| sentinel |
Possible Forest Blizzard attempted credential harvesting - Oct 2020 |
— |
— |
| sentinel |
NRT Multiple users email forwarded to same destination |
NRT |
— |
| sentinel |
Dev-0270 Malicious Powershell usage |
— |
— |
| sentinel |
DEV-0270 New User Creation |
— |
— |
| sentinel |
Dev-0228 File Path Hashes November 2021 |
Scheduled |
— |
| sentinel |
Denim Tsunami File Hashes July 2022 |
— |
— |
| sentinel |
Denim Tsunami C2 Domains July 2022 |
— |
— |
| sentinel |
Denim Tsunami AV Detection |
— |
— |
| sentinel |
DEV-0322 Serv-U related IOCs - July 2021 |
— |
— |
| sentinel |
Cross-Cloud Unauthorized Credential Access Detection From AWS RDS Login |
— |
— |
| sentinel |
Cross-Cloud Suspicious user activity observed in GCP Envourment |
— |
— |
| sentinel |
Cross-Cloud Suspicious Compute resource creation in GCP |
— |
— |
| sentinel |
Chia_Crypto_Mining - Domain, Process, Hash and IP IOCs - June 2021 |
— |
— |
| sentinel |
Caramel Tsunami Actor IOC - July 2021 |
— |
— |
| sentinel |
Cadet Blizzard Actor IOC - January 2022 |
— |
— |
| sentinel |
Known Forest Blizzard group domains - July 2019 |
Scheduled |
— |
| sentinel |
Cross-Cloud Password Spray detection |
— |
— |
| sentinel |
Known Barium IP |
— |
— |
| sentinel |
Known Barium domains |
— |
— |
| sentinel |
Windows host username encoded in base64 web request |
Scheduled |
— |
| sentinel |
IP address of Windows host encoded in web request |
Scheduled |
— |
| sentinel |
Authentication Methods Changed for Privileged Account |
— |
— |
| sentinel |
Audit policy manipulation using auditpol utility |
Scheduled |
— |
| sentinel |
Exchange Worker Process Making Remote Call |
Scheduled |
— |
| sentinel |
Failed AzureAD logons but success logon to AWS Console |
Scheduled |
— |
| sentinel |
Users searching for VIP user activity |
Scheduled |
— |
| sentinel |
OMI Vulnerability Exploitation |
Scheduled |
— |
| sentinel |
Missing Domain Controller Heartbeat |
Scheduled |
— |
| sentinel |
TI map IP entity to GitHub_CL |
— |
— |
| sentinel |
GitHub Security Vulnerability in Repository |
Scheduled |
— |
| sentinel |
NRT GitHub Two Factor Auth Disable |
NRT |
— |
| sentinel |
GitHub Two Factor Auth Disable |
— |
— |
| sentinel |
GitHub Activites from a New Country |
— |
— |
| sentinel |
Trust Monitor Event |
Scheduled |
— |
| sentinel |
TI map IP entity to Duo Security |
— |
— |
| sentinel |
NRT DNS events related to mining pools |
— |
— |
| sentinel |
DNS events related to ToR proxies |
— |
— |
| sentinel |
DNS events related to mining pools |
— |
— |
| sentinel |
Rare client observed with high reverse DNS lookup count |
— |
— |
| sentinel |
Potential DGA detected |
— |
— |