DETECT: Remote Logins from Non-Telemetry (Non reporting MDE) Source Devices to Servers
This KQL query hunts for repeated remote logon activity (via RDP or similar) from source devices that lack Microsoft Defender for Endpoint (MDE) telemetry to server-class devices over an extended period (default 60 days). It identifies patterns where a non-monitored endpoint consistently connects to a server daily or near-daily, which may indicate: => Compromised or unmanaged jump hosts => Lateral movement from external or BYOD devices => Unauthorized administrative access from unmonitored workstations => Potential living-off-the-land or persistence techniques The detection focuses on initiating devices without MDE sensor data (HasTelemetry == false) targeting servers, with logons occurring on multiple distinct days, suggesting routine access rather than one-off events. Cross validate via HasTelemetry == true (i.e with this changes it identifies source devices which are reporting with proper MDE.) KQL for MDE.
Microsoft Sentinel (KQL)
