| sentinel |
(Preview) TI map Domain entity to Dns Events (ASIM DNS Schema) |
— |
— |
| sentinel |
Brute force attack against user credentials (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
Tarrask malware IOC - April 2022 |
— |
— |
| sentinel |
Time series anomaly for data size transferred to public internet |
Scheduled |
— |
| sentinel |
Unauthorized user access across AWS and Azure |
— |
— |
| sentinel |
External guest invitation followed by Microsoft Entra ID PowerShell signin |
— |
— |
| sentinel |
User agent search for log4j exploitation attempt |
— |
— |
| sentinel |
User impersonation by Identity Protection alerts |
— |
— |
| sentinel |
High-Risk Cross-Cloud User Impersonation |
— |
— |
| sentinel |
Alert for IOCs related to Windows/ELF malware - IP, Hash IOCs - September 2021 |
— |
— |
| sentinel |
AV detections related to Zinc actors |
— |
— |
| sentinel |
Zinc Actor IOCs files - October 2022 |
— |
— |
| sentinel |
Zinc Actor IOCs domains hashes IPs and useragent - October 2022 |
— |
— |
| sentinel |
Identify Mango Sandstorm powershell commands |
Scheduled |
— |
| sentinel |
Malicious BEC Inbox Rule |
— |
— |
| sentinel |
Accessed files shared by temporary external user |
— |
— |
| sentinel |
ProofpointPOD - Multiple large emails to the same recipient |
— |
— |
| sentinel |
ProofpointPOD - Multiple protected emails to unknown recipient |
— |
— |
| sentinel |
ProofpointPOD - Suspicious attachment |
— |
— |
| sentinel |
ProofpointPOD - Weak ciphers |
— |
— |
| sentinel |
PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack |
Scheduled |
— |
| sentinel |
High Number of Urgent Vulnerabilities Detected |
— |
— |
| sentinel |
Mass Download & copy to USB device by single user |
Scheduled |
— |
| sentinel |
Solorigate Defender Detections |
Scheduled |
— |
| sentinel |
Workspace deletion activity from an infected device |
Scheduled |
— |
| sentinel |
Microsoft Entra ID Health Monitoring Agent Registry Keys Access |
Scheduled |
— |
| sentinel |
Microsoft Entra ID Health Service Agents Registry Keys Access |
Scheduled |
— |
| sentinel |
AD FS Abnormal EKU object identifier attribute |
Scheduled |
— |
| sentinel |
ADFS Database Named Pipe Connection |
— |
— |
| sentinel |
Dumping LSASS Process Into a File |
— |
— |
| sentinel |
Excessive Windows logon failures |
— |
— |
| sentinel |
Exchange OAB Virtual Directory Attribute Containing Potential Webshell |
— |
— |
| sentinel |
Fake computer account created |
Scheduled |
— |
| sentinel |
Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task |
— |
— |
| sentinel |
Group created then added to built in domain local or global group |
Scheduled |
— |
| sentinel |
Lateral Movement via DCOM |
— |
— |
| sentinel |
Entra ID Local Device Join Information and Transport Key Registry Keys Access |
— |
— |
| sentinel |
Detecting Macro Invoking ShellBrowserWindow COM Objects |
— |
— |
| sentinel |
Midnight Blizzard - suspicious rundll32.exe execution of vbscript |
Scheduled |
— |
| sentinel |
Midnight Blizzard - Script payload stored in Registry |
Scheduled |
— |