| sentinel |
Detecting Macro Invoking ShellBrowserWindow COM Objects |
— |
— |
| sentinel |
Entra ID Local Device Join Information and Transport Key Registry Keys Access |
— |
— |
| sentinel |
Lateral Movement via DCOM |
— |
— |
| sentinel |
Azure DevOps Pull Request Policy Bypassing - Historic allow list |
— |
— |
| sentinel |
Several deny actions registered |
— |
— |
| sentinel |
Front Door Premium WAF - SQLi Detection |
— |
— |
| sentinel |
Front Door Premium WAF - XSS Detection |
— |
— |
| sentinel |
Application Gateway WAF - SQLi Detection |
Scheduled |
— |
| sentinel |
Application Gateway WAF - XSS Detection |
Scheduled |
— |
| sentinel |
Suspicious Sign In by Entra ID Connect Sync Account |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Connection to non-corporate private network |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Connection to Unpopular Website Detected |
Scheduled |
— |
| sentinel |
Multiple RDP connections from Single System |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Crypto Miner User-Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Empty User Agent Detected |
Scheduled |
— |
| sentinel |
RDP Nesting |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Hack Tool User-Agent Detected |
Scheduled |
— |
| sentinel |
Palo Alto Threat signatures from Unusual IP addresses |
— |
— |
| sentinel |
Rare RDP Connections |
Scheduled |
— |
| sentinel |
Registry Persistence via AppCert DLL Modification |
— |
— |
| sentinel |
Time series anomaly detection for total volume of traffic |
Scheduled |
— |
| sentinel |
Wazuh - Large Number of Web errors from an IP |
Scheduled |
— |
| sentinel |
TEARDROP memory-only dropper - Migrated to new location |
— |
— |
| sentinel |
PE file dropped in Color Profile Folder |
Scheduled |
— |
| sentinel |
SUNBURST and SUPERNOVA backdoor hashes |
— |
— |
| sentinel |
SUNBURST network beacons |
— |
— |
| sentinel |
Probable AdFind Recon Tool Usage |
— |
— |
| sentinel |
SUNBURST suspicious SolarWinds child processes |
Scheduled |
— |
| sentinel |
Potential DGA detected |
— |
— |
| sentinel |
Rare client observed with high reverse DNS lookup count |
— |
— |
| sentinel |
DNS events related to mining pools |
— |
— |
| sentinel |
DNS events related to ToR proxies |
— |
— |
| sentinel |
NRT DNS events related to mining pools |
— |
— |
| sentinel |
Group created then added to built in domain local or global group |
Scheduled |
— |
| sentinel |
Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task |
— |
— |
| sentinel |
Fake computer account created |
Scheduled |
— |
| sentinel |
Exchange OAB Virtual Directory Attribute Containing Potential Webshell |
— |
— |
| sentinel |
Excessive Windows logon failures |
— |
— |
| sentinel |
Dumping LSASS Process Into a File |
— |
— |
| sentinel |
TI map IP entity to Duo Security |
— |
— |