m365:defender
Microsoft Defender XDR advanced hunting tables
Device*, Email*, Identity* tables
- Host type
- Microsoft 365
- Tier, as a whole
- Minimum
- Cost class
- Paid tier
- Techniques
- 5
- Rules listed
- 353
- Events
- 2
Why this tier
OMB M-26-14 A6 (Security tooling alerts; our analysis)
Licensing
- License or service
- Defender for Endpoint Plan 2 (in M365 E5/E5 Security; Windows E5; Defender Suite)
- What is free
- Nothing (P1 lists NGAV/ASR only; no EDR)
- What costs
- P2 or E5-level license per device
- Notes
- Service description lists EDR under P2 and not P1; explicit "advanced hunting = P2" sentence not located on an official page (partially UNCONFIRMED). Business Premium = Defender for Business, not mapped to P1/P2
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Security tooling alerts | Supports an activity | our analysis: XDR alerts and incidents |
Techniques
Rules
Elastic 262
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- Alternate Data Stream Creation/Execution at Volume Root Directory
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install or Run Kali Linux via WSL
- AzCopy or Azure Storage Explorer Usage on Unusual Host
- Backup Deletion with Wbadmin
- Browser Extension Install
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Clearing Windows Console History
- Clearing Windows Event Logs
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command Shell Activity Started via RunDLL32
- Command and Scripting Interpreter via Windows Scripts
- Conhost Spawned By Suspicious Parent Process
- Control Panel Process with Unusual Arguments
- Creation of a Hidden Local User Account
- Creation or Modification of Domain Backup DPAPI private key
- Creation or Modification of Root Certificate
- Creation or Modification of a new GPO Scheduled Task or Service
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- Delete Volume USN Journal with Fsutil
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Disabling Windows Defender Security Settings via PowerShell
- Enable Host Network Discovery via Netsh
- Encrypting Files with WinRar or 7z
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Administrator Accounts
- Executable File Creation with Multiple Extensions
- Execution from Unusual Directory - Command Line
- Execution of COM object via Xwizard
- Execution via GitHub Actions Runner
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution via local SxS Shared Module
- Exporting Exchange Mailbox via PowerShell
- File with Right-to-Left Override Character (RTLO) Created/Executed
- First Time Seen Removable Device
- Full User-Mode Dumps Enabled System-Wide
- GenAI Process Compiling or Generating Executables
- GenAI Process Performing Encoding/Chunking Prior to Network Activity
- GenAI or MCP Server Child Process Execution
- Group Policy Discovery via Microsoft GPResult Utility
- IIS HTTP Logging Disabled
- Image File Execution Options Injection
- ImageLoad via Windows Update Auto Update Client
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Kirbi File Creation
- LSASS Memory Dump Creation
- LSASS Process Access via Windows API
- Lateral Movement via Startup Folder
- Local Account TokenFilter Policy Disabled
- M365 Defender Alerts Signal (UAL)
- MS Office Macro Security Registry Modifications
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Microsoft Defender XDR Alert External Alerts
- Microsoft Defender XDR Incident External Alerts
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft Exchange Server UM Writing Suspicious Files
- Microsoft Exchange Worker Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Microsoft Windows Defender Tampering
- Mimikatz Memssp Log File Detected
- Modification of AmsiEnable Registry Key
- Modification of Boot Configuration
- Modification of WDigest Security Provider
- Mofcomp Activity
- Mounting Hidden or WebDav Remote Shares
- Multiple Remote Management Tool Vendors on Same Host
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- NetSupport Manager Execution from an Unusual Path
- Netsh Helper DLL
- Network Logon Provider Registry Modification
- Network-Level Authentication (NLA) Disabled
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Newly Seen Commonly Abused Network Scanner
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- Outlook Home Page Registry Modification
- Peripheral Device Discovery
- Persistence via BITS Job Notify Cmdline
- Persistence via Hidden Run Key Detected
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via Scheduled Job Creation
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Persistent Scripts in the Startup Directory
- Port Forwarding Rule Addition
- Potential Application Shimming via Sdbinst
- Potential CVE-2025-33053 Exploitation
- Potential ClickFix Command via Windows Run Dialog
- Potential Credential Access via Windows Utilities
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration via Rclone
- Potential EDR-Freeze via WerFaultSecure Abuse
- Potential Entra ID PRT Extraction via BrowserCore
