| Solution | Status | Publisher | Support | First Published | Popularity | Connectors | Tables | Content | |
|---|---|---|---|---|---|---|---|---|---|
 | 1Password | Active | 1Password | Partner | 2023-12-01 | 🟢 High | 3 | 1 | 19 |
 | 42Crunch API Protection | Active | 42Crunch API Protection | Partner | 2022-09-21 | 1 | 1 | 12 | |
 | A365 Observability | Active | Microsoft Corporation | Microsoft | 2026-02-25 | ⚪ Very Low | 1 | 0 | 0 |
 | AbnormalSecurity | Active | Abnormal Security | Partner | 2021-10-20 | 🟡 Low | 2 | 11 | 0 |
 | AbuseIPDB | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟡 Low | 0 | 0 | 3 |
 | Acronis Cyber Protect Cloud | Active | Acronis International GmbH | Partner | 2025-10-28 | ⚪ Very Low | 0 | 0 | 17 |
 | Agari | Unpublished | Agari | Partner | 2022-05-02 | 1 | 3 | 0 | |
 | AgileSec Analytics Connector | Active | InfoSecGlobal | Partner | ⚪ Very Low | 1 | 1 | 1 | |
 | AI Analyst Darktrace | Active | Darktrace | Partner | 2022-05-02 | 2 | 1 | 1 | |
 | AIShield AI Security Monitoring | Active | AIShield | Partner | 2022-01-11 | ⚪ Very Low | 1 | 1 | 42 |
 | Akamai Security Events | Active | Microsoft Corporation | Microsoft | 2022-03-23 | 🟢 High | 2 | 1 | 1 |
| ALC-WebCTRL | Active | Microsoft Corporation | Microsoft | 2021-11-18 | ⚪ Very Low | 1 | 1 | 0 |
| Alibaba Cloud | Active | Microsoft Corporation | Microsoft | 2022-06-27 | ⚪ Very Low | 1 | 1 | 1 |
 | Alibaba Cloud ActionTrail | Active | Microsoft Corporation | Microsoft | 2025-07-03 | ⚪ Very Low | 1 | 1 | 0 |
| Alibaba Cloud Networking | Active | Microsoft Corporation | Microsoft | 2026-02-12 | ⚪ Very Low | 1 | 0 | 0 |
 | Alsid For AD | Unpublished | Alsid | Partner | 2022-05-06 | 1 | 3 | 14 (+1 🔍) | |
 | Amazon Web Services | Active | Microsoft Corporation | Microsoft | 2022-05-26 | 🟢 High | 3 | 5 | 100 |
| Amazon Web Services NetworkFirewall | Active | Microsoft Corporation | Microsoft | 2025-03-20 | 🟡 Low | 1 | 3 | 0 |
| Amazon Web Services Route 53 | Active | Microsoft Corporation | Microsoft | 2025-03-21 | 🟡 Low | 1 | 1 | 0 |
 | Anvilogic | Active | Anvilogic | Partner | 2025-06-20 | ⚪ Very Low | 1 | 1 | 1 |
 | Apache Log4j Vulnerability Detection | Active | Microsoft Corporation | Microsoft | 2021-12-15 | 🔵 Medium | 0 | 0 | 17 |
 | ApacheHTTPServer | Active | Microsoft Corporation | Microsoft | 2021-10-27 | 🔵 Medium | 1 | 1 | 22 |
| 📦 | archTIS | Unpublished | 0 | 0 | 0 | ||||
 | ARGOSCloudSecurity | Active | ARGOS Cloud Security | Partner | 2022-08-16 | ⚪ Very Low | 1 | 1 | 2 |
 | AristaAwakeSecurity | Active | Arista - Awake Security | Partner | 2021-10-18 | ⚪ Very Low | 1 | 1 | 4 |
 | Armis | Active | Armis Corporation | Partner | 2022-08-02 | 🟡 Low | 4 | 3 | 4 |
 | Armorblox | Active | Armorblox | Partner | 2021-10-18 | 1 | 1 | 3 | |
 | Aruba ClearPass | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 2 | 1 | 1 |
| AtlassianConfluenceAudit | Active | Microsoft Corporation | Microsoft | 2022-01-24 | 🔵 Medium | 3 | 3 | 1 |
 | AtlassianJiraAudit | Active | Microsoft Corporation | Microsoft | 2022-01-10 | 🔵 Medium | 2 | 2 | 29 |
| Attacker Tools Threat Protection Essentials | Active | Microsoft Corporation | Microsoft | 2022-11-16 | 🟡 Low | 0 | 0 | 6 |
 | Australian Cyber Security Centre | Active | Microsoft Corporation | Microsoft | 2022-11-23 | ⚪ Very Low | 0 | 0 | 1 |
 | Auth0 | Active | Microsoft Corporation | Microsoft | 2022-08-18 | 🟢 High | 2 | 2 | 2 |
 | Authomize | Unpublished | Authomize | Partner | 2023-06-15 | 1 | 1 | 28 | |
| AWS CloudFront | Active | Microsoft Corporation | Microsoft | 2025-03-20 | 🟢 High | 1 | 1 | 0 |
| AWS EKS | Active | Microsoft Corporation | Microsoft | 2024-03-04 | ⚪ Very Low | 1 | 1 | 0 |
| AWS ELB | Active | Microsoft Corporation | Microsoft | 2026-03-20 | ⚪ Very Low | 1 | 6 | 3 |
| AWS Security Hub | Active | Microsoft Corporation | Microsoft | 2025-03-12 | 🟢 High | 1 | 1 | 11 |
 | AWS Systems Manager | Active | Microsoft Corporation | Microsoft | 🔵 Medium | 0 | 0 | 7 | |
| AWS VPC Flow Logs | Unpublished | Microsoft Corporation | Microsoft | 2025-07-30 | 1 | 1 | 0 | |
| AWS_AccessLogs | Active | Microsoft Corporation | Microsoft | 2025-02-06 | 🟡 Low | 1 | 1 | 0 |
| AWS_IAM | Active | Microsoft Corporation | Microsoft | 2022-09-28 | 🟢 High | 0 | 0 | 4 |
 | AWSAthena | Active | Microsoft Corporation | Microsoft | 2022-11-18 | 🔵 Medium | 0 | 0 | 1 |
 | Azure Activity | Active | Microsoft Corporation | Microsoft | 2022-04-18 | 🟢 High | 1 | 1 | 31 |
| Azure Batch Account | Active | Microsoft Corporation | Microsoft | 2022-06-30 | 🟢 High | 1 | 1 | 0 |
 | Azure Cloud NGFW By Palo Alto Networks | Active | Palo Alto Networks | Partner | 2023-11-03 | 🟢 High | 1 | 1 | 7 |
| Azure Cognitive Search | Active | Microsoft Corporation | Microsoft | 2022-06-28 | 🟢 High | 1 | 1 | 0 |
| 📦 | Azure Data Lake Storage Gen1 | Active | Microsoft Corporation | Microsoft | 2022-06-24 | 🟢 High | 1 | 1 | 0 |
 | Azure DDoS Protection | Active | Microsoft Corporation | Microsoft | 2022-05-13 | 🟢 High | 1 | 1 | 3 |
| Azure Event Hubs | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🟢 High | 1 | 1 | 0 |
 | Azure Firewall | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 1 | 10 | 23 |
| Azure Key Vault | Active | Microsoft Corporation | Microsoft | 2022-05-02 | 🟢 High | 1 | 1 | 5 |
| Azure kubernetes Service | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🔵 Medium | 1 | 3 | 3 |
| Azure Logic Apps | Active | Microsoft Corporation | Microsoft | 2022-06-24 | 🟢 High | 1 | 1 | 0 |
 | Azure Network Security Groups | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 1 | 1 | 0 |
 | Azure Resource Graph | Active | Microsoft Corporation | Microsoft | 2025-06-20 | 🟢 High | 1 | 0 | 0 |
| Azure Service Bus | Active | Microsoft Corporation | Microsoft | 2022-06-29 | 🟢 High | 1 | 1 | 0 |
 | Azure SQL Database solution for sentinel | Active | Microsoft Corporation | Microsoft | 2022-08-19 | 🟢 High | 1 | 1 | 19 |
 | Azure Storage | Active | Microsoft Corporation | Microsoft | 2022-05-12 | 🟢 High | 1 | 5 | 0 |
| Azure Stream Analytics | Active | Microsoft Corporation | Microsoft | 2022-06-24 | ⚪ Very Low | 1 | 1 | 0 |
 | Azure Web Application Firewall (WAF) | Active | Microsoft Corporation | Microsoft | 2022-05-18 | 🟢 High | 1 | 1 | 14 |
 | AzureDevOpsAuditing | Active | Microsoft Corporation | Microsoft | 2022-09-20 | 🟢 High | 1 | 1 | 37 |
| AzureSecurityBenchmark | Active | Microsoft Corporation | Microsoft | 2022-06-17 | 🟢 High | 0 | 0 | 5 |
| Barracuda CloudGen Firewall | Active | Community | Community | 2021-05-02 | 🟢 High | 1 | 1 | 1 (+1 🔍) |
 | Barracuda WAF | Active | Barracuda | Partner | 2022-05-13 | 1 | 3 | 0 | |
 | BETTER Mobile Threat Defense (MTD) | Active | Better Mobile Security Inc. | Partner | 2022-05-02 | ⚪ Very Low | 1 | 4 | 1 |
 | Beyond Security beSECURE | Unpublished | Beyond Security | Partner | 2022-05-02 | 1 | 3 | 0 | |
 | BeyondTrustPMCloud | Active | BeyondTrust | Partner | 2025-10-31 | ⚪ Very Low | 1 | 2 | 1 |
 | BigID | Active | BigID | Partner | 2025-10-07 | ⚪ Very Low | 1 | 2 | 0 |
| Bitglass | Active | Microsoft Corporation | Microsoft | 2021-10-23 | 🟡 Low | 1 | 1 | 22 |
 | BitSight | Active | BitSight Support | Partner | 2023-02-20 | 1 | 11 | 18 | |
 | Bitwarden | Active | Bitwarden Inc | Partner | 2024-05-12 | 🔵 Medium | 1 | 3 | 4 |
| Blackberry CylancePROTECT | Active | Microsoft Corporation | Microsoft | 2022-05-20 | 🟡 Low | 1 | 1 | 1 (+1 🔍) |
 | Blacklens | Active | blacklens.io Support | Partner | 2025-12-31 | ⚪ Very Low | 1 | 1 | 1 |
 | BlinkOps | Active | Blink Support | Partner | 2025-05-05 | 🟡 Low | 0 | 0 | 2 |
 | BloodHound Enterprise | Active | SpecterOps | Partner | 2023-05-04 | 1 | 1 | 108 | |
 | Box | Active | Microsoft Corporation | Microsoft | 2022-05-20 | 🔵 Medium | 2 | 2 | 22 |
| Broadcom SymantecDLP | Active | Microsoft Corporation | Microsoft | 2022-05-02 | ⚪ Very Low | 2 | 1 | 1 |
| Business Email Compromise - Financial Fraud | Active | Microsoft Corporation | Microsoft | 2023-08-04 | ⚪ Very Low | 0 | 0 | 20 |
 | Censys | Unpublished | Censys Support | Partner | 2026-03-05 | 0 | 0 | 12 | |
 | Check Point | Active | Check Point | Partner | 2021-08-13 | 🟡 Low | 0 | 0 | 2 |
 | Check Point CloudGuard CNAPP | Active | Check Point | Partner | 2024-11-12 | 🟡 Low | 1 | 1 | 0 |
