Defender for Identity RCE and pass-the-hash alerts retire: migrate

Microsoft Defender for Identity is retiring two classic alerts, "Remote code execution attempt" and "Suspected identity theft (pass-the-hash)", with rollout starting in late November 2026. Message Center post MC1552387 (published November 13, 2026) lists November 30, 2026 as the act-by date. To keep coverage, create a custom detection rule for remote code execution from Microsoft's published query, and confirm that your devices are onboarded to Defender for Endpoint for pass-the-hash.

This guide is for security administrators and SOC analysts who run Defender for Identity. It shows how to find out whether you depend on these alerts, how to build the replacement rule, and how to test and roll back.

What the retirement is

MC1552387 is tagged Retirement for the Microsoft Defender XDR service. Its summary says Defender for Identity retires two classic alerts: "Remote code execution attempt" and "Suspected identity theft (pass-the-hash)". The post says rollout begins in late November 2026 and is expected to finish in the same period, and that no compliance issues were identified. The page we read did not show a last-updated date, so we treat the published date, November 13, 2026, as the date to plan against.

After rollout, both alerts are no longer available. Microsoft's recommended actions in the post are:

1. Create an advanced hunting custom detection rule for remote code execution using Microsoft's published query.
2. Confirm pass-the-hash coverage through Defender for Endpoint on onboarded devices.
3. Review the Defender for Identity classic alerts documentation.

For reference, the Microsoft Learn classic alerts page lists what each alert detects:

The Learn page also notes that Remote code execution attempt alerts on attempted use of PowerShell commands are supported only by Defender for Identity sensors. That matters because the replacement query described below covers WMI, scheduled tasks and services, and the Learn page does not say it covers PowerShell. Plan for that gap.

As of November 15, 2026, the Learn classic alerts page (last updated in its metadata on August 27, 2026) does not mention the retirement, and we found no dated notice about it on the Defender for Identity "What's new" page. If Learn and Message Center ever disagree on the date, plan against the later official update.

Who it affects and availability

You are affected if you use Defender for Identity and any of these depend on the two alert names:

• Analytic or triage playbooks, such as incident queues filtered by alert title.
• Automation, such as Power Automate flows, Logic Apps, SIEM rules or notification rules keyed to alert names or External IDs 2019 and 2017.
• Reports and dashboards that count these alerts.

MC1552387 states that the change applies to Worldwide, GCC, GCC High and DoD environments, so government tenants are not excluded. The post gives no price change and does not describe any license change.

Requirements

• A role that can manage custom detections. Microsoft Learn lists Security settings (manage), Security Administrator, or Security Operator. Security Operator is sufficient only if role-based access control (RBAC) is turned off in Defender for Endpoint; with RBAC configured, you also need the Manage Security Settings permission for Defender for Endpoint.
• Because the query reads IdentityDirectoryEvents, which holds Defender for Identity data, you need manage permissions for the Defender workload that owns the data. Learn states that if you only have rights for Defender for Office 365, you can use Email* tables but not Identity* tables.
• Devices onboarded to Microsoft Defender for Endpoint, for the pass-the-hash path.
• Access to Advanced hunting in the Microsoft Defender portal (security.microsoft.com).

How to check whether you're affected

1. In the Microsoft 365 admin center, open Message Center and search for MC1552387 to read the post in your own tenant, including any update after November 13.
2. In the Microsoft Defender portal, look through recent alerts and incidents for the titles "Remote code execution attempt" and "Suspected identity theft (pass-the-hash)". Note which incidents, tags or response teams they feed. We could not verify the exact portal filter labels in this run, so use the alert title search your portal version offers.
3. List every automation that references those titles or External IDs 2019 and 2017: playbooks, notification rules, SIEM analytics, workbooks.
4. Record how often the alerts fired in the last 30 days. That tells you how noisy a replacement rule might be.
5. Check that devices are onboarded to Defender for Endpoint. Your onboarding method decides how you verify this (for example Intune or the Defender portal's device inventory). See our guide to Defender for Endpoint onboarding with Intune at /blog/defender-for-endpoint-onboarding-intune.

How to migrate to a custom detection rule, step by step

Remote code execution

The query Microsoft links from MC1552387 lives in the Microsoft-Defender-for-Identity GitHub repository (AdvancedHunting/RemoteCodeExecution.md). Its description says it detects possible remote code execution by monitoring three activity types: WMI process creation (win32_process create), task scheduling and service creation. It builds a 7-day baseline and suppresses any account or source device that performed the same action type on at least 3 distinct days. It lists MITRE ATT&CK techniques T1047, T1053.005 and T1543.003.

Copy the query from the repository itself rather than from a secondary source. Do not paste a query you did not read, and review it before use. The steps below follow Microsoft Learn's "Create custom detection rules in Microsoft Defender XDR".

