| sentinel |
AV detections related to Tarrask malware |
— |
— |
| sentinel |
AV detections related to SpringShell Vulnerability |
— |
— |
| sentinel |
New High Severity Vulnerability Detected Across Multiple Hosts |
— |
— |
| sentinel |
High Number of Urgent Vulnerabilities Detected |
— |
— |
| sentinel |
New High Severity Vulnerability Detected Across Multiple Hosts |
— |
— |
| sentinel |
ProofpointPOD - Multiple archived attachments to the same recipient |
— |
— |
| sentinel |
ProofpointPOD - High risk message not discarded |
— |
— |
| sentinel |
Brute force attack against Azure Portal |
— |
— |
| sentinel |
ProofpointPOD - Email sender in TI list |
Scheduled |
— |
| sentinel |
ProofpointPOD - Email sender IP in TI list |
Scheduled |
— |
| sentinel |
ProofpointPOD - Possible data exfiltration to private email |
— |
— |
| sentinel |
ProofpointPOD - Binary file in attachment |
— |
— |
| sentinel |
Dev-0228 File Path Hashes November 2021 (ASIM Version) |
Scheduled |
— |
| sentinel |
Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) |
Scheduled |
— |
| sentinel |
SUNBURST suspicious SolarWinds child processes (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Base64 encoded Windows process command-lines (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Malware in the recycle bin (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Discord CDN Risky File Download (ASIM Web Session Schema) |
Scheduled |
— |
| sentinel |
Excessive number of HTTP authentication failures from a source (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
Potential communication with a Domain Generation Algorithm (DGA) based hostname (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
A host is potentially running a crypto miner (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
Changes to internet facing AWS RDS Database instances |
— |
— |
| sentinel |
Changes to Amazon VPC settings |
— |
— |
| sentinel |
Office policy tampering |
— |
— |
| sentinel |
Exchange AuditLog disabled |
— |
— |
| sentinel |
SharePointFileOperation via devices with previously unseen user agents |
— |
— |
| sentinel |
SharePointFileOperation via previously unseen IPs |
— |
— |
| sentinel |
Rare and potentially high-risk Office operations |
— |
— |
| sentinel |
New executable via Office FileUploaded Operation |
— |
— |
| sentinel |
Multiple users email forwarded to same destination |
— |
— |
| sentinel |
Changes made to AWS CloudTrail logs |
— |
— |
| sentinel |
Login to AWS Management Console without MFA |
— |
— |
| sentinel |
Suspicious Service Principal creation activity |
— |
— |
| sentinel |
URL Added to Application from Unknown Domain |
Scheduled |
— |
| sentinel |
NRT Malicious Inbox Rule |
NRT |
— |
| sentinel |
Multiple Teams deleted by a single user |
— |
— |
| sentinel |
Malicious Inbox Rule |
— |
— |
| sentinel |
Mail redirect via ExO transport rule |
— |
— |