MDE Device Rename

Query

let DeviceMultipleNames = (
DeviceInfo
| where isnotempty( HardwareUuid)
| summarize arg_max(Timestamp,*), ComputerNames = make_set(DeviceName), DeviceNameCount = dcount(DeviceName) by HardwareUuid
| where DeviceNameCount > 1
| project Timestamp,  ComputerNames, HardwareUuid);
DeviceMultipleNames

About this query

MDE - Device Rename

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1078	Initial Access: Valid Accounts	https://attack.mitre.org/techniques/T1078/

Description

Use the below queries to identify Windows devices that have been renamed

References

Microsoft Defender XDR

Detect device rename using Defender for Endpoint logs

Detect device rename when device is AD joined (Requires Defender for Identity)

IdentityDirectoryEvents
| where ActionType == @"Account Name changed"
| extend FROM_Account_Name = tostring(AdditionalFields.["FROM Account Name"])
| extend TO_Account_Name = tostring(AdditionalFields.["TO Account Name"])
| project TimeGenerated, FROM_Account_Name, TO_Account_Name, ActionType, TargetDeviceName

Explanation

This query is designed to identify Windows devices that have been renamed, which can be an indicator of unauthorized access or configuration changes. It uses Microsoft Defender for Endpoint and Defender for Identity logs to detect such changes.

Detecting Device Renames with Defender for Endpoint:
- The first part of the query checks for devices that have multiple names associated with the same hardware UUID. This is done by summarizing the data to find devices with more than one name, indicating a rename event.
Detecting Account Name Changes with Defender for Identity:
- The second part of the query looks for events where an account name has been changed on devices that are joined to Active Directory. This involves filtering identity directory events to find changes in account names, which could also signal a device rename.

Overall, these queries help in monitoring and detecting potential security incidents related to device renaming in a Windows environment.

Details

Alex Verboon

Released: October 9, 2024

Tables

DeviceInfoIdentityDirectoryEvents

Keywords

DeviceInfoIdentityDirectoryEventsHardwareUuidComputerNamesNameTimestampActionTypeAccountAdditionalFieldsTarget

Operators

letisnotemptysummarizearg_maxmake_setdcountbywhereprojectextendtostring==

MITRE Techniques

T1078

Actions

GitHub

KQL Search