1. In the Microsoft Defender portal, go to Advanced hunting.
2. Paste Microsoft's query from the repository and select Run query to check for errors and review the results.
3. Select Create detection rule. (Alternative: go to Custom detection rules and select + Create detection rule, then paste the query in the wizard.)
4. Under alert details, set Detection name, Frequency, Alert title, Severity, Category, Tactic, Techniques, Description and Recommended actions. Use unique names and plain text. Reusing the old alert's title may help your existing automation to keep matching, but check that this does not confuse analysts; Learn only requires that the title be unique and plain text.
5. Choose a frequency. Learn lists Every 24 hours, Every 12 hours, Every 3 hours, Every hour and Continuous (NRT). The Microsoft query includes joins, comments and a baseline, so the Learn conditions for Continuous (NRT), a single table, no joins and no comment lines, are not met; pick one of the fixed intervals. Match the query's time window to the frequency: Microsoft's query looks at the previous day, which fits Every 24 hours.
6. Under Define alert enrichment details, review the impacted assets. Learn states that for Defender XDR data the entities are selected automatically. Check that account and device mapping look right.
7. Under actions, we suggest leaving automated actions off at first. Learn lists actions such as Isolate device, Disable user and Reset user authentication, which you should enable only after you trust the rule.
8. Set the rule scope, then select Create. Learn says the rule runs immediately and then at the configured frequency.

Two limits from Learn apply: each rule can generate only 150 alerts each time it runs, and when you save a new rule it checks the past 30 days of data. Review the first results for volume.

Pass-the-hash

Microsoft's post says only that pass-the-hash monitoring can continue through Defender for Endpoint on onboarded devices. It does not name an alert or give steps, and we did not find an official page in this run that maps the retired alert to a specific Defender for Endpoint alert. So:

1. Confirm in the Defender portal that the servers and workstations you care about are onboarded.
2. Look for pass-the-hash related alerts in your own tenant's alert history from Defender for Endpoint, and ask your Microsoft account team or support if you need an exact mapping.
3. Update runbooks so that analysts know where this detection now appears.

Limitations, testing and rollback

• The replacement is not an identical detection. The old classic alert description (PSexec, Remote WMI, PowerShell) differs from the query's description (WMI process creation, task scheduling, service creation). Compare them with real data before the cutover.
• Keep the old alerts running until Microsoft turns them off. Run your new rule in parallel for the remaining days, then compare matches against the classic alerts in the same period.
• If a rule is too noisy, edit it. Learn says edits apply from the next scheduled run. If you must turn it off, you can disable the rule from the Custom detection rules list, though we did not verify the exact label for this in this run.
• Tune before you automate. Learn advises reviewing custom detections regularly and tweaking queries to avoid alerting on normal day-to-day activity.
• Not documented: any error messages, behavior in a particular tenant, or whether existing incidents that contain these alerts keep them after retirement. The post does not say.

Privacy and admin notes

The custom detection rule reads identity directory events that Defender for Identity already collects, so no new collection is introduced by the rule itself. Microsoft's post says no compliance issues were identified. Limit who can edit detections, because Learn says rules can take response actions on devices and users, such as isolating devices or disabling accounts. Use roles with the fewest permissions; Learn warns that Global Administrator should be limited to emergency scenarios.

Related reading: our walkthrough of Defender for Identity sensors at /blog/defender-for-identity-sensor-deployment and advanced hunting for identity attacks at /blog/advanced-hunting-kql-identity-attacks.

What we checked

• Opened MC1552387 on the mc.merill.net mirror on 2026-11-15: tag Retirement, service Microsoft Defender XDR, published 2026-11-13, act by 2026-11-30, scope Worldwide, GCC, GCC High and DoD. The page showed no last-updated date. We could not open the Message Center entry itself because it needs admin sign-in.
• Opened the Microsoft Learn classic alerts page on 2026-11-15 and confirmed the two alert descriptions, severities (Medium and High), External IDs 2019 and 2017, and the PowerShell note. The page did not mention the retirement.
• Opened Microsoft's RemoteCodeExecution.md in the Microsoft-Defender-for-Identity repository on 2026-11-15 and confirmed the three activity types, the 7-day baseline, the 3-distinct-day suppression and the three MITRE techniques. We did not reproduce the query here.
• Opened the Learn custom detection rules page on 2026-11-15 and confirmed the required roles, the wizard fields, the frequency options, the 150-alert limit and the Continuous (NRT) conditions.
• The Defender for Identity "What's new" page showed no retirement notice for these alerts in our search.
• Not checked: we did not run the query or create a rule in a live tenant, and we found no official page that maps pass-the-hash to a specific Defender for Endpoint alert.

Last tested: 2026-11-15

Sources

• MC1552387 (Message Center mirror): https://mc.merill.net/message/MC1552387
• Microsoft Defender for Identity classic security alerts: https://learn.microsoft.com/en-us/defender-for-identity/alerts-mdi-classic
• Remote code execution custom detection query: https://github.com/microsoft/Microsoft-Defender-for-Identity/blob/main/AdvancedHunting/RemoteCodeExecution.md
• Create custom detection rules in Microsoft Defender XDR: https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules
• What's new in Microsoft Defender for Identity: https://learn.microsoft.com/en-us/defender-for-identity/whats-new

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.