| sentinel |
Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Deleted |
Scheduled |
— |
| sentinel |
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account |
Scheduled |
— |
| sentinel |
Europium - Hash and IP IOCs - September 2022 |
Scheduled |
— |
| sentinel |
Email access via active sync |
Scheduled |
— |
| sentinel |
Emerald Sleet domains included in DCU takedown |
— |
— |
| sentinel |
Unusual identity creation using exchange powershell |
Scheduled |
— |
| sentinel |
Exchange Server Vulnerabilities Disclosed March 2021 IoC Match |
— |
— |
| sentinel |
Cross-tenant Access Settings Organization Added |
Scheduled |
— |
| sentinel |
Credential added after admin consented to Application |
— |
— |
| sentinel |
Conditional Access Policy Modified by New User |
Scheduled |
— |
| sentinel |
Bulk Changes to Privileged Account Permissions |
— |
— |
| sentinel |
Microsoft Entra ID Role Management Permission Grant |
— |
— |
| sentinel |
Authentication Method Changed for Privileged Account |
— |
— |
| sentinel |
Application Redirect URL Update |
Scheduled |
— |
| sentinel |
Application ID URI Changed |
Scheduled |
— |
| sentinel |
Admin promotion after Role Management Application Permission Grant |
— |
— |
| sentinel |
Addition of a Temporary Access Pass to a Privileged Account |
Scheduled |
— |
| sentinel |
Account Elevated to New Role |
— |
— |
| sentinel |
Account Created and Deleted in Short Timeframe |
— |
— |
| sentinel |
Account created or deleted by non-approved user |
— |
— |
| sentinel |
Possible Forest Blizzard attempted credential harvesting - Oct 2020 |
— |
— |
| sentinel |
Gain Code Execution on ADFS Server via Remote WMI Execution |
Scheduled |
— |
| sentinel |
Known Granite Typhoon domains and hashes |
— |
— |
| sentinel |
Hive Ransomware IOC - July 2022 |
— |
— |
| sentinel |
Failed host logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
Known Mint Sandstorm group domains/IP - October 2020 |
— |
— |
| sentinel |
Unusual Anomaly |
Scheduled |
— |
| sentinel |
Anomaly Sign In Event from an IP |
Scheduled |
— |
| sentinel |
AWS Guard Duty Alert |
— |
— |
| sentinel |
Azure VM Run Command operations executing a unique PowerShell script |
Scheduled |
— |
| sentinel |
Suspicious access of BEC related documents in AWS S3 buckets |
— |
— |
| sentinel |
NRT Login to AWS Management Console without MFA |
— |
— |
| sentinel |
Changes to AWS Elastic Load Balancer security groups |
— |
— |
| sentinel |
Changes to AWS Security Group ingress and egress settings |
— |
— |
| sentinel |
Full Admin policy created and then attached to Roles, Users or Groups |
— |
— |
| sentinel |
Monitor AWS Credential abuse or hijacking |
— |
— |
| sentinel |
Login to AWS Management Console without MFA |
— |
— |
| sentinel |
Changes made to AWS CloudTrail logs |
— |
— |
| sentinel |
Changes to Amazon VPC settings |
— |
— |