| sentinel |
Process executed from binary hidden in Base64 encoded file |
— |
— |
| sentinel |
Failed logon attempts by valid accounts within 10 mins |
Scheduled |
— |
| sentinel |
Malware in the recycle bin |
— |
— |
| sentinel |
TI map IP entity to AzureFirewall |
— |
— |
| sentinel |
Possible Forest Blizzard attempted credential harvesting - Oct 2020 |
— |
— |
| sentinel |
Gain Code Execution on ADFS Server via Remote WMI Execution |
Scheduled |
— |
| sentinel |
Known Granite Typhoon domains and hashes |
— |
— |
| sentinel |
Hive Ransomware IOC - July 2022 |
— |
— |
| sentinel |
Failed host logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
Known Mint Sandstorm group domains/IP - October 2020 |
— |
— |
| sentinel |
Changes to Application Ownership |
Scheduled |
— |
| sentinel |
TI map IP entity to Azure Key Vault logs |
— |
— |
| sentinel |
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) |
— |
— |
| sentinel |
TI map IP entity to Azure SQL Security Audit Events |
— |
— |
| sentinel |
TI map IP entity to CommonSecurityLog |
— |
— |
| sentinel |
TI map IP entity to DnsEvents |
— |
— |
| sentinel |
TI map IP entity to OfficeActivity |
— |
— |
| sentinel |
TI map IP entity to VMConnection |
— |
— |
| sentinel |
Changes to Application Logout URL |
Scheduled |
— |
| sentinel |
Dumping LSASS Process Into a File |
— |
— |
| sentinel |
Excessive Windows logon failures |
— |
— |
| sentinel |
Exchange OAB Virtual Directory Attribute Containing Potential Webshell |
— |
— |
| sentinel |
Fake computer account created |
Scheduled |
— |
| sentinel |
Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task |
— |
— |
| sentinel |
Group created then added to built in domain local or global group |
Scheduled |
— |
| sentinel |
AD user enabled and password not set within 48 hours |
— |
— |
| sentinel |
Powershell Empire cmdlets seen in command line |
— |
— |
| sentinel |
Log4j vulnerability exploit aka Log4Shell IP IOC |
— |
— |
| sentinel |
MFA disabled for a user |
— |
— |
| sentinel |
MSHTML vulnerability CVE-2021-40444 attack |
— |
— |
| sentinel |
Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt |
Scheduled |
— |
| sentinel |
Malformed user agent |
Scheduled |
— |
| sentinel |
Known Manganese IP and UserAgent activity |
— |
— |
| sentinel |
Mercury - Domain, Hash and IP IOCs - August 2022 |
Scheduled |
— |
| sentinel |
Vulnerable Machines related to log4j CVE-2021-44228 |
— |
— |
| sentinel |
Vulnerable Machines related to OMIGOD CVE-2021-38647 |
Scheduled |
— |
| sentinel |
Password spray attack against ADFSSignInLogs |
— |
— |
| sentinel |
Anomalous Single Factor Signin |
Scheduled |
— |
| sentinel |
Anomalous sign-in location by user account and authenticating application |
— |
— |
| sentinel |
(Preview) TI map IP entity to Web Session Events (ASIM Web Session schema) |
— |
— |