John Maclain
@Maclain19551 follower5 downloads188 copies10 likes924 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Products / Services
1
MITRE Techniques
1
1
1
This KQL query hunts for repeated remote logon activity (via RDP or similar) from source devices that lack Microsoft Defender for Endpoint (MDE) telemetry to server-class devices over an extended period (default 60 days). It identifies patterns where a non-monitored endpoint consistently connects to a server daily or near-daily, which may indicate:
=> Compromised or unmanaged jump hosts
=> Lateral movement from external or BYOD devices
=> Unauthorized administrative access from unmonitored workstations
=> Potential living-off-the-land or persistence techniques
The detection focuses on initiating devices without MDE sensor data (HasTelemetry == false) targeting servers, with logons occurring on multiple distinct days, suggesting routine access rather than one-off events.
Cross validate via HasTelemetry == true (i.e with this changes it identifies source devices which are reporting with proper MDE.)
KQL for MDE.
=> Compromised or unmanaged jump hosts
=> Lateral movement from external or BYOD devices
=> Unauthorized administrative access from unmonitored workstations
=> Potential living-off-the-land or persistence techniques
The detection focuses on initiating devices without MDE sensor data (HasTelemetry == false) targeting servers, with logons occurring on multiple distinct days, suggesting routine access rather than one-off events.
Cross validate via HasTelemetry == true (i.e with this changes it identifies source devices which are reporting with proper MDE.)
KQL for MDE.
