| sentinel |
Email access via active sync |
Scheduled |
— |
| sentinel |
Europium - Hash and IP IOCs - September 2022 |
Scheduled |
— |
| sentinel |
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account |
Scheduled |
— |
| sentinel |
AD account with Don't Expire Password |
Scheduled |
— |
| sentinel |
DSRM Account Abuse |
Scheduled |
— |
| sentinel |
Known Diamond Sleet related maldoc hash |
— |
— |
| sentinel |
Known Diamond Sleet Comebacker and Klackring malware hashes |
— |
— |
| sentinel |
Dev-0530 IOC - July 2022 |
— |
— |
| sentinel |
Dev-0530 File Extension Rename |
Scheduled |
— |
| sentinel |
Dev-0270 WMIC Discovery |
— |
— |
| sentinel |
Dev-0270 Registry IOC - September 2022 |
— |
— |
| sentinel |
Hive Ransomware IOC - July 2022 |
— |
— |
| sentinel |
Silk Typhoon Suspicious File Downloads. |
Scheduled |
— |
| sentinel |
Exchange Server Suspicious File Downloads. |
Scheduled |
— |
| sentinel |
Suspicious link sharing pattern |
Scheduled |
— |
| sentinel |
User joining Zoom meeting from suspicious timezone |
Scheduled |
— |
| sentinel |
External User Access Enabled |
Scheduled |
— |
| sentinel |
Zoom E2E Encryption Disabled |
Scheduled |
— |
| sentinel |
Chia_Crypto_Mining - Domain, Process, Hash and IP IOCs - June 2021 |
— |
— |
| sentinel |
Caramel Tsunami Actor IOC - July 2021 |
— |
— |
| sentinel |
SUPERNOVA webshell |
Scheduled |
— |
| sentinel |
Exchange SSRF Autodiscover ProxyShell - Detection |
Scheduled |
— |
| sentinel |
Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts |
Scheduled |
— |
| sentinel |
High count of connections by client IP on many ports |
Scheduled |
— |
| sentinel |
High count of failed logons by a user |
Scheduled |
— |
| sentinel |
High count of failed attempts from same client IP |
Scheduled |
— |
| sentinel |
Anomalous User Agent connection attempt |
Scheduled |
— |
| sentinel |
TI map URL entity to Syslog data |
— |
— |
| sentinel |
TI map URL entity to SecurityAlert data |
— |
— |
| sentinel |
TI map URL entity to PaloAlto data |
— |
— |
| sentinel |
TI map URL entity to OfficeActivity data |
— |
— |
| sentinel |
TI map URL entity to AuditLogs |
— |
— |
| sentinel |
TI map IP entity to SigninLogs |
— |
— |
| sentinel |
(Preview) TI map IP entity to Web Session Events (ASIM Web Session schema) |
— |
— |
| sentinel |
TI map IP entity to VMConnection |
— |
— |
| sentinel |
TI map IP entity to OfficeActivity |
— |
— |
| sentinel |
TI map IP entity to DnsEvents |
— |
— |
| sentinel |
TI map IP entity to CommonSecurityLog |
— |
— |
| sentinel |
TI map IP entity to Azure SQL Security Audit Events |
— |
— |
| sentinel |
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) |
— |
— |