Microsoft 365 Defender Custom Detection Rules for Multi-Stage Attack Detection
A security analyst wants to create a custom detection rule that tracks a specific multi-stage attack pattern: a user receives a phishing email, clicks a link, and then a script is executed on their device. The analyst needs to write a Kusto Query Language (KQL) query to detect this pattern and schedule it to run automatically, generating alerts. Which Microsoft 365 Defender capability should they use?
Quick Answer
The answer is custom detection rules. This capability in Microsoft 365 Defender allows security analysts to write Kusto Query Language (KQL) queries that run on a defined schedule, automatically generating alerts and incidents when the query detects a specified pattern—such as the multi-stage attack chain of a phishing email, link click, and script execution. On the SC-900 exam, this tests your understanding of how advanced hunting data can be leveraged for proactive threat detection beyond out-of-the-box alerts. A common trap is confusing custom detection rules with automated investigation and response (AIR) or simple alert rules; remember that custom detection rules are specifically for scheduled KQL queries that hunt for multi-stage attack patterns. For a memory tip, think of it as "KQL on a clock"—you write the query, set the schedule, and Defender does the rest.
⚠ Common exam trap
It's easy for candidates to confuse Advanced hunting (a query tool) with Custom detection rules (a scheduled alerting engine), assuming that writing a KQL query in Advanced hunting alone is sufficient for automated detection, when in fact it requires the custom detection rule framework to run on a schedule and generate alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom detection rules
Custom detection rules in Microsoft 365 Defender allow security analysts to write KQL queries that run on a schedule and automatically generate alerts when the query returns results. This capability is specifically designed to detect multi-stage attack patterns, such as the phishing email → link click → script execution chain described, by querying advanced hunting data and triggering incident creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Advanced hunting
Why it's wrong here
Incorrect. Advanced hunting is used for interactive, ad-hoc queries on raw data. It does not natively support scheduling the query as a detection rule.
- ✓
Custom detection rules
Why this is correct
Correct. Custom detection rules allow you to create a KQL query from advanced hunting and schedule it to run automatically, generating alerts for matching events.
- ✗
Automation
Why it's wrong here
Incorrect. Automation in Microsoft 365 Defender automates responses to incidents (e.g., playbooks), but does not provide custom KQL-based detection scheduling.
- ✗
Threat analytics
Why it's wrong here
Incorrect. Threat analytics provides reports on active threats and vulnerabilities, not the ability to create custom scheduled queries.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?
hard- A.Anomaly analytics rule
- B.Near-real-time (NRT) analytics rule
- C.Microsoft security analytics rule
- ✓ D.Scheduled query analytics rule
Why D: A scheduled query analytics rule is the correct choice because it allows the SOC analyst to define a custom KQL query that counts failed logins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type runs on a recurring schedule (e.g., every 5 minutes) and is designed for threshold-based detection scenarios like brute-force attacks.
Variation 2. A cybersecurity analyst uses Microsoft Sentinel to detect threats. Which THREE types of analytics rules can be created?
medium- ✓ A.Scheduled query rules
- ✓ B.Near-real-time (NRT) rules
- C.Hunting rules
- ✓ D.Fusion rules
- E.Machine learning rules
Why A: Scheduled query rules are correct because they allow you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect threats by analyzing log data from multiple sources. This is a core analytics rule type in Microsoft Sentinel for proactive threat detection based on time-based patterns.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.