Detect Suspicious ncrypt.dll usage by CLI tool or unknown process

Robbe Van den Daele@RobbeVdDaele

•updated Aug 19, 2025•2•0•55

This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll. More information on the attack scenario this is detection is applicable for can be found in the references.