Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Detects users who have been compromised multiple times within a 7-day window. This may indicate a persistent threat or inadequate remediation. Ref: https://data443.com/tacitred-attack-surface-intelligence/
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | TacitRedThreatIntelligence |
| ID | a1b2c3d4-e5f6-7890-abcd-ef1234567890 |
| Severity | High |
| Kind | Scheduled |
| Tactics | CredentialAccess, Persistence |
| Techniques | T1078 |
| Required Connectors | TacitRedThreatIntel |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
AADNonInteractiveUserSignInLogs |
✓ | ✗ | ✓ |
BehaviorAnalytics |
✓ | ✗ | ✗ |
SigninLogs |
✓ | ✗ | ✓ |
TacitRed_Findings_CL 🔶 |
✗ | ✓ | ✗ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Analytic Rules · Back to TacitRedThreatIntelligence