 | Check Point Cyberint Alerts | Active | Check Point | Partner | 2025-03-18 | ⚪ Very Low | 1 | 1 | 11 |
| Check Point Cyberint IOC | Active | Cyberint | Partner | 2025-04-29 | 🟡 Low | 1 | 1 | 0 |
| CheckPhish by Bolster | Active | Microsoft Corporation | Microsoft | 2022-10-12 | ⚪ Very Low | 0 | 0 | 1 |
 | Cisco ACI | Active | Microsoft Corporation | Microsoft | 2021-07-03 | 🟡 Low | 1 | 1 | 1 |
| Cisco ETD | Active | Cisco Systems | Partner | 2024-03-04 | ⚪ Very Low | 1 | 1 | 1 |
| Cisco Firepower EStreamer | Active | Cisco | Partner | 2022-05-25 | 🔵 Medium | 2 | 1 | 3 |
| Cisco ISE | Active | Microsoft Corporation | Microsoft | 2021-07-03 | 🟢 High | 1 | 1 | 25 |
 | Cisco Meraki Events via REST API | Active | Microsoft Corporation | Microsoft | 2023-07-12 | 🔵 Medium | 1 | 3 | 0 |
| Cisco SD-WAN | Active | Cisco Systems | Partner | 2023-06-01 | 🔵 Medium | 1 | 2 | 8 (+4 🔍) |
| Cisco Secure Cloud Analytics | Active | Microsoft Corporation | Microsoft | 2021-10-20 | ⚪ Very Low | 1 | 1 | 1 |
| Cisco Secure Endpoint | Active | Microsoft Corporation | Microsoft | 2021-10-28 | 🟡 Low | 2 | 3 | 23 |
| Cisco UCS | Active | Microsoft Corporation | Microsoft | 2022-05-02 | ⚪ Very Low | 1 | 1 | 1 |
| CiscoASA | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 2 | 2 | 6 |
| CiscoDuoSecurity | Active | Cisco Systems | Partner | 2022-01-07 | ⚪ Very Low | 1 | 1 | 22 |
| CiscoMeraki | Active | Microsoft Corporation | Microsoft | 2021-09-08 | 🟢 High | 3 | 3 | 7 |
| CiscoSEG | Active | Microsoft Corporation | Microsoft | 2021-06-23 | 🟡 Low | 2 | 1 | 23 |
| CiscoUmbrella | Active | Microsoft Corporation | Microsoft | 2022-04-01 | 🟢 High | 2 | 12 | 26 |
| CiscoWSA | Active | Microsoft Corporation | Microsoft | 2021-06-29 | ⚪ Very Low | 1 | 1 | 23 |
 | Citrix ADC | Active | Microsoft Corporation | Microsoft | 2022-06-02 | 🟢 High | 1 | 1 | 1 (+1 🔍) |
 | Citrix Analytics CCF | Unpublished | Citrix Systems, Inc. | Partner | 2026-01-21 | 1 | 6 | 1 | |
| Citrix Analytics for Security | Active | Citrix Systems | Partner | 2022-05-06 | 1 | 4 | 1 | |
| Citrix Web App Firewall | Active | Citrix Systems | Partner | 2022-05-06 | 🟡 Low | 2 | 1 | 1 |
| Claroty | Active | Microsoft Corporation | Microsoft | 2021-10-23 | 🔵 Medium | 2 | 1 | 22 |
 | Claroty xDome | Active | xDome Customer Support | Partner | 2024-02-01 | 🔵 Medium | 1 | 1 | 0 |
| Cloud Identity Threat Protection Essentials | Active | Microsoft Corporation | Microsoft | 2022-11-16 | 🔵 Medium | 0 | 0 | 10 |
| Cloud Service Threat Protection Essentials | Active | Microsoft Corporation | Microsoft | 2022-11-16 | ⚪ Very Low | 0 | 0 | 2 |
| Cloudflare | Active | Cloudflare | Partner | 2021-10-20 | 🟢 High | 2 | 2 | 22 |
| Cloudflare CCF | Active | Cloudflare | Partner | 2025-09-30 | ⚪ Very Low | 1 | 1 | 22 |
 | CofenseIntelligence | Unpublished | Cofense Support | Partner | 2023-05-26 | 1 | 2 | 1 | |
| CofenseTriage | Unpublished | Cofense Support | Partner | 2023-03-24 | 1 | 3 | 1 | |
 | Cognni | Active | Cognni | Partner | 2022-05-06 | ⚪ Very Low | 1 | 1 | 16 |
 | CognyteLuminar | Active | Cognyte Luminar | Partner | 2023-09-15 | ⚪ Very Low | 1 | 1 | 0 |
 | CohesitySecurity | Active | Cohesity | Partner | 2022-10-10 | 🟡 Low | 1 | 1 | 5 |
| Common Event Format | Active | Microsoft Corporation | Microsoft | 2022-05-30 | 🟢 High | 2 | 1 | 1 |
 | Commvault Security IQ | Active | Commvault | Partner | 2023-08-17 | ⚪ Very Low | 1 | 1 | 4 |
| ContinuousDiagnostics&Mitigation | Active | Microsoft Corporation | Microsoft | 2022-08-24 | ⚪ Very Low | 0 | 0 | 3 |
 | Contrast Protect | Active | Contrast Protect | Partner | 2021-10-20 | 2 | 1 | 5 | |
 | ContrastADR | Active | Contrast Security | Partner | 2025-01-18 | ⚪ Very Low | 2 | 4 | 17 |
 | Corelight | Active | Corelight | Partner | 2022-06-01 | ⚪ Very Low | 1 | 108 | 153 |
 | Cortex XDR | Active | Microsoft Corporation | Microsoft | 2023-07-12 | 🔵 Medium | 2 | 5 | 4 |
 | Cribl | Active | Cribl | Partner | 2024-08-01 | 🔵 Medium | 1 | 4 | 4 |
 | CrowdStrike Falcon Endpoint Protection | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🟢 High | 6 | 30 | 9 (+1 🔍) |
 | CTERA | Active | CTERA | Partner | 2024-07-28 | ⚪ Very Low | 1 | 1 | 10 |
| 📦 | CTM360 | Active | Cyber Threat Management 360 | Partner | 2023-10-23 | ⚪ Very Low | 4 | 9 | 0 (+9 🔍) |
| CustomLogsAma | Active | Microsoft Corporation | Microsoft | 2024-07-21 | 🟢 High | 1 | 16 | 0 |
 | CyberArk Privilege Access Manager (PAM) Events | Active | Cyberark | Partner | 2022-05-02 | 🔵 Medium | 2 | 1 | 1 |
| CyberArkAudit | Active | CyberArk Support | Partner | 2024-03-01 | 🟢 High | 2 | 1 | 3 |
| CyberArkEPM | Active | CyberArk Support | Partner | 2022-04-10 | 1 | 1 | 22 | |
| CybersecurityMaturityModelCertification(CMMC)2.0 | Active | Microsoft Corporation | Microsoft | 2022-01-06 | 🟢 High | 0 | 0 | 6 |
 | Cybersixgill-Actionable-Alerts | Active | Cybersixgill | Partner | 2023-02-27 | ⚪ Very Low | 1 | 1 | 5 |
 | Cyble Vision | Active | Cyble Support | Partner | 2025-05-05 | 🟡 Low | 1 | 1 | 92 (+1 🔍) |
 | Cyborg Security HUNTER | Active | Cyborg Security | Partner | 2023-07-03 | ⚪ Very Low | 1 | 1 | 10 |
 | CyeraDSPM | Active | Cyera Inc | Partner | 2026-02-27 | ⚪ Very Low | 1 | 5 | 0 |
 | Cyfirma Attack Surface | Active | CYFIRMA | Partner | 2025-03-27 | ⚪ Very Low | 1 | 6 | 12 |
| Cyfirma Brand Intelligence | Active | CYFIRMA | Partner | 2025-03-27 | ⚪ Very Low | 1 | 5 | 10 |
| Cyfirma Compromised Accounts | Active | CYFIRMA | Partner | 2025-05-15 | 🟡 Low | 1 | 1 | 3 |
| Cyfirma Cyber Intelligence | Active | CYFIRMA | Partner | 2025-05-15 | 🟡 Low | 1 | 4 | 36 |
| Cyfirma Digital Risk | Active | CYFIRMA | Partner | 2025-03-27 | ⚪ Very Low | 1 | 7 | 14 |
| Cyfirma Vulnerabilities Intel | Active | CYFIRMA | Partner | 2025-05-15 | ⚪ Very Low | 1 | 1 | 4 |
 | Cyjax | Unpublished | Cyjax | Partner | 2026-03-24 | 1 | 1 | 8 | |
 | Cynerio | Active | Cynerio | Partner | 2023-03-29 | ⚪ Very Low | 1 | 1 | 6 (+2 🔍) |
 | Cyren-SentinelOne-ThreatIntelligence | Active | Data443 Risk Mitigation, Inc. | Partner | 2026-02-17 | ⚪ Very Low | 0 | 0 | 1 |
 | CyrenThreatIntelligence | Active | Data443 Risk Mitigation, Inc. | Partner | 2025-11-16 | ⚪ Very Low | 1 | 1 | 4 |
 | Cyware | Active | Cyware | Partner | 2024-03-18 | ⚪ Very Low | 0 | 0 | 4 |
 | D3SmartSOAR | Active | D3 Security | Partner | 2026-02-18 | ⚪ Very Low | 1 | 1 | 1 |
| Darktrace | Active | Darktrace | Partner | 2022-05-02 | 🟢 High | 1 | 1 | 4 |
 | Databahn | Active | Databahn | Partner | 2026-02-06 | ⚪ Very Low | 1 | 3 | 0 |
 | Datalake2Sentinel | Active | Orange Cyberdefense | Partner | 2024-01-15 | 🔵 Medium | 1 | 1 | 0 |
 | Dataminr Pulse | Active | Dataminr Support | Partner | 2023-04-12 | 🔵 Medium | 1 | 1 | 10 |
 | Datawiza | Active | Datawiza Technology Inc. | Partner | 2025-11-10 | ⚪ Very Low | 1 | 1 | 1 |
 | Delinea Secret Server | Active | Delinea | Partner | 2022-05-06 | 🔵 Medium | 2 | 1 | 1 |
| Dev 0270 Detection and Hunting | Active | Microsoft Corporation | Microsoft | 2022-11-29 | 🟡 Low | 0 | 0 | 4 |
| DEV-0537DetectionandHunting | Active | Microsoft Corporation | Microsoft | 2022-04-07 | 0 | 0 | 1 | |
| Digital Guardian Data Loss Prevention | Active | Microsoft Corporation | Microsoft | 2021-07-23 | 🔵 Medium | 1 | 1 | 22 |
 | Digital Shadows | Active | Digital Shadows | Partner | 🔵 Medium | 1 | 1 | 4 | |
| DNS Essentials | Active | Microsoft Corporation | Microsoft | 2023-01-14 | 🔵 Medium | 0 | 0 | 21 |
 | DomainTools | Active | DomainTools | Partner | 2022-10-20 | 🔵 Medium | 0 | 0 | 9 |
 | Doppel | Active | Doppel | Partner | 2024-11-20 | 🟡 Low | 1 | 1 | 1 |
| DORA Compliance | Active | Microsoft Corporation | Microsoft | 2025-10-08 | ⚪ Very Low | 0 | 0 | 1 |
| DPDP Compliance | Active | Microsoft Corporation | Microsoft | 2026-01-26 | ⚪ Very Low | 0 | 0 | 1 |
 | Dragos | Active | Dragos Inc | Partner | 2025-01-23 | 🟡 Low | 1 | 1 | 5 |
 | DruvaDataSecurityCloud | Active | Druva Inc | Partner | 2024-12-24 | 🟢 High | 1 | 3 | 5 |
 | Dynamics 365 | Active | Microsoft Corporation | Microsoft | 2023-01-17 | 🟢 High | 1 | 1 | 0 |
 | Dynatrace | Active | Dynatrace | Partner | 2022-10-18 | 🔵 Medium | 8 | 8 | 16 |
| EatonForeseer | Active | Microsoft Corporation | Microsoft | 2022-06-28 | 🟡 Low | 0 | 0 | 2 |
