Detection rules › By event

Defender-DeviceFileEvents

Event	Rules
any	23
FileCreated	13
FileModified	4
FileRenamed	5

any

23 detection rules reference this event. View event page.

Kusto (23)

[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 severity high T1546
Azure VM Run Command operations executing a unique PowerShell script severity medium T1059,T1059.001,T1570
Dataverse - Terminated employee exfiltration to USB drive severity high T1052
Detect executable drops via Azure custom script extension T1021,T1021.008,T1651
Detect LolDriver drop or load from unknown or unsigned process T1068
Dev-0530 File Extension Rename severity high T1486
Europium - Hash and IP IOCs - September 2022 severity high T1003,T1071
Identify SysAid Server web shell creation severity high T1190
Ingress Tool Transfer - Certutil severity low T1027,T1105,T1140,T1564,T1564.004
Mercury - Domain, Hash and IP IOCs - August 2022 severity high T1071
Microsoft Recommended Driver Block List
PE file dropped in Color Profile Folder severity medium T1203
Potential Build Process Compromise - MDE severity medium T1554
Prestige ransomware IOCs Oct 2022 severity high T1203
Rare Process as a Service severity medium T1543,T1543.003
Remote File Creation with PsExec severity high T1570
Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint)
SUNBURST and SUPERNOVA backdoor hashes severity high T1059,T1195,T1546
Suspicious MSC File Launched T1218,T1218.014,T1566
TI Map File Hash to DeviceFileEvents Event severity medium T1071
TI map File Hash to DeviceFileEvents Event severity medium T1071
VTI - High Severity SHA1 Collision Detection severity high T1204
Zinc Actor IOCs files - October 2022 severity high T1546

FileCreated

13 detection rules reference this event. View event page.

FileModified

4 detection rules reference this event. View event page.

Kusto (4)

Hijack Execution Flow - DLL Side-Loading severity medium T1574,T1574.001
Potential Build Process Compromise - MDE severity medium T1554
Rouge RDP: Suspicious File Creation T1556
WinRM Plugin Lateral Movement T1021,T1021.006

FileRenamed

5 detection rules reference this event. View event page.

Kusto (5)

ASR Bypassing Writing Executable Content severity medium T1211
Mass Download & copy to USB device by single user severity medium T1052
Suspicious MSC File Launched T1218,T1218.014,T1566
Suspicious office child process created T1204
WinRM Plugin Lateral Movement T1021,T1021.006