| sentinel |
Anomalous sign-in location by user account and authenticating application |
— |
— |
| sentinel |
Aqua Blizzard Actor IOCs - Feb 2022 |
— |
— |
| sentinel |
Failed AzureAD logons but success logon to host |
Scheduled |
— |
| sentinel |
COM Registry Key Modified to Point to File in Color Profile Folder |
Scheduled |
— |
| sentinel |
DSRM Account Abuse |
Scheduled |
— |
| sentinel |
Known Diamond Sleet related maldoc hash |
— |
— |
| sentinel |
Known Diamond Sleet Comebacker and Klackring malware hashes |
— |
— |
| sentinel |
Dev-0530 IOC - July 2022 |
— |
— |
| sentinel |
Dev-0530 File Extension Rename |
Scheduled |
— |
| sentinel |
Dev-0270 WMIC Discovery |
— |
— |
| sentinel |
Dev-0270 Registry IOC - September 2022 |
— |
— |
| sentinel |
NRT Multiple users email forwarded to same destination |
NRT |
— |
| sentinel |
Exchange Worker Process Making Remote Call |
Scheduled |
— |
| sentinel |
Audit policy manipulation using auditpol utility |
Scheduled |
— |
| sentinel |
Authentication Methods Changed for Privileged Account |
— |
— |
| sentinel |
Dev-0270 Malicious Powershell usage |
— |
— |
| sentinel |
DEV-0270 New User Creation |
— |
— |
| sentinel |
Authentication Attempt from New Country |
Scheduled |
— |
| sentinel |
Authentications of Privileged Accounts Outside of Expected Controls |
Scheduled |
— |
| sentinel |
Microsoft Entra ID PowerShell accessing non-Entra ID resources |
— |
— |
| sentinel |
Azure Portal Signin from another Azure Tenant |
— |
— |
| sentinel |
Brute Force Attack against GitHub Account |
— |
— |
| sentinel |
Brute force attack against a Cloud PC |
— |
— |
| sentinel |
TI map IP entity to W3CIISLog |
— |
— |
| sentinel |
Dev-0228 File Path Hashes November 2021 |
Scheduled |
— |
| sentinel |
Denim Tsunami File Hashes July 2022 |
— |
— |
| sentinel |
Denim Tsunami C2 Domains July 2022 |
— |
— |
| sentinel |
Denim Tsunami AV Detection |
— |
— |
| sentinel |
DEV-0322 Serv-U related IOCs - July 2021 |
— |
— |
| sentinel |
Changes to Application Ownership |
Scheduled |
— |
| sentinel |
IP address of Windows host encoded in web request |
Scheduled |
— |
| sentinel |
Windows host username encoded in base64 web request |
Scheduled |
— |
| sentinel |
Known Barium domains |
— |
— |
| sentinel |
Known Barium IP |
— |
— |
| sentinel |
Cross-Cloud Password Spray detection |
— |
— |
| sentinel |
Cross-Cloud Unauthorized Credential Access Detection From AWS RDS Login |
— |
— |
| sentinel |
Cross-Cloud Suspicious user activity observed in GCP Envourment |
— |
— |
| sentinel |
Cross-Cloud Suspicious Compute resource creation in GCP |
— |
— |
| sentinel |
Chia_Crypto_Mining - Domain, Process, Hash and IP IOCs - June 2021 |
— |
— |
| sentinel |
Caramel Tsunami Actor IOC - July 2021 |
— |
— |