| EclecticIQ | Active | Microsoft Corporation | Microsoft | 2022-09-30 | ⚪ Very Low | 0 | 0 | 2 |
 | Egress Defend | Unpublished | egress1589289169584 | Partner | 2023-07-27 | 1 | 2 | 4 (+1 🔍) | |
| Egress Iris | Active | Egress Software Technologies Ltd | Partner | 2024-03-11 | 1 | 3 | 1 | |
| Elastic Search | Unpublished | Microsoft Corporation | Microsoft | 2022-09-30 | 0 | 0 | 1 | |
| ElasticAgent | Active | Microsoft Corporation | Microsoft | 2021-11-12 | ⚪ Very Low | 1 | 1 | 0 (+1 🔍) |
 | Endace | Active | Endace | Partner | 2025-03-24 | ⚪ Very Low | 0 | 0 | 1 |
| Endpoint Threat Protection Essentials | Active | Microsoft Corporation | Microsoft | 2022-11-16 | 🔵 Medium | 0 | 0 | 29 |
 | Entrust identity as Service | Active | Microsoft Corporation | Microsoft | 2023-05-22 | 🟡 Low | 0 | 0 | 5 |
 | Ermes Browser Security | Active | Ermes Cyber Security S.p.A. | Partner | 2023-09-29 | ⚪ Very Low | 1 | 1 | 0 |
 | ESET Inspect | Active | ESET Enterprise | Partner | 2022-06-01 | 1 | 1 | 0 | |
 | ESET Protect Platform | Unpublished | ESET Enterprise Integrations | Partner | 2024-10-29 | 1 | 2 | 1 | |
| Eset Security Management Center | Unpublished | Eset | Partner | 2022-05-11 | 1 | 1 | 3 | |
| ESETPROTECT | Active | ESET Netherlands | Partner | 2021-10-20 | 1 | 1 | 4 | |
 | Exabeam Advanced Analytics | Active | Microsoft Corporation | Microsoft | 2022-05-20 | 🔵 Medium | 1 | 1 | 1 |
 | ExtraHop | Active | ExtraHop Support | Partner | 2025-02-11 | 🔵 Medium | 1 | 1 | 3 |
 | ExtraHop Reveal(x) | Active | ExtraHop | Partner | 2022-05-19 | ⚪ Very Low | 2 | 1 | 1 |
 | F5 Big-IP | Active | F5 Networks | Partner | 2022-05-25 | 🔵 Medium | 1 | 3 | 2 |
| F5 Networks | Active | F5 | Partner | 2022-05-12 | 🔵 Medium | 2 | 1 | 0 |
 | FalconFriday | Active | FalconForce | Partner | 2021-10-18 | ⚪ Very Low | 0 | 0 | 30 |
| 📦 | Farsight DNSDB | Active | 0 | 0 | 0 (+4 🔍) | ||||
 | Feedly | Active | Feedly Inc | Partner | 2023-08-01 | ⚪ Very Low | 1 | 1 | 0 |
| FireEye Network Security | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🟡 Low | 2 | 1 | 1 |
 | Flare | Active | Flare | Partner | 2021-10-20 | 🔵 Medium | 1 | 1 | 10 |
| Forcepoint CASB | Active | Community | Community | 2022-05-19 | ⚪ Very Low | 2 | 1 | 1 |
| Forcepoint CSG | Active | Community | Community | 2022-05-10 | 🟡 Low | 2 | 1 | 1 |
| Forcepoint DLP | Active | Community | Community | 2022-05-09 | 🔵 Medium | 1 | 1 | 1 |
| Forcepoint NGFW | Active | Community | Community | 2022-05-25 | ⚪ Very Low | 2 | 1 | 2 |
| Forescout (Legacy) | Active | Microsoft Corporation | Microsoft | 2022-06-01 | ⚪ Very Low | 1 | 1 | 1 |
 | Forescout eyeInspect for OT Security | Unpublished | Forescout Technologies | Partner | 2025-07-10 | 1 | 2 | 1 | |
| ForescoutHostPropertyMonitor | Active | Forescout Technologies | Partner | 2022-06-28 | ⚪ Very Low | 1 | 3 | 3 |
 | ForgeRock Common Audit for CEF | Unpublished | Forgerock | Partner | 2022-05-04 | 1 | 1 | 1 | |
| Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel | Active | Microsoft Corporation | Microsoft | 2021-08-13 | 🟢 High | 2 | 1 | 4 |
 | Fortinet FortiNDR Cloud | Active | Fortinet | Partner | 2024-01-15 | 🔵 Medium | 1 | 3 | 2 |
| Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🔵 Medium | 2 | 1 | 7 |
 | Garrison ULTRA | Active | Garrison | Partner | 2024-10-04 | ⚪ Very Low | 1 | 1 | 0 |
| GDPR Compliance & Data Security | Active | Microsoft Corporation | Microsoft | 2025-10-08 | ⚪ Very Low | 0 | 0 | 1 |
 | Gigamon Connector | Active | Gigamon | Partner | 🟡 Low | 1 | 1 | 1 | |
 | GitHub | Active | Microsoft Corporation | Microsoft | 2021-10-18 | 🟢 High | 4 | 4 | 29 |
| GitLab | Active | Microsoft Corporation | Microsoft | 2022-04-27 | 🔵 Medium | 1 | 1 | 12 |
 | Global Secure Access | Active | Microsoft Corporation | Microsoft | 2024-04-08 | 🟢 High | 0 | 0 | 10 |
 | Google Apigee | Active | Microsoft Corporation | Microsoft | 2021-10-28 | 🔵 Medium | 2 | 2 | 3 |
 | Google Cloud Platform Audit Logs | Active | Microsoft Corporation | Microsoft | 2023-03-29 | 🔵 Medium | 2 | 1 | 12 |
| Google Cloud Platform BigQuery | Active | Microsoft Corporation | Microsoft | 2023-03-02 | 🔵 Medium | 0 | 0 | 3 |
 | Google Cloud Platform Cloud Monitoring | Active | Microsoft Corporation | Microsoft | 2022-07-01 | 🟡 Low | 2 | 2 | 1 |
| Google Cloud Platform Cloud Run | Active | Microsoft Corporation | Microsoft | 2021-07-30 | 🟡 Low | 1 | 1 | 0 |
| Google Cloud Platform Compute Engine | Active | Microsoft Corporation | Microsoft | 2022-07-07 | ⚪ Very Low | 1 | 1 | 0 |
| Google Cloud Platform Firewall Logs | Active | Microsoft Corporation | Microsoft | 2024-11-03 | ⚪ Very Low | 1 | 1 | 0 |
 | Google Cloud Platform Load Balancer Logs | Active | Microsoft Corporation | Microsoft | 2025-02-12 | 🔵 Medium | 1 | 1 | 0 |
| Google Cloud Platform Security Command Center | Active | Microsoft Corporation | Microsoft | 2023-09-11 | 🟡 Low | 1 | 1 | 10 |
| Google Cloud Platform VPC Flow Logs | Active | Microsoft Corporation | Microsoft | 2025-02-12 | 🟢 High | 1 | 1 | 0 |
| Google Kubernetes Engine | Active | Microsoft Corporation | Microsoft | 2025-04-04 | ⚪ Very Low | 1 | 6 | 0 |
 | Google Threat Intelligence | Active | Partner | 2024-10-26 | 🔵 Medium | 0 | 0 | 16 | |
| GoogleCloudPlatformCDN | Active | Microsoft Corporation | Microsoft | 2025-03-07 | 🟢 High | 1 | 1 | 0 |
| GoogleCloudPlatformDNS | Active | Microsoft Corporation | Microsoft | 2022-07-07 | ⚪ Very Low | 2 | 2 | 23 |
| GoogleCloudPlatformIAM | Active | Microsoft Corporation | Microsoft | 2021-07-30 | 🟢 High | 2 | 2 | 25 |
| GoogleCloudPlatformIDS | Active | Microsoft Corporation | Microsoft | 2022-07-07 | 🟡 Low | 1 | 1 | 0 |
| GoogleCloudPlatformNAT | Active | Microsoft Corporation | Microsoft | 2025-05-29 | ⚪ Very Low | 1 | 2 | 0 |
| GoogleCloudPlatformResourceManager | Active | Microsoft Corporation | Microsoft | 2025-03-07 | 🟡 Low | 1 | 1 | 0 |
| GoogleCloudPlatformSQL | Active | Microsoft Corporation | Microsoft | 2021-07-30 | ⚪ Very Low | 1 | 1 | 0 |
| 📦 | GoogleDirectory | Unpublished | 0 | 0 | 0 (+3 🔍) | ||||
 | GoogleWorkspaceReports | Active | Microsoft Corporation | Microsoft | 2022-01-24 | 🔵 Medium | 2 | 23 | 24 (+2 🔍) |
 | GravityZone | Unpublished | Bitdefender SRL | Partner | 2026-04-21 | 1 | 1 | 0 | |
 | GreyNoiseThreatIntelligence | Active | GreyNoise | Partner | 2023-09-05 | ⚪ Very Low | 1 | 1 | 6 |
| 📦 | Group-IB | Unpublished | 0 | 0 | 0 (+23 🔍) | ||||
 | Halcyon | Active | Halcyon | Partner | 2025-12-22 | ⚪ Very Low | 1 | 1 | 0 |
| HIPAA Compliance | Active | Microsoft Corporation | Microsoft | 2025-10-08 | ⚪ Very Low | 0 | 0 | 1 |
| HolmSecurity | Active | Holm Security | Partner | 2022-07-18 | 🔵 Medium | 1 | 2 | 0 |
| 📦 | HoneyTokens | Unpublished | 0 | 0 | 0 | ||||
 | HYAS | Active | HYAS | Partner | 2021-10-20 | ⚪ Very Low | 0 | 0 | 25 |
| HYAS Protect | Active | HYAS | Partner | 2023-09-26 | 1 | 1 | 1 | |
 | iboss | Active | iboss | Partner | 2022-02-15 | 🟡 Low | 2 | 1 | 3 |
| Illumio Core | Active | Microsoft | Microsoft | 2022-05-26 | 2 | 1 | 1 | |
| Illumio Insight | Active | Illumio | Partner | 2025-08-10 | ⚪ Very Low | 2 | 2 | 0 |
 | IllumioSaaS | Active | Illumio | Partner | 2024-05-13 | 🔵 Medium | 2 | 3 | 15 |
| 📦 | Illusive Active Defense | Unpublished | 0 | 0 | 0 (+2 🔍) | ||||
 | Illusive Platform | Active | Illusive Networks | Partner | 2022-05-25 | ⚪ Very Low | 2 | 1 | 3 |
 | Imperva WAF Gateway | Unpublished | Imperva | Partner | 2022-05-02 | 1 | 1 | 0 | |
| ImpervaCloudWAF | Active | Microsoft Corporation | Microsoft | 2021-09-28 | 🔵 Medium | 2 | 3 | 22 |
 | Infoblox | Active | Infoblox | Partner | 2024-07-15 | 🟡 Low | 5 | 20 | 27 |
| Infoblox Cloud Data Connector | Active | Infoblox | Partner | 2021-10-20 | 2 | 1 | 21 | |
| Infoblox NIOS | Active | Microsoft Corporation | Microsoft | 2022-04-01 | 🟢 High | 1 | 1 | 25 |
| Infoblox SOC Insights | Unpublished | Infoblox | Partner | 2024-03-06 | 3 | 2 | 12 | |
| 📦 | InsightVM | Unpublished | 0 | 0 | 0 | ||||
| Integration for Atlassian Beacon | Active | DEFEND Ltd. | Partner | 2023-09-22 | ⚪ Very Low | 1 | 1 | 2 |
 | Intel471 | Active | Intel 471 | Partner | 2023-06-21 | 0 | 0 | 2 | |
 | IONIX | Active | IONIX | Partner | 2022-05-02 | 🔵 Medium | 2 | 1 | 2 |
| IoTOTThreatMonitoringwithDefenderforIoT | Active | Microsoft Corporation | Microsoft | 2021-10-26 | 🔵 Medium | 1 | 1 | 23 (+1 🔍) |
