| sentinel |
TI map IP entity to DnsEvents |
— |
— |
| sentinel |
TI map IP entity to OfficeActivity |
— |
— |
| sentinel |
TI map IP entity to VMConnection |
— |
— |
| sentinel |
New Agent Added to Pool by New User or Added to a New OS Type. |
— |
— |
| sentinel |
NRT Azure DevOps Audit Stream Disabled |
— |
— |
| sentinel |
External Upstream Source Added to Azure DevOps Feed |
— |
— |
| sentinel |
TI map Email entity to SecurityAlert |
— |
— |
| sentinel |
TI map Email entity to CommonSecurityLog |
— |
— |
| sentinel |
Mass secret retrieval from Azure Key Vault |
— |
— |
| sentinel |
Azure DevOps Service Connection Abuse |
— |
— |
| sentinel |
Azure DevOps Pipeline Created and Deleted on the Same Day |
— |
— |
| sentinel |
Azure DevOps Personal Access Token (PAT) misuse |
— |
— |
| sentinel |
Azure DevOps Service Connection Addition/Abuse - Historic allow list |
— |
— |
| sentinel |
COM Registry Key Modified to Point to File in Color Profile Folder |
Scheduled |
— |
| sentinel |
Aqua Blizzard Actor IOCs - Feb 2022 |
— |
— |
| sentinel |
Midnight Blizzard - Domain and IP IOCs - March 2021 |
— |
— |
| sentinel |
Midnight Blizzard IOCs related to FoggyWeb backdoor |
— |
— |
| sentinel |
Midnight Blizzard - Domain, Hash and IP IOCs - May 2021 |
— |
— |
| sentinel |
Multiple Password Reset by user |
Scheduled |
— |
| sentinel |
Network endpoint to host executable correlation |
— |
— |
| sentinel |
New UserAgent observed in last 24 hours |
— |
— |
| sentinel |
Known Nylon Typhoon domains and hashes |
— |
— |
| sentinel |
Anomalous login followed by Teams action |
Scheduled |
— |
| sentinel |
Linked Malicious Storage Artifacts |
— |
— |
| sentinel |
Privileged Accounts - Sign in Failure Spikes |
— |
— |
| sentinel |
Risky user signin observed in non-Microsoft network device |
Scheduled |
— |
| sentinel |
Known Ruby Sleet domains and hashes |
— |
— |
| sentinel |
Azure VM Run Command operation executed during suspicious login window |
Scheduled |
— |
| sentinel |
SUNSPOT malware hashes |
— |
— |
| sentinel |
SUNSPOT log file creation |
— |
— |
| sentinel |
Known Seashell Blizzard IP |
— |
— |
| sentinel |
Account created from non-approved sources |
Scheduled |
— |
| sentinel |
Login to AWS Management Console without MFA |
— |
— |
| sentinel |
Changes made to AWS CloudTrail logs |
— |
— |
| sentinel |
Changes to Amazon VPC settings |
— |
— |
| sentinel |
Failed AWS Console logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
Changes to internet facing AWS RDS Database instances |
— |
— |
| sentinel |
ADFS DKM Master Key Export |
Scheduled |
— |
| sentinel |
A potentially malicious web request was executed against a web server |
— |
— |
| sentinel |
A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) |
Scheduled |
— |