What is Defense in Depth?

NIST's glossary carries two definitions worth knowing. The one from SP 800-53 Rev. 5, the US federal control catalog, is about strategy: integrate people, technology and operations capabilities to establish variable barriers across multiple layers and missions of the organization. The one NIST quotes from ISA/IEC 62443, the industrial control systems standard, is about engineering: layer heterogeneous security technologies in the common attack vectors so that attacks missed by one technology are caught by another. By that second definition, two controls that fail for the same reason are one layer, however many product names they carry.

Microsoft Defender shows how that happens. Attack surface reduction (ASR) rules and the antivirus scanner look like two endpoint layers, but Microsoft's ASR documentation lists real-time protection in Microsoft Defender Antivirus as a requirement for the rules. An attacker with local admin rights who turns real-time protection off removes both at once. Tamper protection exists to refuse that change, and when it does, Defender writes event 5013 instead.

No standard fixes the number of layers

Microsoft's SC-900 training module lists seven: physical security, identity and access, perimeter, network, compute, application and data. Other models count five by merging some of them. Layered security is the same idea under another name.

For a SOC the useful way to count is by log source: if two layers write to the same log and fail together, count them once. Zero trust sits inside this picture as one way to build the identity and network layers, verifying each request instead of trusting the network it comes from.

One intrusion, layer by layer

What follows is a simulated example generated by SOCSimulator Research: hosts, accounts and times are invented, and the external addresses come from documentation ranges. It follows one attacker through a mid-sized company on 6 October 2026 (UTC) and gives, for each layer, the event that layer writes. Event IDs, log channels and meanings follow Microsoft Learn.

Office hardening, held

09:12:04, workstation WS-ACC-014: user m.reyes opens Invoice_4471.docm and the macro tries to start powershell.exe. The ASR rule Block all Office applications from creating child processes (GUID d4f940ab-401b-4efc-aadc-ad5f3c50688a) is in block mode, so it stops the launch and writes 1121 to Microsoft-Windows-Windows Defender/Operational. In audit mode the same rule would have logged 1122 and let PowerShell run.

Antivirus, held

09:14:37, same host: she opens the second attachment, an ISO with a loader DLL inside. Defender writes 1116 (malware detected, with threat name, path and detection origin) and then 1117 (action taken, here quarantine). Read them as a pair. A 1116 followed by 1118 or 1119 means the action failed and the file may still be on disk.

The user, bypassed

The email also carried a link to a fake sign-in page, and she typed her password into it. Nothing on the company network logs that step. The control here is training, and its failure leaves no event until the stolen password gets used.

Identity, missing

11:02 to 11:04, file server FS-OPS-02, whose RDP port was forwarded for a vendor and never closed. Two 4625 failures from 203.0.113.45 for the accounts admin and scanner, then a 4624 with Logon Type 10 (RemoteInteractive) for m.reyes from the same address. RDP on that server had no MFA, so the identity layer was one password.

Host firewall, held

11:12: from FS-OPS-02 the attacker tries SMB against workstation WS-ACC-022. Its firewall accepts port 445 only from the management subnet, so Windows Filtering Platform drops the connection and WS-ACC-022 writes 5157 (connection blocked, Direction Inbound, local port 445) to its Security log. That needs Audit Filtering Platform Connection enabled for failures; without it the block still happens and nobody sees it.

Endpoint protection, switched off

11:21: m.reyes is still in the server's local Administrators group from an old project, and tamper protection is off on servers. Set-MpPreference -DisableRealtimeMonitoring $true produces 5007 (configuration changed, with old and new values) and 5001 (real-time protection disabled). ATT&CK files this under T1685 Disable or Modify Tools, tactic Defense Impairment; the old ID T1562.001 now redirects there. Since ASR needs real-time protection, both endpoint layers on this server are gone.

Logging, tampered with

11:22: auditpol /set /subcategory:"Process Creation" /success:disable writes 4719 (system audit policy changed), which Windows logs regardless of the Audit Policy Change setting. 11:23: wevtutil cl Security empties the log and writes 1102. ATT&CK has these as T1685.001 Disable or Modify Windows Event Log and T1685.005 Clear Windows Event Logs (formerly T1562.002 and T1070.001). Neither command touches the Defender channel, so 5001 and 5007 are still on the server.

SIEM, held

The forwarder shipped the 4624, the 4688 process events for powershell.exe and auditpol.exe, and the 4719 before 11:23. Those 4688s carry full command lines only because the Include command line in process creation events policy was on; by default that field is empty. On the server the Security log now starts with 1102. In the SIEM, the hour before it is intact.

Reading by absence

From 11:30 the server writes a 5156 every few minutes:

Application \device\harddiskvolume2\programdata\sync\rc.exe, Direction Outbound, destination 198.51.100.77 port 443

There is no 4688 for rc.exe anywhere. A connection from a process that never started means process auditing is off on that host, or the EDR sensor that should have recorded the launch is not there. In this case the 4719 in the SIEM says which one, and since when.

Four layers held (three preventive, plus the SIEM), one was bypassed (the user), two were never there (MFA on the exposed RDP path, least privilege on the server) and the attacker switched two off (endpoint protection and process auditing on the server). Detection came from the SIEM copy of 4719 and 1102, the one layer the attacker could not reach from the server.