Famous Security Software Built with
the Microsoft Stack

The machine learning models that stop 35% of threats before they reach an enterprise endpoint were produced with a C# framework. The identity platform behind Microsoft 365 and Azure ships two official C# libraries for the developers who integrate with it. The authentication system that replaced passwords on hundreds of millions of Windows devices exposes its developer API through a C# namespace. The SIEM platform running in enterprise security operations centers validates its community detection rules with a C# test suite.

Most developers file the language under enterprise line-of-business work. Discover six documented examples below, each traced to a primary source.

Microsoft Defender ATP processes trillions of signals every day and finds around 5 billion new threats every month. The volume spans phishing PDFs, documents carrying weaponized macros, and password-protected archives holding polymorphic executables. A human analyst can hold a few dozen malicious attributes in mind at once. A single malware sample may carry hundreds of thousands.

Microsoft Defender ATP uses ML.NET, a C# framework built on .NET, as one of several tools in its threat detection pipeline. Microsoft documents the arrangement on its own .NET platform site, noting that Defender ATP runs a derivative of ML.NET called TLC, an internal Microsoft machine learning framework in use for more than a decade.

DEFENDER ATP WITH ML.NET, BY THE NUMBERS

Source: Microsoft .NET platform, Microsoft Defender uses ML.NET to stop malware

Two published figures set the return. ML.NET’s supervised algorithms stop 35% of threats at the pre-breach level, covering malware arriving through malicious URLs, email attachments, and other emerging vectors. Measured against Defender ATP’s analysis of actual alerts, the machine learning techniques run at least 20% more precise than manually crafted heuristics.

HOW A SIGNAL BECOMES A VERDICT

The training scale is where the engineering gets interesting. On an average training cycle, a Defender ATP model may consume around 100 million rows of data with 190 thousand features each. Feature selection splits along two lines:

Models retrain daily on the latest data. Specialist models cover distinct territory: first-seen portable executable threats, macro threats, script-based attacks, and models trained purely on fuzzy hashes. Above those individual classifiers sits an ensemble layer that takes their signals and re-checks the activity a second time.

Model diversity is the design answer to a specific attack: an adversary who learns one classifier’s decision boundary can shape a payload to slip past it. Running many models trained on different feature sets raises the cost of that work. The output keeps half a billion people’s computers safe from malware.

Microsoft Entra ID, renamed from Azure Active Directory in July 2023, is the identity and access management platform behind Microsoft 365 tenants, Azure applications, and thousands of enterprise applications. The rename left the technology alone. Microsoft’s .NET Blog told developers that login URLs, APIs, PowerShell cmdlets, and Microsoft identity platform libraries including MSAL would carry on unchanged.

Microsoft publishes official C# libraries, Microsoft Identity Web and Azure Identity for .NET, for integrating applications with Entra ID.

THE TWO OFFICIAL C# PACKAGES

The detail worth carrying away is the reach of one credential type. Azure.Identity’s TokenCredential classes were built for the Azure SDK, and the Microsoft Graph .NET client library accepts the same instances. A single C# credential object authenticates against Azure resources and against Microsoft Graph, which is the surface most Microsoft security products expose their data through. Identity plumbing that teams often expect to rebuild per service resolves to one type constructed once at startup.

Primary sources: Azure Identity library for .NET  ·  What the Entra ID rename means for .NET developers  ·  Microsoft.Identity.Web on NuGet

Microsoft Sentinel is the cloud-native SIEM and SOAR platform security operations centers use to detect, investigate, and respond to threats across an enterprise estate. Its analytics engine runs on Kusto Query Language. The extension surface that security engineers build on carries the C#.

Security engineers extend Microsoft Sentinel using C#, the connector and automation layer published in the official Azure/Azure-Sentinel repository on GitHub. The repository holds detections, hunting queries, workbooks, playbooks, parsers, and data connectors contributed by Microsoft and by the security community, across roughly 57,000 commits.

