accessibility Binaries
- Potential NetNTLMv1 Downgrade Attack
- Potential Notepad Markdown RCE Exploitation
- Potential Persistence via Time Provider Modification
- Potential Port Monitor or Print Processor Registration Abuse
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via Yuze
- Potential REMCOS Trojan Execution
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote Install via MsiExec
- Potential RemoteMonologue Attack
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Secure File Deletion via SDelete Utility
- Potential System Tampering via File Modification
- Potential Traffic Tunneling using QEMU
- Potential Tunneling via Tailscaled
- Potential Veeam Credential Access Command
- Potential WSUS Abuse for Lateral Movement
- Potential privilege escalation via CVE-2022-38028
- PowerShell Script Block Logging Disabled
- Privilege Escalation via Named Pipe Impersonation
- Privilege Escalation via Windir Environment Variable
- Process Activity via Compiled HTML File
- Process Execution from an Unusual Directory
- Program Files Directory Masquerading
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- RDP Enabled via Registry
- Rare Connection to WebDAV Target
- Rare SMB Connection to the Internet
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Desktop File Opened from Suspicious Path
- Remote File Copy to a Hidden Share
- Remote File Download via Desktopimgdownldr Utility
- Remote File Download via MpCmdRun
- Remote GitHub Actions Runner Registration
- Remote Management Access Launch After MSI Install
- Renamed Automation Script Interpreter
- Renamed Utility Executed with Short Program Name
- SIP Provider Modification
- Scheduled Tasks AT Command Enabled
- ScreenConnect Server Spawning Suspicious Processes
- Script Execution via Microsoft HTML Application
- Searching for Saved Credentials via VaultCmd
- Service Control Spawned via Script Interpreter
- Service DACL Modification via sc.exe
- Signed Proxy Execution via MS Work Folders
- SolarWinds Process Disabling Services via Registry
- Startup Persistence by a Suspicious Process
- Suspicious .NET Code Compilation
- Suspicious Antimalware Scan Interface DLL
- Suspicious CertUtil Commands
- Suspicious Child Process of PaperCut Server Component
- Suspicious Cmd Execution via WMI
- Suspicious Endpoint Security Parent Process
- Suspicious Execution from INET Cache
- Suspicious Execution from a WebDav Share
- Suspicious Execution via Microsoft Office Add-Ins
- Suspicious Execution via Windows Subsystem for Linux
- Suspicious Execution with NodeJS
- Suspicious Explorer Child Process
- Suspicious ImagePath Service Creation
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious JavaScript Execution via Deno
- Suspicious JetBrains TeamCity Child Process
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious Managed Code Hosting Process
- Suspicious Microsoft Antimalware Service Execution
- Suspicious Microsoft Diagnostics Wizard Execution
- Suspicious Microsoft HTML Application Child Process
- Suspicious PDF Reader Child Process
- Suspicious Print Spooler File Deletion
- Suspicious Print Spooler Point and Print DLL
- Suspicious Process Execution via Renamed PsExec Executable
- Suspicious ScreenConnect Client Child Process
- Suspicious Shell Execution via Velociraptor
- Suspicious Startup Shell Folder Modification
- Suspicious WerFault Child Process
- Suspicious Windows Command Shell Arguments
- Suspicious Windows Powershell Arguments
- Suspicious Zoom Child Process
- Svchost spawning Cmd
- Symbolic Link to Shadow Copy Created
- System File Ownership Change
- System Shells via Services
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- UAC Bypass via ICMLuaUtil Elevated COM Interface
- UAC Bypass via Windows Firewall Snap-In Hijack
- Unusual Child Process from a System Virtual Process
- Unusual Child Process of dns.exe
- Unusual Executable File Creation by a System Critical Process
- Unusual Execution via Microsoft Common Console File
- Unusual File Creation - Alternate Data Stream