 | IPinfo | Active | IPinfo | Partner | 2024-05-02 | ⚪ Very Low | 20 | 20 | 0 |
 | IPQualityScore | Active | IPQS Plugins Team | Partner | 2021-10-20 | 🔵 Medium | 0 | 0 | 5 |
 | IronNet IronDefense | Unpublished | Microsoft Corporation | Microsoft | 2021-10-18 | 1 | 1 | 3 (+3 🔍) | |
| ISC Bind | Active | Microsoft Corporation | Microsoft | 2022-09-20 | ⚪ Very Low | 1 | 1 | 1 |
 | Island | Active | Island | Partner | 2023-05-02 | 🟡 Low | 3 | 5 | 2 |
| Ivanti Unified Endpoint Management | Active | Microsoft Corporation | Microsoft | 2022-07-05 | 🔵 Medium | 1 | 1 | 1 |
 | Jamf Protect | Active | Jamf Software, LLC | Partner | 2022-10-10 | 🟢 High | 1 | 3 | 12 |
| JBoss | Active | Microsoft Corporation | Microsoft | 2021-10-20 | 🟡 Low | 1 | 1 | 1 |
 | JoeSandbox | Active | Stefan Bühlmann | Partner | 2025-09-12 | ⚪ Very Low | 1 | 1 | 2 |
| Joshua-Cyberiskvision | Active | Joshua Cyberiskvision | Partner | 2022-01-10 | ⚪ Very Low | 0 | 0 | 9 |
| Juniper SRX | Active | Microsoft Corporation | Microsoft | 2022-05-02 | 🟢 High | 1 | 1 | 1 |
| JuniperIDP | Active | Microsoft Corporation | Microsoft | 2021-03-31 | 🔵 Medium | 1 | 1 | 1 |
 | Keeper Security | Active | Keeper Security | Partner | 2025-06-03 | 🟢 High | 1 | 1 | 3 |
 | KnowBe4 Defend | Unpublished | knowbe41678478380097 | Partner | 2025-02-05 | 1 | 2 | 5 | |
| KQL Training | Active | Community | Community | 2022-11-30 | 🔵 Medium | 0 | 0 | 2 |
 | Lastpass Enterprise Activity Monitoring | Active | The Collective Consulting | Partner | 2021-10-20 | 🔵 Medium | 1 | 1 | 10 |
| Legacy IOC based Threat Protection | Active | Microsoft Corporation | Microsoft | 2022-12-19 | 🔵 Medium | 0 | 0 | 10 |
 | Lookout | Active | Lookout | Partner | 2021-10-18 | 🔵 Medium | 2 | 2 | 12 |
| Lookout Cloud Security Platform for Microsoft Sentinel | Active | Lookout | Partner | 2023-02-17 | 1 | 1 | 3 | |
 | Lumen Defender Threat Feed | Active | Lumen Technologies, Inc. | Partner | 2025-09-12 | 2 | 1 | 10 | |
| 📦 | MailGuard 365 | Active | MailGuard 365 | Partner | 2023-05-09 | ⚪ Very Low | 1 | 1 | 0 (+4 🔍) |
 | MailRisk | Active | Secure Practice | Partner | 2023-03-16 | ⚪ Very Low | 1 | 1 | 0 |
| Malware Protection Essentials | Active | Microsoft Corporation | Microsoft | 2023-09-25 | 🟡 Low | 0 | 0 | 14 |
| MarkLogicAudit | Active | Microsoft Corporation | Microsoft | 2022-08-01 | ⚪ Very Low | 1 | 1 | 1 |
| MaturityModelForEventLogManagementM2131 | Active | Microsoft Corporation | Microsoft | 2021-12-05 | 🟡 Low | 0 | 0 | 16 |
 | McAfee ePolicy Orchestrator | Active | Microsoft Corporation | Microsoft | 2021-03-25 | 1 | 1 | 26 | |
| McAfee Network Security Platform | Active | Microsoft Corporation | Microsoft | 2021-06-29 | 1 | 1 | 1 | |
 | meshStack | Active | meshcloud GmbH | Partner | 2025-12-15 | ⚪ Very Low | 1 | 1 | 0 |
 | Microsoft 365 | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 1 | 1 | 39 (+1 🔍) |
| Microsoft 365 Assets | Active | Microsoft Corporation | Microsoft | 2025-06-20 | 1 | 0 | 0 | |
 | Microsoft Business Applications | Active | Microsoft Corporation | Microsoft | 2023-04-19 | 🟢 High | 4 | 4 | 72 |
 | Microsoft Copilot | Active | Microsoft | Microsoft | 2025-10-01 | ⚪ Very Low | 1 | 1 | 7 |
| Microsoft Defender for Cloud | Active | Microsoft Corporation | Microsoft | 2022-05-17 | 🟢 High | 2 | 1 | 1 |
| Microsoft Defender for Cloud Apps | Active | Microsoft Corporation | Microsoft | 2022-05-02 | 🟢 High | 1 | 2 | 2 |
| Microsoft Defender for Identity | Active | Microsoft Corporation | Microsoft | 2022-04-20 | 🟢 High | 1 | 1 | 0 |
| Microsoft Defender for Office 365 | Active | Microsoft Corporation | Microsoft | 2022-05-17 | 🟢 High | 1 | 1 | 6 |
| Microsoft Defender Threat Intelligence | Active | Microsoft Corporation | Microsoft | 2023-03-23 | 🟢 High | 0 | 0 | 8 |
| Microsoft Defender XDR | Active | Microsoft Corporation | Microsoft | 2022-05-02 | 🟢 High | 1 | 22 | 371 (+3 🔍) |
 | Microsoft Entra ID | Active | Microsoft Corporation | Microsoft | 2022-05-16 | 🟢 High | 1 | 12 | 88 |
 | Microsoft Entra ID Assets | Active | Microsoft Corporation | Microsoft | 2025-06-20 | ⚪ Very Low | 1 | 0 | 0 |
 | Microsoft Entra ID Protection | Active | Microsoft Corporation | Microsoft | 2022-05-18 | 🟢 High | 1 | 1 | 6 |
| Microsoft Exchange Security - Exchange On-Premises | Active | Community | Community | 2022-12-21 | 🟢 High | 8 | 6 | 13 |
| Microsoft Exchange Security - Exchange Online | Active | Community | Community | 2022-12-21 | 🟢 High | 1 | 1 | 10 |
 | Microsoft PowerBI | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 1 | 1 | 1 |
 | Microsoft Project | Active | Microsoft | Microsoft | 2022-05-23 | 🟢 High | 1 | 1 | 0 |
 | Microsoft Purview | Active | Microsoft Corporation | Microsoft | 2021-11-23 | 🟢 High | 1 | 1 | 3 |
| Microsoft Purview Information Protection | Active | Microsoft Corporation | Microsoft | 2023-01-06 | 🟢 High | 1 | 1 | 0 |
| Microsoft Sysmon For Linux | Active | Microsoft Corporation | Microsoft | 2021-10-27 | ⚪ Very Low | 1 | 1 | 0 |
| Microsoft Windows SQL Server Database Audit | Active | Community | Community | 2022-11-29 | 🔵 Medium | 0 | 0 | 9 |
| MicrosoftDefenderForEndpoint | Active | Microsoft Corporation | Microsoft | 2022-01-31 | 🟢 High | 1 | 1 | 27 |
| MicrosoftPurviewInsiderRiskManagement | Active | Microsoft Corporation | Microsoft | 2021-10-20 | 🟢 High | 1 | 1 | 12 |
 | Mimecast | Active | Mimecast | Partner | 2024-09-10 | 🟢 High | 5 | 11 | 30 |
| MimecastAudit | Active | Mimecast | Partner | 2022-02-24 | ⚪ Very Low | 1 | 1 | 2 |
| MimecastSEG | Active | Mimecast | Partner | 2022-02-24 | 🟡 Low | 1 | 2 | 10 |
| MimecastTIRegional | Active | Mimecast | Partner | 2023-08-23 | ⚪ Very Low | 1 | 1 | 1 |
| MimecastTTP | Active | Mimecast | Partner | 2022-02-24 | ⚪ Very Low | 1 | 3 | 4 |
| Minemeld | Active | Microsoft Corporation | Microsoft | 2022-10-11 | ⚪ Very Low | 0 | 0 | 2 |
 | Miro | Active | Miro | Partner | ⚪ Very Low | 2 | 2 | 0 | |
 | MISP2Sentinel | Active | Community | Community | 2023-07-29 | 🟢 High | 1 | 1 | 0 |
 | MongoDBAtlas | Active | MongoDB | Partner | 2025-08-22 | ⚪ Very Low | 1 | 1 | 0 |
| MongoDBAudit | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🟡 Low | 1 | 1 | 1 |
 | Morphisec | Active | Morphisec | Partner | 2022-05-05 | 🔵 Medium | 1 | 1 | 4 |
| Mulesoft | Active | Microsoft Corporation | Microsoft | 2022-07-12 | 🟢 High | 1 | 1 | 1 |
| Multi Cloud Attack Coverage Essentials - Resource Abuse | Active | Microsoft Corporation | Microsoft | 2023-11-22 | ⚪ Very Low | 0 | 0 | 9 |
 | Nasuni | Active | Nasuni | Partner | 2023-07-07 | ⚪ Very Low | 1 | 1 | 3 |
 | NC Protect Data Connector | Active | archTIS | Partner | 2021-10-20 | 🔵 Medium | 1 | 1 | 1 |
 | NCSC-NL NDN Cyber Threat Intelligence Sharing | Active | Microsoft Corporation | Microsoft | 2025-05-19 | ⚪ Very Low | 0 | 0 | 1 |
 | NetApp Ransomware Resilience | Unpublished | NetApp | Partner | 2026-02-16 | 0 | 0 | 7 | |
 | NetClean ProActive | Active | NetClean | Partner | 2022-06-30 | 1 | 1 | 2 | |
| Netskope | Active | Netskope | Partner | 2022-05-05 | 🔵 Medium | 1 | 1 | 1 (+1 🔍) |
 | Netskopev2 | Active | Netskope | Partner | 2024-03-18 | 🔵 Medium | 3 | 28 | 37 |
 | NetskopeWebTx | Active | Netskope | Partner | 2026-02-10 | ⚪ Very Low | 1 | 1 | 12 |
| Network Session Essentials | Active | Microsoft Corporation | Microsoft | 2022-11-11 | 🟢 High | 0 | 0 | 38 |
| Network Threat Protection Essentials | Active | Microsoft Corporation | Microsoft | 2022-11-16 | 🔵 Medium | 0 | 0 | 5 |
| Netwrix Auditor | Active | Microsoft Corporation | Microsoft | 2022-06-17 | 🔵 Medium | 2 | 1 | 1 |
| Neustar IP GeoPoint | Active | Microsoft Corporation | Microsoft | 2022-09-30 | ⚪ Very Low | 0 | 0 | 1 |
| NGINX HTTP Server | Active | Microsoft Corporation | Microsoft | 2021-12-16 | 🟢 High | 1 | 1 | 22 |
| NISTSP80053 | Active | Microsoft Corporation | Microsoft | 2022-02-24 | 🔵 Medium | 0 | 0 | 5 |
| Noname API Security Solution for Microsoft Sentinel | Active | Noname Security | Partner | 2022-12-01 | 1 | 1 | 0 | |
 | NordPass | Active | NordPass | Partner | 2025-04-22 | 🔵 Medium | 1 | 1 | 10 |
| NozomiNetworks | Active | Microsoft Corporation | Microsoft | 2022-07-12 | 🟡 Low | 2 | 1 | 1 |
 | NXLog BSM macOS | Active | NXLog | Partner | 2022-05-02 | 1 | 1 | 0 | |
