| sentinel |
DNS events related to ToR proxies (ASIM DNS Schema) |
Scheduled |
— |
| sentinel |
Probable AdFind Recon Tool Usage (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Credential Dumping Tools - File Artifacts |
— |
— |
| sentinel |
Credential Dumping Tools - Service Installation |
— |
— |
| sentinel |
COM Event System Loading New DLL |
Scheduled |
— |
| sentinel |
AdminSDHolder Modifications |
Scheduled |
— |
| sentinel |
Modification of Accessibility Features |
Scheduled |
— |
| sentinel |
AD FS Remote HTTP Network Connection |
— |
— |
| sentinel |
CoreBackUp Deletion in correlation with other related security alerts |
— |
— |
| sentinel |
Correlate Unfamiliar sign-in properties and atypical travel alerts |
— |
— |
| sentinel |
Detect PIM Alert Disabling activity |
Scheduled |
— |
| sentinel |
AV detections related to Dev-0530 actors |
Scheduled |
— |
| sentinel |
AV detections related to Europium actors |
Scheduled |
— |
| sentinel |
AV detections related to Hive Ransomware |
Scheduled |
— |
| sentinel |
Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory |
Scheduled |
— |
| sentinel |
AD FS Remote Auth Sync Connection |
— |
— |
| sentinel |
External user added and removed in short timeframe |
— |
— |
| sentinel |
Possible Forest Blizzard attempted credential harvesting - Sept 2020 |
— |
— |
| sentinel |
Failed AzureAD logons but success logon to host |
Scheduled |
— |
| sentinel |
NRT Malicious Inbox Rule |
NRT |
— |
| sentinel |
Exchange workflow MailItemsAccessed operation anomaly |
— |
— |
| sentinel |
Multiple Teams deleted by a single user |
— |
— |
| sentinel |
Changes to Application Logout URL |
Scheduled |
— |
| sentinel |
Mail redirect via ExO transport rule |
— |
— |
| sentinel |
Changes to Application Ownership |
Scheduled |
— |
| sentinel |
Malicious Inbox Rule |
— |
— |
| sentinel |
Multiple users email forwarded to same destination |
— |
— |
| sentinel |
Cross-tenant Access Settings Organization Inbound Direct Settings Changed |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Outbound Direct Settings Changed |
Scheduled |
— |
| sentinel |
GitHub Activites from a New Country |
— |
— |
| sentinel |
End-user consent stopped due to risk-based consent |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Deleted |
Scheduled |
— |
| sentinel |
First access credential added to Application or Service Principal where no credential was present |
— |
— |
| sentinel |
Cross-tenant Access Settings Organization Added |
Scheduled |
— |
| sentinel |
Credential added after admin consented to Application |
— |
— |
| sentinel |
Trust Monitor Event |
Scheduled |
— |
| sentinel |
Guest accounts added in Entra ID Groups other than the ones specified |
Scheduled |
— |
| sentinel |
Conditional Access Policy Modified by New User |
Scheduled |
— |