Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce

Robbe Van den Daele@RobbeVdDaele

•updated Aug 19, 2025•5•0•62

This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.