Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Shows all users with more than 1 display name in recent history. This is to hunt for users maliciously changing their display name as a masquerading technique
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | AzureDevOpsAuditing |
| ID | cf0c493b-a8af-4b32-8c7e-d4303f3a406f |
| Tactics | Persistence, DefenseEvasion |
| Techniques | T1098, T1036 |
| Required Connectors | AzureMonitor |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
ADOAuditLogs_CL |
? | ✓ | ? |
AzureDevOpsAuditing |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