detection.wiki

Defender-AlertEvidence

ActionTypeTitleSampleRule
anyAlert evidenceYY

any: Alert evidence

#
Table
AlertEvidence

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
EntityType2 detection rulesKusto
ServiceSource1 detection ruleKusto

Example Event #

{
  "AdditionalFields": {
    "DnsDomain": "ludus.domain",
    "HostName": "jd-win11-22h2-1",
    "NetBiosName": "jd-win11-22h2-1.ludus.domain",
    "OSFamily": "Windows",
    "OSVersion": "10.0",
    "IsDomainJoined": true,
    "IpInterfaces": [
      {
        "$id": "2",
        "Address": "10.2.10.21",
        "Type": "ip"
      },
      {
        "$id": "3",
        "Address": "127.0.0.1",
        "Type": "ip"
      },
      {
        "$id": "4",
        "Address": "::1",
        "Type": "ip"
      }
    ],
    "RemediationProviders": [
      {
        "RemediationState": "Active",
        "RemediationDate": "2026-08-01T09:23:27.0361808Z",
        "Type": "remediation-provider"
      }
    ],
    "LastRemediationState": "Active",
    "ThreatAnalysisSummary": [
      {
        "AnalyzersResult": [],
        "Verdict": "Suspicious",
        "AnalysisDate": "2026-08-01T09:23:27.0361808Z"
      }
    ],
    "LastVerdict": "Suspicious",
    "Asset": true,
    "DetailedRoles": [
      "PrimaryDevice"
    ],
    "RbacScopes": {
      "ScopesPerType": {
        "MachineGroupIds": {
          "Mode": "Any",
          "Scopes": [
            "223"
          ]
        },
        "Workloads": {
          "Mode": "All",
          "Scopes": [
            "Mdatp"
          ]
        }
      }
    },
    "Type": "host",
    "LeadingHost": true,
    "Role": 0,
    "MachineId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
    "MachineIdType": 3,
    "HostMachineId": null,
    "DetectionStatus": "Detected",
    "SuspicionLevel": "Suspicious",
    "EnrichmentType": "MachineIpInterfacesEnrichment",
    "IsIoc": false,
    "MergeByKey": "7i1RmyvZqPH7gS+N2PpTwV+Sz64=",
    "MergeByKeyHex": "EE2D519B2BD9A8F1FB812F8DD8FA53C15F92CFAE"
  },
  "AlertId": "da90e6fe47-4ecb-4cfd-abd5-826bc671bae6_1",
  "AttackTechniques": [
    "Masquerading (T1036)",
    "Masquerade Task or Service (T1036.004)",
    "Windows Service (T1543.003)",
    "Service Execution (T1569.002)",
    "Services Registry Permissions Weakness (T1574.011)"
  ],
  "Categories": [
    "Persistence"
  ],
  "DetectionSource": "EDR",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "EntityType": "Machine",
  "EvidenceRole": "Impacted",
  "LocalIP": "10.2.10.21",
  "ServiceSource": "Microsoft Defender for Endpoint",
  "Severity": "Medium",
  "Timestamp": "2026-08-01T02:22:14.8885692Z",
  "Title": "Suspicious service registration"
}

Detection Patterns #

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
DestinationHostname (kusto rule field)is_not_null1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

  • Possible Phishing with CSL and Network Sessions source medium: This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. If your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.T1102, T1566
  • Defender Alert Evidence source high: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.T1546

References #