| sentinel |
Repeated failed MFA challenges for one user from one IP (AADSTS50074 / AADSTS500121) |
Scheduled |
— |
| sentinel |
PHP Worker Process Spawning Shell/Recon Tool |
Scheduled |
— |
| snort |
ET WEB_CLIENT WSO 2.6 Webshell Accessed on External Compromised Server |
rev 2 |
— |
| sentinel |
TI map IP entity to Azure SQL Security Audit Events |
— |
— |
| sentinel |
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) |
— |
— |
| sentinel |
TI map IP entity to Azure Key Vault logs |
— |
— |
| sentinel |
TI map IP entity to AzureFirewall |
— |
— |
| sentinel |
TI map IP entity to AzureActivity |
— |
— |
| sentinel |
TI map IP entity to AWSCloudTrail |
— |
— |
| sentinel |
TI map File Hash to Security Event |
— |
— |
| sentinel |
TI map File Hash to CommonSecurityLog Event |
— |
— |
| sentinel |
TI map Email entity to SigninLogs |
— |
— |
| sentinel |
TI map Email entity to SecurityEvent |
— |
— |
| sentinel |
TI map Email entity to SecurityAlert |
— |
— |
| sentinel |
TI map Email entity to CommonSecurityLog |
— |
— |
| sentinel |
TI map Domain entity to CommonSecurityLog |
— |
— |
| sentinel |
SSH - Potential Brute Force |
— |
— |
| sentinel |
Squid proxy events for ToR proxies |
— |
— |
| sentinel |
Squid proxy events related to mining pools |
— |
— |
| sentinel |
NRT Squid proxy events related to mining pools |
— |
— |
| sentinel |
Failed logon attempts in authpriv |
— |
— |
| sentinel |
User Accounts - Sign in Failure due to CA Spikes |
— |
— |
| sentinel |
Successful logon from IP and failure from a different IP |
— |
— |
| sentinel |
Brute force attack against Azure Portal |
— |
— |
| sentinel |
Sign-ins from IPs that attempt sign-ins to disabled accounts |
— |
— |
| sentinel |
GitHub Signin Burst from Multiple Locations |
— |
— |
| sentinel |
Service Principal Authentication Attempt from New Country |
Scheduled |
— |
| sentinel |
Password spray attack against Microsoft Entra ID Seamless SSO |
— |
— |
| sentinel |
Privileged User Logon from new ASN |
Scheduled |
— |
| sentinel |
Password spray attack against Microsoft Entra ID application |
— |
— |
| sentinel |
NRT MFA Rejected by User |
— |
— |
| sentinel |
MFA Rejected by User |
— |
— |
| sentinel |
Failed login attempts to Azure Portal |
— |
— |
| sentinel |
[Deprecated] Explicit MFA Deny |
— |
— |
| sentinel |
Distributed Password cracking attempts in AzureAD |
— |
— |
| sentinel |
Attempts to sign in to disabled accounts |
— |
— |
| sentinel |
Attempt to bypass conditional access rule in Microsoft Entra ID |
— |
— |
| sentinel |
TI map IP entity to W3CIISLog |
— |
— |
| sentinel |
Brute force attack against a Cloud PC |
— |
— |
| sentinel |
Brute Force Attack against GitHub Account |
— |
— |