| sentinel |
Potential beaconing activity (ASIM Network Session schema) |
— |
— |
| sentinel |
New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) |
Scheduled |
— |
| sentinel |
Potential re-named sdelete usage (ASIM Version) |
Scheduled |
— |
| sentinel |
Sdelete deployed via GPO and run recursively (ASIM Version) |
Scheduled |
— |
| sentinel |
Dev-0228 File Path Hashes November 2021 (ASIM Version) |
Scheduled |
— |
| sentinel |
Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) |
Scheduled |
— |
| sentinel |
SUNBURST suspicious SolarWinds child processes (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Base64 encoded Windows process command-lines (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Malware in the recycle bin (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Azure DevOps Service Connection Addition/Abuse - Historic allow list |
— |
— |
| sentinel |
Sensitive Azure Key Vault operations |
— |
— |
| sentinel |
Azure DevOps Pipeline Created and Deleted on the Same Day |
— |
— |
| sentinel |
A potentially malicious web request was executed against a web server |
— |
— |
| sentinel |
Azure WAF matching for Log4j vuln(CVE-2021-44228) |
— |
— |
| sentinel |
New Agent Added to Pool by New User or Added to a New OS Type. |
— |
— |
| sentinel |
NRT_KeyVaultSensitiveOperations.yaml |
— |
— |
| sentinel |
New PA, PCA, or PCAS added to Azure DevOps |
— |
— |
| sentinel |
TimeSeriesKeyvaultAccessAnomaly.yaml |
— |
— |
| sentinel |
Azure DevOps Personal Access Token (PAT) misuse |
— |
— |
| sentinel |
External Upstream Source Added to Azure DevOps Feed |
— |
— |
| sentinel |
Azure DevOps Service Connection Abuse |
— |
— |
| sentinel |
NRT Azure DevOps Audit Stream Disabled |
— |
— |
| sentinel |
Mass secret retrieval from Azure Key Vault |
— |
— |
| sentinel |
DNS events related to mining pools |
— |
— |
| sentinel |
Rare client observed with high reverse DNS lookup count |
— |
— |
| sentinel |
Potential DGA detected |
— |
— |
| sentinel |
SUNBURST suspicious SolarWinds child processes |
Scheduled |
— |
| sentinel |
Probable AdFind Recon Tool Usage |
— |
— |
| sentinel |
SUNBURST network beacons |
— |
— |
| sentinel |
SUNBURST and SUPERNOVA backdoor hashes |
— |
— |
| sentinel |
PE file dropped in Color Profile Folder |
Scheduled |
— |
| sentinel |
TEARDROP memory-only dropper - Migrated to new location |
— |
— |
| sentinel |
Wazuh - Large Number of Web errors from an IP |
Scheduled |
— |
| sentinel |
Time series anomaly detection for total volume of traffic |
Scheduled |
— |
| sentinel |
Palo Alto Threat signatures from Unusual IP addresses |
— |
— |
| sentinel |
Palo Alto - possible internal to external port scanning |
— |
— |
| sentinel |
Palo Alto - potential beaconing detected |
— |
— |
| sentinel |
Possible contact with a domain generated by a DGA |
Scheduled |
— |
| sentinel |
Fortinet - Beacon pattern detected |
Scheduled |
— |
| sentinel |
RunningRAT request parameters |
Scheduled |
— |