| NXLog FIM | Active | NXLog | Partner | 2022-08-15 | 1 | 1 | 0 | |
| NXLog LinuxAudit | Active | NXLog | Partner | 2022-05-05 | 1 | 1 | 0 | |
| NXLogAixAudit | Active | NXLog | Partner | 2022-05-05 | 1 | 1 | 0 (+1 🔍) | |
| NXLogDNSLogs | Active | NXLog | Partner | 2022-05-24 | 1 | 1 | 1 | |
 | Obsidian Datasharing | Active | Obsidian Security | Partner | 2024-01-01 | ⚪ Very Low | 1 | 2 | 0 |
 | Okta Single Sign-On | Active | Microsoft Corporation | Microsoft | 2022-03-24 | 🟢 High | 4 | 3 | 24 |
 | Onapsis Defend | Active | Onapsis | Partner | 2025-07-17 | 🔵 Medium | 1 | 2 | 0 |
| Onapsis Platform | Unpublished | Onapsis | Partner | 2022-05-11 | 1 | 1 | 2 | |
 | OneIdentity | Active | One Identity | Partner | 2022-05-02 | 1 | 1 | 1 (+1 🔍) | |
| OneLoginIAM | Active | Microsoft Corporation | Microsoft | 2022-08-18 | 🟡 Low | 2 | 3 | 1 |
 | OneTrust | Active | OneTrust, LLC | Partner | 2025-10-24 | ⚪ Very Low | 1 | 1 | 0 |
| 📦 | Open Systems | Active | Open Systems | Partner | 2025-05-12 | ⚪ Very Low | 1 | 4 | 0 (+5 🔍) |
 | OpenAI | Unpublished | Microsoft Corporation | Microsoft | 2026-03-20 | 1 | 2 | 0 | |
| OpenCTI | Active | Microsoft Corporation | Microsoft | 2022-09-22 | 🔵 Medium | 0 | 0 | 4 |
| OpenVPN | Active | Microsoft Corporation | Microsoft | 2022-08-18 | 🟢 High | 1 | 1 | 1 |
| Oracle Cloud Infrastructure | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🟢 High | 3 | 2 | 22 |
 | OracleDatabaseAudit | Active | Microsoft Corporation | Microsoft | 2021-11-05 | 🔵 Medium | 1 | 1 | 22 |
| OracleWebLogicServer | Active | Microsoft Corporation | Microsoft | 2022-01-06 | 🔵 Medium | 1 | 1 | 22 |
 | Orca Security Alerts | Active | Orca Security | Partner | 2022-05-10 | 🟡 Low | 1 | 1 | 1 |
| OSSEC | Active | Microsoft Corporation | Microsoft | 2022-05-19 | ⚪ Very Low | 2 | 1 | 1 |
| 📦 | Palo Alto - XDR (Cortex) | Unpublished | 1 | 1 | 0 (+2 🔍) | ||||
| Palo Alto Cortex XDR CCP | Active | Microsoft Corporation | Microsoft | 2024-12-07 | 🔵 Medium | 1 | 5 | 0 |
| Palo Alto Cortex Xpanse CCF | Active | Microsoft Corporation | Microsoft | 2024-12-07 | ⚪ Very Low | 1 | 1 | 0 |
| Palo Alto Prisma Cloud CWPP | Active | Microsoft Corporation | Microsoft | 2022-06-24 | 🔵 Medium | 2 | 1 | 0 |
| PaloAlto-PAN-OS | Active | Microsoft Corporation | Microsoft | 2021-08-09 | 🟢 High | 2 | 1 | 16 |
 | PaloAltoCDL | Active | Microsoft Corporation | Microsoft | 2021-10-23 | 🔵 Medium | 2 | 1 | 22 |
 | PaloAltoPrismaCloud | Active | Microsoft Corporation | Microsoft | 2021-04-16 | 🔵 Medium | 2 | 4 | 24 |
 | Pathlock_TDnR | Active | Pathlock Inc. | Partner | 2022-02-17 | ⚪ Very Low | 1 | 2 | 0 |
| PCI DSS Compliance | Active | Microsoft Corporation | Microsoft | 2022-06-29 | 🔵 Medium | 0 | 0 | 1 |
| 📦 | PDNS Block Data Connector | Unpublished | Nominet PDNS Support | Partner | 2023-03-31 | 1 | 1 | 0 | |
 | Perimeter 81 | Active | Perimeter 81 | Partner | 2022-05-06 | ⚪ Very Low | 1 | 1 | 1 |
 | Phosphorus | Active | Phosphorus Inc. | Partner | 2024-08-13 | ⚪ Very Low | 1 | 1 | 0 |
 | PingFederate | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🔵 Medium | 2 | 1 | 23 |
| PingOne | Active | Microsoft Corporation | Microsoft | 2025-04-20 | 🔵 Medium | 1 | 1 | 0 |
| PostgreSQL | Active | Microsoft Corporation | Microsoft | 2022-06-27 | 🟢 High | 1 | 1 | 1 |
| 📦 | Power Platform | Unpublished | 0 | 0 | 0 | ||||
| 📦 | Prancer PenSuiteAI Integration | Active | Prancer PenSuiteAI Integration | Partner | 2023-08-02 | ⚪ Very Low | 1 | 1 | 0 (+14 🔍) |
 | Proofpoint On demand(POD) Email Security | Active | Proofpoint, Inc. | Partner | 2021-03-31 | ⚪ Very Low | 2 | 6 | 22 |
| ProofPointTap | Active | Proofpoint, Inc. | Partner | 2022-05-23 | ⚪ Very Low | 2 | 8 | 6 |
| Pulse Connect Secure | Active | Microsoft Corporation | Microsoft | 2022-05-02 | 🟡 Low | 1 | 1 | 4 |
 | Pure Storage | Active | purestoragemarketplaceadmin | Partner | 2024-02-05 | 🔵 Medium | 0 | 0 | 9 |
 | Qualys VM Knowledgebase | Active | Microsoft Corporation | Microsoft | 2022-05-17 | 🟡 Low | 2 | 2 | 1 |
| QualysVM | Active | Microsoft Corporation | Microsoft | 2020-12-14 | 🟢 High | 2 | 3 | 8 |
 | Quokka | Active | Quokka | Partner | 2025-10-30 | ⚪ Very Low | 1 | 1 | 2 |
 | Radiflow | Active | Radiflow | Partner | 2024-06-26 | ⚪ Very Low | 1 | 1 | 9 |
| Rapid7InsightVM | Active | Microsoft Corporation | Microsoft | 2021-07-07 | 🔵 Medium | 2 | 4 | 5 |
 | Recorded Future | Active | Recorded Future Support Team | Partner | 2021-11-01 | 🔵 Medium | 0 | 0 | 33 (+4 🔍) |
| Recorded Future Identity | Active | Recorded Future Support Team | Partner | 2022-09-06 | 🟡 Low | 0 | 0 | 9 |
| 📦 | Red Canary | Active | Red Canary | Partner | 2022-03-04 | 1 | 1 | 0 (+1 🔍) | |
 | ReversingLabs | Active | ReversingLabs | Partner | 2022-08-08 | ⚪ Very Low | 0 | 0 | 6 |
 | RidgeSecurity | Active | RidgeSecurity | Partner | 2023-10-23 | ⚪ Very Low | 1 | 1 | 2 |
| RiskIQ | Active | Microsoft Corporation | Microsoft | 2021-10-20 | 🟡 Low | 0 | 0 | 27 |
| RSA SecurID | Active | Microsoft Corporation | Microsoft | 2021-09-07 | 🟡 Low | 1 | 1 | 1 |
 | RSAIDPlus_AdminLogs_Connector | Active | RSA Support Team | Partner | 2025-10-14 | ⚪ Very Low | 1 | 1 | 2 |
 | RubrikSecurityCloud | Active | Rubrik | Partner | 2022-07-19 | 🟢 High | 2 | 5 | 19 |
| SailPointIdentityNow | Active | SailPoint | Partner | 2021-10-26 | 🟢 High | 1 | 2 | 6 |
 | SalemCyber | Unpublished | Salem Cyber | Partner | 2023-07-21 | 0 | 0 | 2 | |
 | Salesforce Service Cloud | Active | Microsoft Corporation | Microsoft | 2022-05-16 | 🟢 High | 2 | 2 | 5 |
 | Samsung Knox Asset Intelligence | Active | Samsung Electronics Co., Ltd. | Partner | 2025-01-15 | 🔵 Medium | 1 | 6 | 8 |
| 📦 | SAP | Unpublished | 1 | 2 | 0 (+3 🔍) | ||||
 | SAP BTP | Active | Microsoft Corporation | Microsoft | 2023-04-04 | 🔵 Medium | 1 | 1 | 16 |
| SAP ETD Cloud | Active | SAP | Partner | 2025-02-17 | ⚪ Very Low | 1 | 2 | 4 |
| SAP LogServ | Active | SAP | Partner | 2025-02-17 | 🟢 High | 1 | 1 | 5 |
| SAP S4 Cloud Public Edition | Active | SAP | Partner | 2025-09-12 | ⚪ Very Low | 1 | 1 | 0 |
 | SecurityBridge App | Active | SecurityBridge | Partner | 2022-02-17 | ⚪ Very Low | 2 | 3 | 2 |
 | SecurityScorecard Cybersecurity Ratings | Active | SecurityScorecard | Partner | 2022-10-01 | 3 | 3 | 1 | |
| SecurityThreatEssentialSolution | Active | Microsoft Corporation | Microsoft | 2022-03-30 | 🔵 Medium | 0 | 0 | 9 |
 | Semperis Directory Services Protector | Active | Semperis | Partner | 2021-10-18 | 1 | 1 | 13 (+2 🔍) | |
 | SemperisLightning | Active | Semperis | Partner | 2026-03-01 | ⚪ Very Low | 1 | 7 | 0 |
 | SenservaPro | Active | Senserva | Partner | 2022-06-01 | 1 | 1 | 33 | |
| SentinelOne | Active | Microsoft Corporation | Microsoft | 2024-11-26 | 🟢 High | 2 | 6 | 23 |
| SentinelSOARessentials | Active | Microsoft Corporation | Microsoft | 2022-06-27 | 🟢 High | 0 | 0 | 28 (+1 🔍) |
 | SeraphicSecurity | Active | Seraphic Security | Partner | 2023-07-31 | ⚪ Very Low | 1 | 1 | 0 |
| Servicenow | Active | Microsoft Corporation | Microsoft | 2022-09-19 | 🟢 High | 0 | 0 | 3 |
 | ServiceNow TISC | Active | ServiceNow | Partner | 2025-01-15 | ⚪ Very Low | 0 | 0 | 8 |
 | SevcoSecurity | Unpublished | Microsoft Corporation | Microsoft | 2023-05-01 | 1 | 1 | 0 | |
 | ShadowByte Aria | Active | Shadowbyte | Partner | 2021-12-24 | ⚪ Very Low | 0 | 0 | 2 |
| Shodan | Active | Microsoft Corporation | Microsoft | 2023-02-20 | 🟡 Low | 0 | 0 | 3 |
 | SIGNL4 | Active | Derdack | Partner | 2021-12-10 | ⚪ Very Low | 1 | 2 | 1 |
 | Silverfort | Active | Silverfort | Partner | 2024-09-01 | 🔵 Medium | 1 | 1 | 5 |
 | SINEC Security Guard | Active | Siemens AG | Partner | 2024-07-15 | 1 | 1 | 1 | |
 | SlackAudit | Active | Microsoft Corporation | Microsoft | 2021-03-24 | ⚪ Very Low | 3 | 3 | 21 |
 | SlashNext | Active | SlashNext | Partner | 2022-08-12 | 1 | 2 | 2 | |
 | SlashNext SIEM | Active | SlashNext | Partner | 2023-05-26 | 0 | 0 | 1 | |
| Snowflake | Active | Microsoft Corporation | Microsoft | 2021-10-23 | 🟢 High | 2 | 11 | 22 |
| SOC Handbook | Active | Community | Community | 2022-11-30 | 🟢 High | 0 | 0 | 13 |
 | SOC Prime CCF | Active | SOC Prime | Partner | 2025-09-25 | ⚪ Very Low | 1 | 1 | 3 |
| SOC-Process-Framework | Active | Microsoft Corporation | Microsoft | 2022-04-08 | 🟡 Low | 0 | 0 | 20 |