LANGUAGE COMPOSITION, AZURE/AZURE-SENTINEL

That small percentage sits in a load-bearing spot. Before a community-contributed detection rule merges into the repository, it passes two automated checks written in C# and executed with dotnet test:

• Kqlvalidations.Tests parses the KQL in each submitted template and rejects any query referencing a table, tabular variable, or function that does not exist, returning the error code and the character offset.

• A second xUnit suite validates detection schema: frequency, period, trigger type, threshold, entity mappings, and connector IDs against an approved list.

Contributors run both locally against the .NET SDK before opening a pull request.

Primary source: github.com/Azure/Azure-Sentinel

Windows Hello moved sign-in on hundreds of millions of Windows devices away from passwords, to face recognition, fingerprint, and PIN. The biometric recognition engine itself runs at operating system level in native code. The layer application developers write against is C#.

Windows Hello’s developer authentication APIs are documented in C# in Microsoft’s official Windows developer documentation. The entry point is the KeyCredentialManager class in the Windows.Security.Credentials namespace, and Microsoft’s tutorial for building a Windows Hello login app is written in C# from the first call to the last.

THREE CALLS CARRY MOST OF THE FLOW

Underneath, KeyCredentialManager creates RSA 2048-bit key pairs. The private key stays on the device, held in the Trusted Platform Module. The application sends only the public key to its registration server, which links it to the user record.

One optional call is worth knowing about. A request for key attestation returns a signed statement, backed by a certificate chain, giving cryptographic proof that the key was generated inside the TPM rather than in software. For an application protecting high-value credentials, that attestation is the difference between trusting a key and verifying where it came from.

Primary sources: Tutorial: Create a Windows Hello login app  ·  KeyCredentialManager class reference

Microsoft Defender for Identity monitors identity signals from on-premises Active Directory, from Microsoft Entra ID, and from third-party identity providers such as Okta. It analyzes those signals with behavioral analytics and known attack patterns to surface lateral movement, privilege escalation, and compromised accounts across the identity attack lifecycle.

Its programmatic surface lives in Microsoft Graph. Microsoft documents the resources in its Graph security API overview, with parts of the surface currently on the beta endpoint.

WHAT THE GRAPH RESOURCES EXPOSE

Microsoft publishes an official .NET SDK for Microsoft Graph, distributed as the Microsoft.Graph NuGet package and maintained in the msgraph-sdk-dotnet repository. Security engineering teams working in C# reach Defender for Identity through GraphServiceClient, authenticated with the same Azure.Identity TokenCredential described in example 02.

Containment is the part that lands. Disabling a compromised account and forcing a password reset are Graph calls, which puts them inside a C# automation path. A detection raised by Defender for Identity can trigger a scoped containment action written in C#, without anyone opening the Defender portal at three in the morning.

Primary sources: Microsoft Graph security API overview  ·  Install a Microsoft Graph SDK  ·  Defender for Identity overview

Secret Server, the privileged access management platform built by Thycotic and now owned by Delinea, installs as an ASP.NET website on IIS with a SQL Server backend, per Delinea’s own installation documentation. The platform serves over 10,000 organizations, from small businesses to the Fortune 100. Softwarium built the mobile autofill credentials feature for it: a credential provider that populates login and password fields inside other mobile applications and in mobile browsers, releasing the credentials after a Face ID, Touch ID, or PIN check. Full detail in the Thycotic Secret Server mobile autofill case study.

THE SIX EXAMPLES AT A GLANCE

Across five product categories, C# occupies the same position: the developer-facing surface where engineering teams extend, integrate, and automate. Endpoint threat detection reaches further, with a C# framework inside the detection pipeline itself. Identity and access management, SIEM automation, biometric authentication, and privileged access management each hand the integration work to C#.

For teams weighing the Microsoft stack for a security product build, the proven ground runs wider than the market’s language about C# suggests. The same pattern shows up outside security, in the C# applications you did not know about post, and across the broader platform in real-world applications built with .NET and Azure.