| sentinel |
New user created and added to the built-in administrators group |
Scheduled |
— |
| sentinel |
User account enabled and disabled within 10 mins |
Scheduled |
— |
| sentinel |
User account created and deleted within 10 mins |
Scheduled |
— |
| sentinel |
High Number of Urgent Vulnerabilities Detected |
— |
— |
| sentinel |
PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack |
Scheduled |
— |
| sentinel |
ProofpointPOD - Weak ciphers |
— |
— |
| sentinel |
ProofpointPOD - Suspicious attachment |
— |
— |
| sentinel |
ProofpointPOD - Multiple protected emails to unknown recipient |
— |
— |
| sentinel |
Palo Alto - possible internal to external port scanning |
— |
— |
| sentinel |
Palo Alto - potential beaconing detected |
— |
— |
| sentinel |
Possible contact with a domain generated by a DGA |
Scheduled |
— |
| sentinel |
Fortinet - Beacon pattern detected |
Scheduled |
— |
| sentinel |
RunningRAT request parameters |
Scheduled |
— |
| sentinel |
ProofpointPOD - Multiple large emails to the same recipient |
— |
— |
| sentinel |
User account added to built in domain local or global group |
Scheduled |
— |
| sentinel |
Account added and removed from privileged groups |
Scheduled |
— |
| sentinel |
Process execution frequency anomaly |
— |
— |
| sentinel |
Starting or Stopping HealthService to Avoid Detection |
— |
— |
| sentinel |
Successful logon from IP and failure from a different IP |
— |
— |
| sentinel |
Password spray attack against Microsoft Entra ID application |
— |
— |
| sentinel |
Brute force attack against Azure Portal |
— |
— |
| sentinel |
CreepyDrive URLs |
Scheduled |
— |
| sentinel |
CreepyDrive request URL sequence |
Scheduled |
— |
| sentinel |
Cisco ASA - threat detection message fired |
— |
— |
| sentinel |
Cisco ASA - average attack detection rate increase |
— |
— |
| sentinel |
Cisco Umbrella - URI contains IP address |
Scheduled |
— |
| sentinel |
Sign-ins from IPs that attempt sign-ins to disabled accounts |
— |
— |
| sentinel |
NRT Security Event log cleared |
— |
— |
| sentinel |
SecurityEvent - Multiple authentication failures followed by a success |
— |
— |
| sentinel |
Midnight Blizzard - Script payload stored in Registry |
Scheduled |
— |
| sentinel |
Midnight Blizzard - suspicious rundll32.exe execution of vbscript |
Scheduled |
— |
| sentinel |
Detecting Macro Invoking ShellBrowserWindow COM Objects |
— |
— |
| sentinel |
Mercury - Domain, Hash and IP IOCs - August 2022 |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Request to blocklisted file type |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Request Allowed to harmful/malicious URI category |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Rare User Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Windows PowerShell User-Agent Detected |
Scheduled |
— |
| sentinel |
Known Manganese IP and UserAgent activity |
— |
— |
| sentinel |
Malformed user agent |
Scheduled |
— |
| sentinel |
Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt |
Scheduled |
— |