 | SOCRadar | Unpublished | SOCRadar | Partner | 2026-02-08 | 0 | 0 | 11 | |
 | SonicWall Firewall | Active | SonicWall | Partner | 2022-05-06 | 🟢 High | 2 | 1 | 4 |
 | SonraiSecurity | Active | Sonrai | Partner | 2021-10-18 | ⚪ Very Low | 1 | 1 | 10 |
 | Sophos Cloud Optix | Active | Sophos | Partner | 2022-05-02 | 1 | 1 | 0 | |
| Sophos Endpoint Protection | Active | Microsoft Corporation | Microsoft | 2021-07-07 | 🟢 High | 2 | 3 | 1 |
| Sophos XG Firewall | Active | Microsoft Corporation | Microsoft | 2021-10-20 | 🟢 High | 1 | 1 | 4 |
| SOX IT Compliance | Active | Microsoft Corporation | Microsoft | 2025-12-11 | ⚪ Very Low | 0 | 0 | 1 |
 | SpyCloud Enterprise Protection | Active | Spycloud | Partner | 2023-09-09 | ⚪ Very Low | 0 | 0 | 10 |
 | Squadra Technologies SecRmm | Active | Squadra Technologies | Partner | 2022-05-09 | 1 | 1 | 2 | |
| SquidProxy | Active | Microsoft Corporation | Microsoft | 2022-05-16 | 🔵 Medium | 1 | 1 | 1 |
 | Styx Intelligence | Unpublished | Styx Intelligence | Partner | 2025-02-07 | 1 | 1 | 0 | |
 | Symantec Endpoint Protection | Active | Microsoft Corporation | Microsoft | 2022-07-01 | 🔵 Medium | 1 | 1 | 4 |
| Symantec Integrated Cyber Defense | Active | Microsoft Corporation | Microsoft | 2022-06-02 | ⚪ Very Low | 1 | 1 | 0 |
| Symantec VIP | Active | Microsoft Corporation | Microsoft | 2022-05-16 | 🟡 Low | 1 | 1 | 4 |
| SymantecProxySG | Active | Microsoft Corporation | Microsoft | 2021-05-25 | 🟢 High | 1 | 1 | 4 |
| 📦 | Synack | Active | 0 | 0 | 0 | ||||
 | SynqlyIntegrationConnector | Active | Synqly | Partner | 2026-01-30 | ⚪ Very Low | 1 | 10 | 0 |
| Syslog | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 2 | 1 | 18 |
 | TacitRed-Defender-ThreatIntelligence | Active | Data443 Risk Mitigation, Inc. | Partner | 2025-11-10 | ⚪ Very Low | 0 | 0 | 1 |
| TacitRed-IOC-CrowdStrike | Active | Data443 Risk Mitigation, Inc. | Partner | 2025-11-25 | ⚪ Very Low | 0 | 0 | 1 |
| TacitRed-SentinelOne | Active | Data443 Risk Mitigation, Inc. | Partner | 2025-12-01 | ⚪ Very Low | 0 | 0 | 1 |
| TacitRedThreatIntelligence | Active | Data443 Risk Mitigation, Inc. | Partner | 2025-01-01 | ⚪ Very Low | 1 | 1 | 3 |
 | Talon | Active | Talon Security | Partner | 2023-01-25 | ⚪ Very Low | 1 | 1 | 1 |
 | Tanium | Active | Tanium Inc. | Partner | 2022-05-16 | 🔵 Medium | 1 | 10 | 10 |
 | Team Cymru Scout | Active | Team Cymru | Partner | 2024-07-16 | 🟡 Low | 1 | 14 | 28 |
| Teams | Active | Microsoft Corporation | Microsoft | 2022-02-01 | 🔵 Medium | 0 | 0 | 3 |
 | Tenable App | Active | Tenable | Partner | 2024-06-06 | 🟢 High | 2 | 7 | 20 |
| 📦 | TenableAD | Unpublished | 1 | 2 | 0 (+15 🔍) | ||||
 | TenableIO | Active | Tenable | Partner | 2022-06-01 | 🟢 High | 1 | 2 | 3 (+2 🔍) |
| 📦 | TestSolution | Unpublished | 0 | 0 | 0 | ||||
| TheHive | Active | Microsoft Corporation | Microsoft | 2021-10-23 | ⚪ Very Low | 2 | 1 | 3 (+1 🔍) |
 | Theom | Active | Theom | Partner | 2022-11-04 | ⚪ Very Low | 1 | 1 | 21 |
| Threat Intelligence | Active | Microsoft Corporation | Microsoft | 2022-05-18 | 🟢 High | 5 | 2 | 58 |
| Threat Intelligence (NEW) | Active | Microsoft Corporation | Microsoft | 2025-04-02 | 🟢 High | 6 | 4 | 59 |
| Threat Intelligence Solution for Azure Government | Unpublished | Microsoft Corporation | Microsoft | 2023-03-06 | 0 | 0 | 0 | |
| ThreatAnalysis&Response | Active | Microsoft Corporation | Microsoft | 2021-10-20 | 🟡 Low | 0 | 0 | 2 |
 | ThreatConnect | Active | ThreatConnect, Inc. | Partner | 2023-09-11 | ⚪ Very Low | 0 | 0 | 6 |
| ThreatXCloud | Active | Microsoft Corporation | Microsoft | 2022-09-23 | ⚪ Very Low | 0 | 0 | 2 |
| Tomcat | Active | Microsoft Corporation | Microsoft | 2022-01-31 | 🔵 Medium | 1 | 1 | 23 |
 | Torq | Active | Torq Support Team | Partner | 2024-12-24 | 🔵 Medium | 0 | 0 | 1 |
 | TransmitSecurity | Active | Transmit Security | Partner | 2024-06-10 | ⚪ Very Low | 1 | 1 | 0 |
| Trellix | Active | Microsoft Corporation | Microsoft | 2026-02-26 | ⚪ Very Low | 1 | 1 | 1 |
 | Trend Micro Apex One | Active | Microsoft Corporation | Microsoft | 2021-07-06 | 🟡 Low | 2 | 1 | 22 |
| Trend Micro Cloud App Security | Active | Microsoft Corporation | Microsoft | 2021-09-28 | 1 | 1 | 21 (+1 🔍) | |
| Trend Micro Deep Security | Active | Trend Micro | Partner | 2022-05-10 | 🟡 Low | 1 | 1 | 3 |
| Trend Micro TippingPoint | Active | Trend Micro | Partner | 2022-05-02 | ⚪ Very Low | 1 | 1 | 1 |
| Trend Micro Vision One | Active | Trend Micro | Partner | 2022-05-11 | 🔵 Medium | 1 | 4 | 2 |
 | Tropico | Active | TROPICO Security | Partner | 2025-12-02 | ⚪ Very Low | 3 | 3 | 0 |
 | Ubiquiti UniFi | Active | Microsoft Corporation | Microsoft | 2022-06-01 | 🟢 High | 1 | 1 | 22 |
| UEBA Essentials | Active | Microsoft Corporation | Microsoft | 2022-06-27 | 🔵 Medium | 0 | 0 | 31 |
 | Upwind | Unpublished | Upwind | Partner | 2026-03-10 | 1 | 1 | 0 | |
| URLhaus | Active | Microsoft Corporation | Microsoft | 2022-09-29 | 🟡 Low | 0 | 0 | 3 |
 | Vaikora-Sentinel | Unpublished | Data443 Risk Mitigation, Inc. | Partner | 2026-04-03 | 1 | 1 | 4 | |
 | Valence Security | Active | Valence Security | Partner | 2023-11-20 | ⚪ Very Low | 1 | 1 | 2 |
 | ValimailEnforce | Unpublished | Valimail | Partner | 2026-03-31 | 1 | 1 | 8 | |
 | vArmour Application Controller | Active | vArmour Networks | Partner | 2022-06-01 | ⚪ Very Low | 2 | 1 | 2 |
 | Varonis Purview | Active | Varonis | Partner | 2025-10-27 | ⚪ Very Low | 1 | 1 | 0 |
| VaronisSaaS | Active | Varonis | Partner | 2023-11-10 | 🟡 Low | 1 | 1 | 1 |
 | Vectra AI Detect | Active | Vectra AI | Partner | 2022-05-24 | 🟡 Low | 2 | 1 | 8 |
| Vectra AI Stream | Active | Vectra AI | Partner | 2021-10-18 | ⚪ Very Low | 2 | 18 | 20 |
| Vectra XDR | Active | Vectra Support | Partner | 2023-07-04 | ⚪ Very Low | 1 | 6 | 33 |
 | Veeam | Active | Veeam Software | Partner | 2025-08-26 | ⚪ Very Low | 1 | 6 | 164 |
| Veritas NetBackup | Active | Veritas Technologies LLC | Partner | 2023-09-25 | 🔵 Medium | 0 | 0 | 2 |
 | VersasecCMS | Active | Versasec Support | Partner | ⚪ Very Low | 1 | 2 | 3 | |
 | VirtualMetric DataStream | Active | VirtualMetric | Partner | 2025-09-15 | ⚪ Very Low | 3 | 1 | 0 |
| VirusTotal | Active | Microsoft Corporation | Microsoft | 2022-07-31 | 🟢 High | 0 | 0 | 9 |
 | Visa Threat Intelligence (VTI) | Unpublished | Visa Inc. | Partner | 2026-02-20 | 1 | 1 | 3 | |
 | VMRay | Active | VMRay | Partner | 2025-07-23 | ⚪ Very Low | 1 | 1 | 2 |
| VMware Carbon Black Cloud | Active | Microsoft | Microsoft | 2022-06-01 | 🟢 High | 2 | 10 | 6 |
 | VMware SASE | Unpublished | VMware by Broadcom | Partner | 2023-12-31 | 1 | 4 | 16 | |
| VMware vCenter | Active | Microsoft Corporation | Microsoft | 2022-06-29 | 🟢 High | 1 | 1 | 4 |
| VMWareESXi | Active | Microsoft Corporation | Microsoft | 2022-01-12 | 🟢 High | 1 | 1 | 26 |
 | Votiro | Unpublished | Votiro | Partner | 1 | 1 | 3 | ||
 | Watchguard Firebox | Active | WatchGuard | Partner | 2022-05-06 | 🔵 Medium | 1 | 1 | 0 (+1 🔍) |
| Watchlists Utilities | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🔵 Medium | 0 | 0 | 12 |
| Web Session Essentials | Active | Microsoft Corporation | Microsoft | 2023-06-29 | ⚪ Very Low | 0 | 0 | 26 |
| Web Shells Threat Protection | Active | Microsoft Corporation | Microsoft | 2022-05-22 | 🟡 Low | 0 | 0 | 9 |
| Windows Firewall | Active | Microsoft Corporation | Microsoft | 2022-05-02 | 🔵 Medium | 2 | 2 | 1 |
| Windows Forwarded Events | Active | Microsoft Corporation | Microsoft | 2022-05-02 | 🔵 Medium | 1 | 1 | 2 (+2 🔍) |
| Windows Security Events | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟢 High | 2 | 1 | 72 |
 | Windows Server DNS | Active | Microsoft Corporation | Microsoft | 2022-05-11 | 🟢 High | 2 | 3 | 15 |
 | WireX Network Forensics Platform | Active | WireX Systems | Partner | 2022-05-06 | ⚪ Very Low | 2 | 1 | 0 |
 | WithSecureElementsViaConnector | Unpublished | WithSecure | Partner | 2022-11-03 | 1 | 1 | 0 | |
| WithSecureElementsViaFunction | Active | WithSecure | Partner | 2024-02-22 | 🟡 Low | 1 | 1 | 1 |
 | Wiz | Active | Wiz | Partner | 2023-06-20 | 🟢 High | 1 | 6 | 1 |
 | Workday | Active | Microsoft Corporation | Microsoft | 2024-02-15 | 🟢 High | 1 | 1 | 0 |
