r/DefenderATP

I’m the IT lead for a 120-person company on Microsoft 365. We recently found a sales rep who had been downloading our customer database to a personal OneDrive.

We had Purview turned on for months. It generated plenty of alerts about external Word doc shares, but nothing on this case. The rep had been with us four years. His OneDrive sync stayed active for 11 days after the termination date. From the Microsoft side the activity looked like normal use of his own account. The signal that stood out was a terminated identity in the IdP still making high-volume API calls.

I’m trying to build a more reliable way to catch this kind of post-termination activity. What does your actual workflow look like for spotting terminated users who still have live OneDrive or similar syncs running? Looking for practical detection and response steps.

I'm looking for some advice regarding Microsoft Defender for Endpoint (MDE) telemetry coverage.

As part of our Threat Hunting programme, we've been testing a number of KQL queries to better understand MDE's telemetry coverage and identify areas where detections may need further tuning.

Using Atomic Red Team tests and other scripts within a dedicated testing environment, we've identified what appears to be a gap in telemetry collection for certain interactively executed PowerShell commands.

For example, when PowerShell or PowerShell ISE is launched and commands are executed interactively, we do not always receive the full cmdlet or script content within MDE telemetry. This makes it difficult to accurately detect, investigate and hunt for the activity using Advanced Hunting.

During our research, we came across the following Microsoft discussion:

🔗 Microsoft Defender ATP - Advanced Hunting Query PowerShell Command Line

The recommendation in that thread is to enable PowerShell Script Block Logging. However, in our testing, enabling Script Block Logging does not appear to resolve the issue. The PowerShell activity is visible locally within Event Viewer, but the corresponding telemetry does not seem to be forwarded into MDE.

Has anyone else encountered this limitation?

I'm particularly interested in understanding:

• Whether this is expected behaviour within MDE
• If there are additional configuration requirements beyond Script Block Logging
• Whether others have found alternative telemetry sources or hunting approaches to capture this activity more reliably

Any insights, experiences or recommendations would be greatly appreciated.