I was reading about a recent PaperCut exploit where suspicious activity was identified through commands such as whoami and local administrator-group enumeration. I tested several unusual commands in my own environment, including Active Directory information-gathering commands, and Microsoft Defender for Endpoint did not generate an alert. An EICAR test was detected normally, so the antivirus component appears to be working.
This made me wonder whether Defender for Endpoint intentionally leaves much of this behavioral detection to custom Advanced Hunting queries, SIEM rules, or managed detection services. We previously used CrowdStrike and I do not remember needing to create as many detections. For those running Defender for Endpoint, how much custom detection engineering are you doing, and what kinds of activity have you found worth monitoring?
4 Answers
There is no complete public list that lets you compare every built-in Defender detection with your own rules, and documented coverage does not always match what fires in a particular environment. The practical approach is to replay representative ATT&CK techniques in a controlled test environment, record what reaches the console, and then create detections for the gaps that matter to your organization. Custom detections are still worthwhile even when automatic attack disruption is enabled.
The Advanced Hunting language is capable of detecting a lot of this, but many useful queries are not enabled as alerts by default. A reasonable starting point is looking for discovery commands launched by unusual parent processes, then correlating them with sign-ins, lateral movement, or other suspicious behavior. Exclusions may be necessary for noisy business applications, but hostname-based exceptions should be documented and reviewed whenever systems are renamed or replaced.
Defender generally is not expected to block or alert on every standalone discovery command. Those actions have too many legitimate uses, and the product may act only when they form part of a broader attack pattern. More advanced attackers may also use native APIs or other methods instead of launching obvious utilities. Enumeration-focused alerts are often better handled through Advanced Hunting or SIEM correlation.
Yes, custom detections are useful, but start with a baseline. Commands like whoami or local-group enumeration are common in legitimate scripts, RMM tools, and administrative sessions, so a simple command match will create a lot of noise. Looking at the parent process, logon type, user context, device role, and follow-on activity is usually more valuable. Also remember that an EICAR test only confirms the antivirus engine is functioning; it says nothing about behavioral coverage.
That is close to what we implemented: alert when commands such as whoami are launched outside normal command shells. We have had to add exceptions for a legacy facilities-management application that behaves strangely, although I am concerned those hostname-based exclusions will be forgotten when the systems change.