- Unusual Parent Process for cmd.exe
- Unusual Parent-Child Relationship
- Unusual Persistence via Services Registry
- Unusual Print Spooler Child Process
- Unusual Process Execution Path - Alternate Data Stream
- Unusual Service Host Child Process - Childless Service
- User Account Creation
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- WDAC Policy File by an Unusual Process
- Web Shell Detection: Script Process Child of Common Web Processes
- Werfault ReflectDebugger Persistence
- Whoami Process Activity
- Windows Defender Disabled via Registry Modification
- Windows Defender Exclusions Added via PowerShell
- Windows Firewall Disabled via PowerShell
- Windows Sandbox with Sensitive Configuration
- Windows Script Executing PowerShell
- Windows Script Execution from Archive
- Windows Server Update Service Spawning Suspicious Processes
- Windows Subsystem for Linux Distribution Installed
- Windows Subsystem for Linux Enabled via Dism Utility
- Wireless Credential Dumping using Netsh Command
Microsoft Sentinel 120
- ADFS DKM Master Key Export
- ASR Bypassing Writing Executable Content
- AV detections related to Europium actors
- AV detections related to Hive Ransomware
- AV detections related to SpringShell Vulnerability
- AV detections related to Tarrask malware
- AV detections related to Zinc actors
- Access Token Manipulation - Create Process with Token
- Account Creation
- Anomaly found in Network Session Traffic (ASIM Network Session schema)
- Audit policy manipulation using auditpol utility
- Azure VM Run Command operations executing a unique PowerShell script
- Bitsadmin Activity
- C2-NamedPipe
- COM Registry Key Modified to Point to File in Color Profile Folder
- CertUtil Used for File Download (Living off the Land)
- Clearing of forensic evidence from event logs using wevtutil
- Component Object Model Hijacking - Vault7 trick
- DCOM Lateral Movement
- DEV-0270 New User Creation
- Dataverse - Terminated employee exfiltration to USB drive
- Deimos Component Execution
- Deletion of data on multiple drives using cipher exe
- Detect .NET runtime being loaded in JScript for code execution
- Detect Suspicious Commands Initiated by Webserver Processes
- Detect port misuse by anomaly based detection (ASIM Network Session schema)
- Detect port misuse by static threshold (ASIM Network Session schema)
- Detecting UAC bypass - ChangePK and SLUI registry tampering
- Detecting UAC bypass - elevated COM interface
- Detecting UAC bypass - modify Windows Store settings
- Dev-0228 File Path Hashes November 2021
- Dev-0270 Malicious Powershell usage
- Dev-0270 Registry IOC - September 2022
- Dev-0270 WMIC Discovery
- Dev-0530 File Extension Rename
- Disable or Modify Windows Defender
- Disabling Security Services via Registry
- Doppelpaymer Stop Services
- DopplePaymer Procdump
- Email access via active sync
- Europium - Hash and IP IOCs - September 2022
- Excessive number of failed connections from a single source (ASIM Network Session schema)
- Exchange Worker Process Making Remote Call
- Execution of software vulnerable to webp buffer overflow of CVE-2023-4863
- Files Copied to USB Drives
- GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)
- Hijack Execution Flow - DLL Side-Loading
- IP address of Windows host encoded in web request
- Identify Mango Sandstorm powershell commands
- Identify SysAid Server web shell creation
- Ingress Tool Transfer - Certutil
- Java Executing cmd to run Powershell
- LSASS Credential Dumping with Procdump
- LaZagne Credential Theft
- Local Admin Group Changes
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Lumen TI IPAddress in DeviceEvents
- Mass Download & copy to USB device by single user
- Match Legitimate Name or Location - 2
- Mercury - Domain, Hash and IP IOCs - August 2022
- Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory
- MosaicLoader
- Network Port Sweep from External Network (ASIM Network Session schema)
- Office ASR rule triggered from browser spawned office process.
