Microsoft Defender for Endpoint

// What is MDE?

Microsoft Defender for Endpoint (MDE) is Microsoft's enterprise EDR (Endpoint Detection and Response) platform. It monitors endpoints � Windows, macOS, Linux, iOS, and Android � for malicious behaviour, provides automated investigation and remediation, and feeds into the broader Microsoft Defender XDR ecosystem.

MDE is tightly integrated with Microsoft Sentinel, Entra ID, Microsoft Defender for Identity, and Microsoft Defender for Office 365 � giving analysts a correlated view across the entire Microsoft security stack through the Microsoft Defender portal.

// Console Overview

The Defender portal (security.microsoft.com) is the unified interface for all Microsoft Defender products. Key sections for MDE:

// Alert Investigation

Each alert in MDE has an alert story � a visual timeline and process tree that shows the sequence of events leading to the detection.

Alert fields

Alert story � what to look for

// Device Inventory

The Device Inventory lists all onboarded endpoints. From a device page you can see:

// Incident Management

MDE automatically groups related alerts across devices and users into incidents. An incident representing an attack campaign may include alerts from multiple devices, each showing a different stage of the attack chain.

Attack chain view

The incident's Attack story tab shows a graphical view of the attack � entities (devices, users, processes, files) connected by the actions that link them. This is useful for scoping: how many devices are affected, which accounts were involved, and what the attacker did at each stage.

Automated Investigation

MDE can automatically investigate alerts and take remediation actions (quarantine files, stop processes) without analyst intervention. Check the Investigations tab on an incident to see what automated actions were taken and whether any require analyst approval before proceeding.

// Advanced Hunting (KQL)

Advanced Hunting lets you query 30 days of raw endpoint telemetry using KQL. This is the primary tool for proactive threat hunting beyond the alerts MDE generates automatically.

Key MDE tables

Hunting queries

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "-e ")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc

// Detects processes named lsass.exe spawned by unexpected parents
// (masquerading malware, not credential dumping via memory access)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ ("wininit.exe", "smss.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has_any (@"\AppData\Local\Temp", @"\Windows\Temp", @"\ProgramData")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".bat"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| sort by Timestamp desc

DeviceLogonEvents
| where Timestamp > ago(24h)
| where LogonType == "Network"
| where isnotempty(RemoteIP)
| where not(ipv4_is_private(RemoteIP)) and RemoteIP != "127.0.0.1"
| project Timestamp, DeviceName, AccountName, RemoteIP, LogonType
| sort by Timestamp desc

// Response Actions

// Threat & Vulnerability Management

MDE's TVM module provides continuous vulnerability assessment without requiring separate scans. It uses the MDE agent's telemetry to inventory installed software and map it against known CVEs.

// Attack Surface Reduction Rules

ASR rules are Windows security controls that block specific attack techniques before they execute � regardless of whether they're detected by AV or EDR. They work at the kernel level and are configured through MDE or Group Policy.