Tag Archive: Attack Disruption

What can be more exciting than new Advance Hunting tables. Since it’s Preview it could change

The DisruptionAndResponseEvents table in Microsoft Defender XDR is your visibility layer into automatic attack disruption – Microsoft’s built-in capability to actively stop attacks in progress.

It records what Defender did, not just what the attacker did.

Telemetry

Most telemetry tells you what happened while this table tells you how an attack was disrupted in real time and it helps you understand attack scope, attack impact and Defender’s automated response decisions.

What kind of events you’ll see?

The table focuses on defensive actions

• Containment actions
• Examples:
• User logon blocked
• SMB access blocked
• RPC access denied
• RDP sessions disconnected

Hardening & protection policies

• Safe Boot blocked
• Safe Boot Guard applied
• Group Policy hardening applied
• SYSVOL access blocked

These indicate environment hardening triggered automatically

Session / activity termination

• SMB session killed
• Remote session logged off

These show active attacker sessions being cut off

Important nuance (most people miss this) the table does NOT log the action itself (like “Contain User”) instead, it logs the resulting effects, such as:

• Blocked logons
• Denied access
• Policy enforcement

Data sources & dependencies

Populated from multiple Defender services (Endpoint, Identity, etc.) which requires proper onboarding – otherwise you’ll see little or no data

No onboarding = no visibility.

This table shines when you want to answer:

• What did Defender automatically stop?
• Why did this attack fail?
• Which users/devices were actively contained?
• What hardening actions were triggered during an incident?

If you want to have the table extended with the description you can use the following User-defined function (which runs in query time in Defender)

let GetResponseDescription = (ActionType:string)
{
    case(
        ActionType == "ContainedRestrictedUserSmbFileOpenBlocked", "Logs an event when a user who is a member of a restricted user group attempts to open a specific Server Message Block (SMB) shared file and the action is blocked.",
        ActionType == "ContainedUserLogonBlocked", "Logs an event when a contained user's logon attempt is blocked.",
        ActionType == "ContainedUserLogonBlockedByDomainController", "Logs an event when a user's logon attempt to a device in the domain is blocked by the Domain Controller due to containment policies.",
        ActionType == "ContainedUserRemoteDesktopSessionDisconnected", "Logs an event when a contained user's remote desktop session is forcibly disconnected using WTSDisconnectSession.",
        ActionType == "ContainedUserRemoteDesktopSessionStopped", "Logs an event when a contained user's remote desktop session is stopped using WTSLogoffSession.",
        ActionType == "ContainedUserRpcAccessBlocked", "Logs an event when a contained user's attempt to access a resource via RPC is blocked.",
        ActionType == "ContainedUserSmbFileOpenBlocked", "Logs an event when a contained user attempts to open an SMB shared file and the attempt is blocked.",
        ActionType == "ContainedUserSmbFileOpenBlockedAggregation", "Same as ContainedUserSmbFileOpenBlocked, but aggregated for cases where the same contained user accesses more than 10 files within a one-minute window.",
        ActionType == "ContainedUserSmbSessionStopped", "Logs an event when an SMB session initiated by a contained user is forcibly ended.",
        ActionType == "GroupPolicyAccessBlocked", "Blocks access to the SYSVOL directory, preventing the device from pulling group policy updates.",
        ActionType == "SafeBootBlocked", "Prevents the device from being rebooted into safe mode.",
        ActionType == "SafeBootGuardPolicyApplied", "Applies the Safe Boot Guard policy to the device.",
        ActionType == "SafeBootGuardPolicyRemoved", "Removes the Safe Boot Guard policy from the device.",
        ActionType == "GroupPolicyHardeningPolicyApplied", "Applies the Group Policy Hardening policy to the device.",
        ActionType == "GroupPolicyHardeningPolicyRemoved", "Removes the Group Policy Hardening policy from the device.",
        "Unknown ActionType"
    )
};
DisruptionAndResponseEvents
| extend ResponseDescription = GetResponseDescription(ActionType)
| summarize arg_max(TimeGenerated,*) by ActionType

For further information about Attack Disruption, please visit: Automatic attack disruption in Microsoft Defender – Microsoft Defender XDR | Microsoft Learn

#Happy Hunting