Custom detection rules

Defender for Identity RCE and pass-the-hash alerts retire: migrate

Microsoft Defender for Identity retires two classic alerts, Remote code execution attempt and pass-the-hash, by late November 2026. See what to check and how to replace them.