Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Looks for a logon domain in the Microsoft Entra ID logs, encoded with the same DGA encoding used in the Nobelium campaign. See Important steps for customers to protect themselves from recent nation-state cyberattacks for more on the Nobelium campaign (formerly known as Solorigate). This query is inspired by an Azure Sentinel detection. References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://raw.githubusercontent.com/Azure/Azure-Senti
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | GitHub Only |
| ID | c561bf69-6a6c-4d0a-960a-b69e0e7c8f51 |
| Tactics | Command and control |
| Required Connectors | MicrosoftThreatProtection |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AADSignInEventsBeta |
? | ✗ | ? | |
DeviceEvents |
✓ | ✗ | ? | |
DeviceNetworkEvents |
✓ | ✗ | ? | |
IdentityQueryEvents |
ActionType in "DNS query,DnsQueryResponse" |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