- Potential Escalation via Vulnerable MSI Repair
- Potential Evasion via Filter Manager
- Potential Execution via FileFix Phishing Attack
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential FileFix Command via Windows Explorer Address Bar
- Potential Foxmail Exploitation
- Potential IIS Web Shell File Creation
- Potential LSA Authentication Package Abuse
- Potential Local NTLM Relay via HTTP
- Potential Modification of Accessibility Binaries
- Potential NetNTLMv1 Downgrade Attack
- Potential Notepad Markdown RCE Exploitation
- Potential Persistence via Time Provider Modification
- Potential Port Monitor or Print Processor Registration Abuse
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via Yuze
- Potential REMCOS Trojan Execution
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote Install via MsiExec
- Potential RemoteMonologue Attack
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Secure File Deletion via SDelete Utility
- Potential System Tampering via File Modification
- Potential Traffic Tunneling using QEMU
- Potential Tunneling via Tailscaled
- Potential Veeam Credential Access Command
- Potential WSUS Abuse for Lateral Movement
- Potential privilege escalation via CVE-2022-38028
- PowerShell Script Block Logging Disabled
- Privilege Escalation via Named Pipe Impersonation
- Privilege Escalation via Windir Environment Variable
- Process Activity via Compiled HTML File
- Process Execution from an Unusual Directory
- Program Files Directory Masquerading
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- RDP Enabled via Registry
- Rare Connection to WebDAV Target
- Rare SMB Connection to the Internet
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Desktop File Opened from Suspicious Path
- Remote File Copy to a Hidden Share
- Remote File Download via Desktopimgdownldr Utility
- Remote File Download via MpCmdRun
- Remote GitHub Actions Runner Registration
- Remote Management Access Launch After MSI Install
- Renamed Automation Script Interpreter
- Renamed Utility Executed with Short Program Name
- SIP Provider Modification
- Scheduled Tasks AT Command Enabled
- ScreenConnect Server Spawning Suspicious Processes
- Script Execution via Microsoft HTML Application
- Searching for Saved Credentials via VaultCmd
- Service Control Spawned via Script Interpreter
- Service DACL Modification via sc.exe
- Signed Proxy Execution via MS Work Folders
- SolarWinds Process Disabling Services via Registry
- Startup Persistence by a Suspicious Process
- Suspicious .NET Code Compilation
- Suspicious Antimalware Scan Interface DLL
- Suspicious CertUtil Commands
- Suspicious Child Process of PaperCut Server Component
- Suspicious Cmd Execution via WMI
- Suspicious Endpoint Security Parent Process
- Suspicious Execution from INET Cache
- Suspicious Execution from a WebDav Share
- Suspicious Execution via Microsoft Office Add-Ins
- Suspicious Execution via Windows Subsystem for Linux
- Suspicious Execution with NodeJS
- Suspicious Explorer Child Process
- Suspicious ImagePath Service Creation
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious JavaScript Execution via Deno
- Suspicious JetBrains TeamCity Child Process
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious Managed Code Hosting Process
- Suspicious Microsoft Antimalware Service Execution
- Suspicious Microsoft Diagnostics Wizard Execution
- Suspicious Microsoft HTML Application Child Process
- Suspicious PDF Reader Child Process
- Suspicious Print Spooler File Deletion
- Suspicious Print Spooler Point and Print DLL
- Suspicious Process Execution via Renamed PsExec Executable
- Suspicious ScreenConnect Client Child Process
- Suspicious Shell Execution via Velociraptor
- Suspicious Startup Shell Folder Modification
- Suspicious WerFault Child Process
- Suspicious Windows Command Shell Arguments
- Suspicious Windows Powershell Arguments
- Suspicious Zoom Child Process
- Svchost spawning Cmd
- Symbolic Link to Shadow Copy Created
- System File Ownership Change
- System Shells via Services
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- UAC Bypass via ICMLuaUtil Elevated COM Interface
- UAC Bypass via Windows Firewall Snap-In Hijack
- Unusual Child Process from a System Virtual Process
- Unusual Child Process of dns.exe
- Unusual Executable File Creation by a System Critical Process
- Unusual Execution via Microsoft Common Console File
- Unusual File Creation - Alternate Data Stream
- Unusual Parent Process for cmd.exe
- Unusual Parent-Child Relationship
- Unusual Persistence via Services Registry
- Unusual Print Spooler Child Process
- Unusual Process Execution Path - Alternate Data Stream
- Unusual Service Host Child Process - Childless Service
- User Account Creation
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- WDAC Policy File by an Unusual Process
- Web Shell Detection: Script Process Child of Common Web Processes
- Werfault ReflectDebugger Persistence
- Whoami Process Activity
