| sentinel |
Prestige ransomware IOCs Oct 2022 |
Scheduled |
— |
| sentinel |
Identify SysAid Server web shell creation |
Scheduled |
— |
| sentinel |
Potential Fodhelper UAC Bypass (ASIM Version) |
Scheduled |
— |
| sentinel |
ProofpointPOD - Multiple protected emails to unknown recipient |
— |
— |
| sentinel |
Potential Build Process Compromise - MDE |
— |
— |
| sentinel |
ProofpointPOD - Suspicious attachment |
— |
— |
| sentinel |
ProofpointPOD - Weak ciphers |
— |
— |
| sentinel |
Known Plaid Rain IP |
— |
— |
| sentinel |
PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack |
Scheduled |
— |
| sentinel |
High Number of Urgent Vulnerabilities Detected |
— |
— |
| sentinel |
Phishing link click observed in Network Traffic |
Scheduled |
— |
| sentinel |
Known Phosphorus group domains/IP |
— |
— |
| sentinel |
[Deprecated] Explicit MFA Deny |
— |
— |
| sentinel |
Dumping LSASS Process Into a File |
— |
— |
| sentinel |
Excessive Windows logon failures |
— |
— |
| sentinel |
Exchange OAB Virtual Directory Attribute Containing Potential Webshell |
— |
— |
| sentinel |
Fake computer account created |
Scheduled |
— |
| sentinel |
Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task |
— |
— |
| sentinel |
Group created then added to built in domain local or global group |
Scheduled |
— |
| sentinel |
TI map IP entity to VMConnection |
— |
— |
| sentinel |
Exchange Server Vulnerabilities Disclosed March 2021 IoC Match |
— |
— |
| sentinel |
TI map IP entity to OfficeActivity |
— |
— |
| sentinel |
Unusual identity creation using exchange powershell |
Scheduled |
— |
| sentinel |
Emerald Sleet domains included in DCU takedown |
— |
— |
| sentinel |
Email access via active sync |
Scheduled |
— |
| sentinel |
Europium - Hash and IP IOCs - September 2022 |
Scheduled |
— |
| sentinel |
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account |
Scheduled |
— |
| sentinel |
TI map IP entity to DnsEvents |
— |
— |
| sentinel |
AD account with Don't Expire Password |
Scheduled |
— |
| sentinel |
TI map IP entity to CommonSecurityLog |
— |
— |
| sentinel |
TI map IP entity to Azure SQL Security Audit Events |
— |
— |
| sentinel |
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) |
— |
— |
| sentinel |
TI map IP entity to Azure Key Vault logs |
— |
— |
| sentinel |
DSRM Account Abuse |
Scheduled |
— |
| sentinel |
Lateral Movement via DCOM |
— |
— |
| sentinel |
Entra ID Local Device Join Information and Transport Key Registry Keys Access |
— |
— |
| sentinel |
Detecting Macro Invoking ShellBrowserWindow COM Objects |
— |
— |
| sentinel |
Midnight Blizzard - suspicious rundll32.exe execution of vbscript |
Scheduled |
— |
| sentinel |
Successful AWS Console Login from IP Address Observed Conducting Password Spray |
— |
— |
| sentinel |
M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity |
Scheduled |
— |