During a lateral movement investigation, an analyst has a list of devices that an attacker reached and wants to determine which user accounts authenticated to those devices and from which source devices, so the spread can be traced hop by hop. The analyst needs the table in Microsoft Defender XDR advanced hunting that records authentication and logon activity on endpoints, including the account, the logon type, and the remote device. Which table should the analyst query?
- ADeviceLogonEvents, which records sign-ins and authentication activity observed on devices, including the account, logon type, and the remote device, so each authentication hop can be reconstructed. Correct
- BDeviceProcessEvents, which records process creation on devices, including the command line and the parent process, so the analyst can see which programs ran during the attacker's lateral movement.
- CDeviceNetworkEvents, which records network connections made by devices, including remote IP addresses and ports, so the analyst can map the connectivity the attacker used between hosts.
- DIdentityLogonEvents, which records authentication activity seen by Microsoft Defender for Identity from domain controllers and Active Directory, including logons against identity infrastructure.
Why A is correct: DeviceLogonEvents captures endpoint logon and authentication activity with the account, logon type, and remote device fields, which is exactly what is needed to trace which users authenticated to which devices and follow lateral movement hop by hop.
Why B is wrong: DeviceProcessEvents is essential for execution analysis and may show tools used to move laterally, which makes it tempting; it captures process creation rather than logon events, so it does not reveal which accounts authenticated to which devices.
Why C is wrong: DeviceNetworkEvents shows connection-level telemetry such as remote IPs and ports and can hint at host-to-host traffic, but it does not record the authenticating account or logon type, so it cannot attribute logons to specific users.
Why D is wrong: IdentityLogonEvents reflects authentication observed by Microsoft Defender for Identity at the identity layer, which is useful for directory-side analysis; it does not record the endpoint-observed device logons needed to trace authentications onto the specific reached devices.