- Windows Defender Disabled via Registry Modification
- Windows Defender Exclusions Added via PowerShell
- Windows Firewall Disabled via PowerShell
- Windows Sandbox with Sensitive Configuration
- Windows Script Executing PowerShell
- Windows Script Execution from Archive
- Windows Server Update Service Spawning Suspicious Processes
- Windows Subsystem for Linux Distribution Installed
- Windows Subsystem for Linux Enabled via Dism Utility
- Wireless Credential Dumping using Netsh Command
Microsoft Sentinel 89
- AV detections related to Dev-0530 actors
- AV detections related to Europium actors
- AV detections related to Hive Ransomware
- AV detections related to SpringShell Vulnerability
- AV detections related to Tarrask malware
- AV detections related to Ukraine threats
- AV detections related to Zinc actors
- Aqua Blizzard AV hits - Feb 2022
- Azure DevOps Pipeline modified by a new user
- Correlate Unfamiliar sign-in properties & atypical travel alerts
- Cross-Cloud Password Spray detection
- Cross-Cloud Suspicious user activity observed in GCP Envourment
- Dataverse - Guest user exfiltration following Power Platform defense impairment
- Dataverse - Suspicious use of TDS endpoint
- Dataverse - Terminated employee exfiltration over email
- Defender Alert Evidence
- Denial of Service (Microsoft Defender for IoT)
- Detect CoreBackUp Deletion Activity from related Security Alerts
- Detect Malicious Usage of Recovery Tools to Delete Backup Files
- Detect Potential Kerberoast Activities
- Detect Print Processors Registry Driver Key Creation/Modification
- Detect Registry Run Key Creation/Modification
- Detect Windows Allow Firewall Rule Addition/Modification
- Detect Windows Update Disabled from Registry
- Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt
- Dev-0228 File Path Hashes November 2021
- Dev-0228 File Path Hashes November 2021 (ASIM Version)
- Excessive Login Attempts (Microsoft Defender for IoT)
- Firmware Updates (Microsoft Defender for IoT)
- High bandwidth in the network (Microsoft Defender for IoT)
- Illegal Function Codes for ICS traffic (Microsoft Defender for IoT)
- Insider Risk_High User Security Alert Correlations
- Insider Risk_High User Security Incidents Correlation
- Insider Risk_Microsoft Purview Insider Risk Management Alert Observed
- Internet Access (Microsoft Defender for IoT)
- Linked Malicious Storage Artifacts
- M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity
- Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts
- Mass Download & copy to USB device by single user
- Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory
- Multiple scans in the network (Microsoft Defender for IoT)
- No traffic on Sensor Detected (Microsoft Defender for IoT)
- PLC Stop Command (Microsoft Defender for IoT)
- PLC unsecure key state (Microsoft Defender for IoT)
- Phishing link click observed in Network Traffic
- Possible Phishing with CSL and Network Sessions
- Potential Ransomware activity related to Cobalt Strike
- Power Apps - Multiple users access a malicious link after launching new app
- Prestige ransomware IOCs Oct 2022
- Preview - TI map Domain entity to Cloud App Events
- Preview - TI map Email entity to Cloud App Events
- Preview - TI map IP entity to Cloud App Events
- Preview - TI map URL entity to Cloud App Events
- Process Creation with Suspicious CommandLine Arguments
- SOCRadar Unsynced Closed Incident
- Solorigate Defender Detections
- Star Blizzard C2 Domains August 2022
- Successful AWS Console Login from IP Address Observed Conducting Password Spray
- Suspicious AWS console logins by credential access alerts
- Suspicious VM Instance Creation Activity Detected
- Suspicious malware found in the network (Microsoft Defender for IoT)
- TI Map Domain entity to Cloud App Events
- TI Map Domain entity to EmailEvents
- TI Map Domain entity to EmailUrlInfo
- TI Map Domain entity to SecurityAlert
- TI Map Email entity to Cloud App Events
- TI Map Email entity to EmailEvents
- TI Map Email entity to SecurityAlert
- TI Map IP entity to Cloud App Events
- TI Map URL Entity to EmailUrlInfo
- TI Map URL Entity to EmailUrlInfo
- TI Map URL Entity to SecurityAlert Data
- TI Map URL Entity to SecurityAlert Data
- TI Map URL Entity to UrlClickEvents
- TI Map URL Entity to UrlClickEvents
- TI Map URL entity to Cloud App Events
- TI map Domain entity to EmailEvents
- TI map Domain entity to EmailUrlInfo
- TI map Domain entity to SecurityAlert
- TI map Email entity to EmailEvents
- TI map Email entity to SecurityAlert
- Unauthorized DHCP configuration in the network (Microsoft Defender for IoT)
- Unauthorized PLC changes (Microsoft Defender for IoT)
- Unauthorized device in the network (Microsoft Defender for IoT)
- Unauthorized remote access to the network (Microsoft Defender for IoT)
- Unusual Volume of file deletion by users
- User impersonation by Identity Protection alerts
- VTI - High Severity Domain Collision Detection
- Workspace deletion activity from an infected device