| sentinel |
PE file dropped in Color Profile Folder |
Scheduled |
— |
| sentinel |
TEARDROP memory-only dropper - Migrated to new location |
— |
— |
| sentinel |
Wazuh - Large Number of Web errors from an IP |
Scheduled |
— |
| sentinel |
Time series anomaly detection for total volume of traffic |
Scheduled |
— |
| sentinel |
Palo Alto Threat signatures from Unusual IP addresses |
— |
— |
| sentinel |
Palo Alto - possible internal to external port scanning |
— |
— |
| sentinel |
Palo Alto - potential beaconing detected |
— |
— |
| sentinel |
Possible contact with a domain generated by a DGA |
Scheduled |
— |
| sentinel |
DEV-0270 New User Creation |
— |
— |
| sentinel |
Fortinet - Beacon pattern detected |
Scheduled |
— |
| sentinel |
RunningRAT request parameters |
Scheduled |
— |
| sentinel |
CreepyDrive URLs |
Scheduled |
— |
| sentinel |
CreepyDrive request URL sequence |
Scheduled |
— |
| sentinel |
Cisco ASA - threat detection message fired |
— |
— |
| sentinel |
Cisco ASA - average attack detection rate increase |
— |
— |
| sentinel |
Cisco Umbrella - URI contains IP address |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Request to blocklisted file type |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Request Allowed to harmful/malicious URI category |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Rare User Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Windows PowerShell User-Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Hack Tool User-Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Empty User Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Crypto Miner User-Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Connection to Unpopular Website Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Connection to non-corporate private network |
Scheduled |
— |
| sentinel |
Suspicious Sign In by Entra ID Connect Sync Account |
Scheduled |
— |
| sentinel |
Application Gateway WAF - XSS Detection |
Scheduled |
— |
| sentinel |
Application Gateway WAF - SQLi Detection |
Scheduled |
— |
| sentinel |
Front Door Premium WAF - XSS Detection |
— |
— |
| sentinel |
Front Door Premium WAF - SQLi Detection |
— |
— |
| sentinel |
Several deny actions registered |
— |
— |
| sentinel |
TimeSeriesKeyvaultAccessAnomaly.yaml |
— |
— |
| sentinel |
NRT_KeyVaultSensitiveOperations.yaml |
— |
— |
| sentinel |
A potentially malicious web request was executed against a web server |
— |
— |
| sentinel |
Mass secret retrieval from Azure Key Vault |
— |
— |
| sentinel |
Sensitive Azure Key Vault operations |
— |
— |
| sentinel |
Azure WAF matching for Log4j vuln(CVE-2021-44228) |
— |
— |
| sentinel |
New PA, PCA, or PCAS added to Azure DevOps |
— |
— |
| sentinel |
New Agent Added to Pool by New User or Added to a New OS Type. |
— |
— |
| sentinel |
NRT Azure DevOps Audit Stream Disabled |
— |
— |