| sentinel |
Possible Forest Blizzard attempted credential harvesting - Oct 2020 |
— |
— |
| sentinel |
Gain Code Execution on ADFS Server via Remote WMI Execution |
Scheduled |
— |
| sentinel |
Known Granite Typhoon domains and hashes |
— |
— |
| sentinel |
Hive Ransomware IOC - July 2022 |
— |
— |
| sentinel |
Failed host logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
Account created or deleted by non-approved user |
— |
— |
| sentinel |
Account Created and Deleted in Short Timeframe |
— |
— |
| sentinel |
Account Elevated to New Role |
— |
— |
| sentinel |
Addition of a Temporary Access Pass to a Privileged Account |
Scheduled |
— |
| sentinel |
Admin promotion after Role Management Application Permission Grant |
— |
— |
| sentinel |
Application ID URI Changed |
Scheduled |
— |
| sentinel |
Application Redirect URL Update |
Scheduled |
— |
| sentinel |
Authentication Method Changed for Privileged Account |
— |
— |
| sentinel |
Microsoft Entra ID Role Management Permission Grant |
— |
— |
| sentinel |
Bulk Changes to Privileged Account Permissions |
— |
— |
| sentinel |
Conditional Access Policy Modified by New User |
Scheduled |
— |
| sentinel |
Credential added after admin consented to Application |
— |
— |
| sentinel |
Cross-tenant Access Settings Organization Added |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Deleted |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Inbound Direct Settings Changed |
Scheduled |
— |
| sentinel |
Anomalous Single Factor Signin |
Scheduled |
— |
| sentinel |
Password spray attack against ADFSSignInLogs |
— |
— |
| sentinel |
Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Outbound Direct Settings Changed |
Scheduled |
— |
| sentinel |
NRT Base64 encoded Windows process command-lines |
— |
— |
| sentinel |
NRT Process executed from binary hidden in Base64 encoded file |
— |
— |
| sentinel |
New EXE deployed via Default Domain or Default Domain Controller Policies |
— |
— |
| sentinel |
Non Domain Controller Active Directory Replication |
— |
— |
| sentinel |
Vulnerable Machines related to OMIGOD CVE-2021-38647 |
Scheduled |
— |
| sentinel |
Vulnerable Machines related to log4j CVE-2021-44228 |
— |
— |
| sentinel |
Powershell Empire cmdlets seen in command line |
— |
— |
| sentinel |
AD user enabled and password not set within 48 hours |
— |
— |
| sentinel |
End-user consent stopped due to risk-based consent |
Scheduled |
— |
| sentinel |
Silk Typhoon Suspicious Exchange Request |
Scheduled |
— |
| sentinel |
Service Principal Name (SPN) Assigned to User Account |
Scheduled |
— |
| sentinel |
Exchange workflow MailItemsAccessed operation anomaly |
— |
— |
| sentinel |
First access credential added to Application or Service Principal where no credential was present |
— |
— |
| sentinel |
Possible Resource-Based Constrained Delegation Abuse |
Scheduled |
— |
| sentinel |
Guest accounts added in Entra ID Groups other than the ones specified |
Scheduled |
— |