- Office Apps Launching Wscipt
- Oracle suspicious command execution
- PE file dropped in Color Profile Folder
- PHP Worker Process Spawning Shell/Recon Tool
- Password Spraying
- Port scan detected (ASIM Network Session schema)
- Possible Phishing with CSL and Network Sessions
- Potential Build Process Compromise - MDE
- Potential Ransomware activity related to Cobalt Strike
- Potential beaconing activity (ASIM Network Session schema)
- PowerShell Encoded Command Execution (Living off the Land)
- Prestige ransomware IOCs Oct 2022
- Probable AdFind Recon Tool Usage
- Qakbot Campaign Self Deletion
- Qakbot Discovery Activies
- RDP Nesting
- Rare Process as a Service
- Regsvr32 Rundll32 Image Loads Abnormal Extension
- Regsvr32 Rundll32 with Anomalous Parent Process
- Remote Desktop Protocol - SharpRDP
- Remote File Creation with PsExec
- Rename System Utilities
- SMB/Windows Admin Shares
- SUNBURST and SUPERNOVA backdoor hashes
- SUNBURST network beacons
- SUNBURST suspicious SolarWinds child processes
- SUNSPOT malware hashes
- Security Service Registry ACL Modification
- Service Accounts Performing Remote PS
- Shadow Copy Deletions
- Solorigate Defender Detections
- Star Blizzard C2 Domains August 2022
- Stopping multiple processes using taskkill
- Suspicious Powershell Commandlet Executed
- Suspicious Process Injection from Office application
- Suspicious named pipes
- Suspicious parentprocess relationship - Office child processes.
- TEARDROP memory-only dropper
- TI Map Domain Entity to DeviceNetworkEvents
- TI Map Domain Entity to DeviceNetworkEvents
- TI Map File Hash to DeviceFileEvents Event
- TI Map IP Entity to DeviceNetworkEvents
- TI Map IP Entity to DeviceNetworkEvents
- TI Map IP entity to Network Session Events (ASIM Network Session schema)
- TI Map URL Entity to DeviceNetworkEvents
- TI Map URL Entity to DeviceNetworkEvents
- TI map File Hash to DeviceFileEvents Event
- TI map IP entity to Network Session Events (ASIM Network Session schema)
- Trusted Developer Utilities Proxy Execution
- Unusual identity creation using exchange powershell
- VTI - High Severity SHA1 Collision Detection
- WMI Spawning Suspicious Child Process (Living off the Land)
- Windows host username encoded in base64 web request
- Zinc Actor IOCs files - October 2022
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022
- [Deprecated] Explicit MFA Deny
Events
Minimum (4)
- DeviceEventsDeviceEvents
- DeviceFileEventsDeviceFileEvents
- DeviceNetworkEventsDeviceNetworkEvents
- DeviceProcessEventsDeviceProcessEvents
Recommended (3)
- DeviceImageLoadEventsDeviceImageLoadEvents
- DeviceLogonEventsDeviceLogonEvents
- DeviceRegistryEventsDeviceRegistryEvents
Listed (17)
- DeviceEvents:AmsiScriptContentDeviceEvents / AmsiScriptContent
- DeviceEvents:CreateRemoteThreadApiCallDeviceEvents / CreateRemoteThreadApiCall
- DeviceEvents:LdapSearchDeviceEvents / LdapSearch
- DeviceEvents:NamedPipeEventDeviceEvents / NamedPipeEvent
- DeviceEvents:PowerShellCommandDeviceEvents / PowerShellCommand
- DeviceEvents:QueueUserApcRemoteApiCallDeviceEvents / QueueUserApcRemoteApiCall
- DeviceEvents:SetThreadContextRemoteApiCallDeviceEvents / SetThreadContextRemoteApiCall
- DeviceEvents:UserAccountAddedToLocalGroupDeviceEvents / UserAccountAddedToLocalGroup
- DeviceFileEvents:FileCreatedDeviceFileEvents / FileCreated
- DeviceFileEvents:FileRenamedDeviceFileEvents / FileRenamed
- DeviceInfoDeviceInfo
- DeviceLogonEvents:LogonFailedDeviceLogonEvents / LogonFailed
- DeviceLogonEvents:LogonSuccessDeviceLogonEvents / LogonSuccess
- DeviceNetworkEvents:ConnectionSuccessDeviceNetworkEvents / ConnectionSuccess
- DeviceNetworkEvents:InboundConnectionAcceptedDeviceNetworkEvents / InboundConnectionAccepted
- DeviceNetworkInfoDeviceNetworkInfo
- DeviceRegistryEvents:RegistryValueSetDeviceRegistryEvents / RegistryValueSet