| Workplace from Facebook | Active | Microsoft Corporation | Microsoft | 2022-05-18 | 🟡 Low | 1 | 1 | 0 (+1 🔍) |
 | XBOW | Active | XBOW | Partner | 2026-03-04 | ⚪ Very Low | 1 | 3 | 4 |
 | ZeroFox | Active | ZeroFox | Partner | 2023-07-28 | 🔵 Medium | 2 | 21 | 4 |
 | ZeroNetworks | Active | Zero Networks | Partner | 2022-06-06 | 🟡 Low | 3 | 5 | 12 |
| ZeroTrust(TIC3.0) | Active | Microsoft Corporation | Microsoft | 2021-10-20 | ⚪ Very Low | 0 | 0 | 5 |
 | Zimperium Mobile Threat Defense | Active | Zimperium | Partner | 2022-05-02 | ⚪ Very Low | 1 | 2 | 1 |
| Zinc Open Source | Active | Microsoft Corporation | Microsoft | 2022-10-03 | ⚪ Very Low | 0 | 0 | 3 |
| ZoomReports | Active | Microsoft Corporation | Microsoft | 2022-05-23 | 🟡 Low | 2 | 2 | 2 |
 | Zscaler Internet Access | Active | Zscaler | Partner | 2022-10-10 | 15 | 1 | 27 (+2 🔍) | |
| Zscaler Private Access (ZPA) | Active | Microsoft Corporation | Microsoft | 2022-01-31 | 🟢 High | 1 | 1 | 22 |
Active Published solution
Deprecated Deprecated solution
Unpublished Not on content hub
Active Published connector
Deprecated Deprecated connector
Unpublished Not on content hub
🔶 Custom Logs v1 (classic, may not be accurate)
🔍 Not listed in solution JSON
🔶 Custom Logs v1 (classic, may not be accurate)
📖 Table schema available
| Name | Type | Source | Solution | Description |
|---|---|---|---|---|
| 1Password - Changes to firewall rules | Analytic Rule | 📦 Solution | 1Password | This will alert when changes have been made to the firewall rules. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same... |
| 1Password - Changes to SSO configuration | Analytic Rule | 📦 Solution | 1Password | This will alert when changes have been made to the SSO configuration. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the s... |
| 1Password - Disable MFA factor or type for all user accounts | Analytic Rule | 📦 Solution | 1Password | This will alert when the MFA factor or type for all user accounts are disabled. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities... |
| 1Password - Log Ingestion Failure | Analytic Rule | 📦 Solution | 1Password | This will alert when the log ingestion for the OnePasswordEventLogs_CL logs is failing. The alert is based on the healthevents that are created every 5 minutes and will trigger if no logs have been re... |
| 1Password - Manual account creation | Analytic Rule | 📦 Solution | 1Password | This will alert when a new account was created manually within 1Password. This should only be used when a 1Password integration via a SCIM Bridge has been implemented. Ref: https://support.1password.... |
| 1Password - New service account integration created | Analytic Rule | 📦 Solution | 1Password | This will alert when a new integration has been created. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: ht... |
| 1Password - Non-privileged vault user permission change | Analytic Rule | 📦 Solution | 1Password | This will alert when user permissions have changed within a non-privileged vault which have been implemented by an actor that was not the target user account. Once this analytics rule is triggered it ... |
| 1Password - Potential insider privilege escalation via group | Analytic Rule | 📦 Solution | 1Password | This will alert when an actor grants, or updates their own permissions via a group. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related enti... |
| 1Password - Potential insider privilege escalation via vault | Analytic Rule | 📦 Solution | 1Password | This will alert when an actor grants, or updates their own permissions via a vault. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related enti... |
| 1Password - Privileged vault permission change | Analytic Rule | 📦 Solution | 1Password | This will alert when permissions have changed within a privileged vault. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are th... |
| 1Password - Secret extraction post vault access change by administrator | Analytic Rule | 📦 Solution | 1Password | This will alert when a secret extraction has occurred after an administrator has changed their own vault access permissions within that same vault. Ref: https://1password.com/ Ref: https://github.com/... |
| 1Password - Service account integration token adjustment | Analytic Rule | 📦 Solution | 1Password | This will alert when a service account integration token has been created, renamed, verified, or revoked. Once this analytics rule is triggered it will group all related future alerts for upto an hour... |
| 1Password - Successful anomalous sign-in | Analytic Rule | 📦 Solution | 1Password | This will alert when a new successful MFA confirmed sign-in has occurred from a location that was not seen within the last 14 days. Ref: https://1password.com/ Ref: https://github.com/securehats/ |
| 1Password - User account MFA settings changed | Analytic Rule | 📦 Solution | 1Password | This will alert when a user creates, updates, or disables the user account MFA settings. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related... |
| 1Password - User added to privileged group | Analytic Rule | 📦 Solution | 1Password | This will alert when a user is added to a privileged group which has been implemented by an actor that was not the target user account. Once the analytics rule is triggered it will group all related f... |
| 1Password - Vault export post account creation | Analytic Rule | 📦 Solution | 1Password | This will alert when a successful vault export has occurred within 14 days of a new account being created within 1Password. Ref: https://1password.com/ Ref: https://github.com/securehats/ |
| 1Password - Vault export prior to account suspension or deletion | Analytic Rule | 📦 Solution | 1Password | This will alert when a successful vault export has occurred within the last 14 days prior to an account being suspended or deleted from 1Password. Ref: https://1password.com/ Ref: https://github.com/... |
| 1Password - Vault export | Analytic Rule | 📦 Solution | 1Password | This will alert when a successful vault export has occurred within 1Password. Ref: https://1password.com/ Ref: https://github.com/securehats/ |
| 1Password | Workbook | 📦 Solution | 1Password | |
| API - Account Takeover | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against account takeover |
| API - Anomaly Detection | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection anomaly detection |
| API - API Scraping | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against API scraping |
| API - BOLA | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against BOLA |
| API - Rate limiting | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against first-time access |
| API - Invalid host access | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against invalid host access |
| API - JWT validation | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against JWT validation |
| API - Kiterunner detection | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against Kiterunner enumeration |
| API - Password Cracking | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against password cracking |
| API - Rate limiting | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against rate limiting |
| API - Suspicious Login | Analytic Rule | 📦 Solution | 42Crunch API Protection | 42Crunch API protection against suspicious login |
| 42CrunchAPIProtectionWorkbook | Workbook | 📦 Solution | 42Crunch API Protection | |
| AbuseIPDB Blacklist Ip To Threat Intelligence | Playbook | 📦 Solution | AbuseIPDB | By every day reccurence, this playbook gets triggered and performs the following actions: 1. Gets [list](https://docs.abuseipdb.com/#blacklist-endpoint) of the most reported IP addresses form the Blac... |
| AbuseIPDB Enrich Incident By IP Info | Playbook | 📦 Solution | AbuseIPDB | Once a new sentinal incident is created, this playbook gets triggered and performs the following actions: 1. [Gets Information](https://docs.abuseipdb.com/#check-endpoint) from AbuseIPDB by IP`s, prov... |
| AbuseIPDB Report IPs To AbuseIPDB After User Response In MSTeams | Playbook | 📦 Solution | AbuseIPDB | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Sends an adaptive card to the Teams channel where the analyst can choose an action to be ta... |
