Valimail Enforce - Bulk Domain Changes by Single User

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Hunt for users who have made configuration changes to an unusually high number of domains in a short period. May indicate a compromised admin account or unauthorized bulk reconfiguration.

Attribute	Value
Type	Hunting Query
Solution	ValimailEnforce
ID	85db7cdc-378e-48b9-b6cf-77fd622aa617
Tactics	Impact, DefenseEvasion
Techniques	T1562, T1098
Required Connectors	ValimailEnforce
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
ValimailEnforceEvents_CL	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to ValimailEnforce