| Acronis - Login from Abnormal IP - Low Occurrence | Analytic Rule | 📦 Solution | Acronis Cyber Protect Cloud | Suspicious login from an IP address observed up to two times in the last two weeks. |
| Acronis - Multiple Endpoints Accessing Malicious URLs | Analytic Rule | 📦 Solution | Acronis Cyber Protect Cloud | Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs. |
| Acronis - Multiple Endpoints Infected by Ransomware | Analytic Rule | 📦 Solution | Acronis Cyber Protect Cloud | Detects when three or more distinct endpoints report ransomware detections within a single day. |
| Acronis - Multiple Inboxes with Malicious Content Detected | Analytic Rule | 📦 Solution | Acronis Cyber Protect Cloud | Many inboxes containing malicious content could indicate a potential ongoing phishing attack. |
| Acronis - Agent failed updating more than twice in a day | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | The following devices have failed agent updates more than two times. |
| Acronis - Agents offline for 2 days or more | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Query to find agents that have been offline for two days or longer. |
| Acronis - Audit Log | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Records user and system operations in the management portal and Cyber Protect console, including scripting, quota, and email archiving events. |
| Acronis - Cloud Connection Errors | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Various errors related to S3 or Azure cloud connections. |
| Acronis - Endpoints Accessing Malicious URLs | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs. |
| Acronis - Endpoints Infected by Ransomware | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Detected and blocked ransomware. |
| Acronis - Endpoints with Backup issues | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Endpoints experiencing various backup-related issues. |
| Acronis - Endpoints with EDR Incidents | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | A high number of endpoints with multiple incidents could indicate an ongoing attack. |
| Acronis - Endpoints with high failed login attempts | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Multiple endpoints with a high number of failed login attempts could indicate a password spraying attack, where an attacker tries different credentials across several machines. |
| Acronis - Inboxes with Malicious Content | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Many inboxes containing malicious content could indicate a potential ongoing phishing attack. |
| Acronis - Login from Abnormal IP - Low Occurrence | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Suspicious login from an IP address observed up to two times. |
| Acronis - Protection Service Errors | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | Various errors related to Active Protection or CPS malfunctions. |
| Acronis - ASZ defence: Unauthorized operation is detected and blocked | Hunting Query | 📦 Solution | Acronis Cyber Protect Cloud | An attempt to modify the protected Acronis Secure Zone partition was blocked. |
| InfoSecGlobal | Workbook | 📦 Solution | AgileSec Analytics Connector | |
| AIA-Darktrace | Workbook | 📦 Solution | AI Analyst Darktrace | |
| Guardian- Ban Topic Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Ban Topic Policy Violation detected from the Guardian. |
| Guardian- BII Detection Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when BII Detection Policy Violation detected from the Guardian. |
| Guardian- Block Competitor Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when a Block Competitor Policy Violation is detected from the Guardian. |
| Guardian- Blocks specific strings of text Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Blocks specific strings of text Policy Violation detected from the Guardian. |
| Guardian- Code Detection Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Code Detection Policy Violation detected from the Guardian. |
| Guardian- Content Access Control Allowed List Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Content Access Control Allowed List Policy Violation detected from the Guardian. |
| Guardian- Content Access Control Blocked List Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Content Access Control Blocked List Policy Violation detected from the Guardian. |
| Guardian- Content Safety Profanity Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Content Safety Profanity Policy Violation detected from the Guardian. |
| Guardian- Content Safety Toxicity Policy Violation Detection. | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Content Safety Toxicity Policy Violation detected from the Guardian |
| Guardian- Gender Bias Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Gender Bias Policy Violation detected from the Guardian. |
| AIShield - Image classification AI Model Evasion high suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Image classification AI Model Evasion high suspicious, high severity vulnerability detected from the AIShield. |
| AIShield - Image classification AI Model Evasion low suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Image classification AI Model Evasion low suspicious, high severity vulnerability detected from the AIShield. |
| AIShield - Image classification AI Model extraction high suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Image classification AI Model extraction high suspicious, high severity vulnerability detected from the AIShield. |
| AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Image Segmentation AI Model extraction high suspicious, high severity vulnerability detected from the AIShield. |
| Guardian- Input Output Relevance Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Input Output Relevance Policy Violation detected from the Guardian. |
| Guardian- Input Rate Limiter Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Input Rate Limiter Policy Violation detected from the Guardian. |
| Guardian- Invisible Text Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Invisible Text Policy Violation detected from the Guardian. |
| Guardian- Additional check JSON Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Additional check JSON Policy Violation detected from the Guardian. |
| Guardian- Language Detection Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Language Detection Policy Violation detected from the Guardian. |
| Guardian- Malicious URL Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Malicious URL Policy Violation detected from the Guardian. |
| AIShield - Natural language processing AI model extraction high suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Natural language processing AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.' |
| Guardian- No LLM Output Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when No LLM Output Policy Violation detected from the Guardian. |
| Guardian- Not Safe For Work Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Not Safe For Work Policy Violation detected from the Guardian. |
| Guardian- Privacy Protection PII Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Privacy Protection PII Policy Violation detected from the Guardian |
| Guardian- Racial Bias Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Racial Bias Policy Violation detected from the Guardian. |
| Guardian- Regex Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Regex Policy Violation detected from the Guardian. |
| Guardian- Same Input/Output Language Detection Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Same Input/Output Language Detection Policy Violation detected from the Guardian. |
| Guardian- Secrets Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Secrets Policy Violation detected from the Guardian. |
| Guardian- Security Integrity Checks Prompt Injection Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Security Integrity Checks Prompt Injection Policy Violation detected from the Guardian. |
| Guardian- Sentiment Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Sentiment Policy Violation detected from the Guardian. |
| Guardian- Special PII Detection Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Special PII Detection Policy Violation detected from the Guardian. |
| AIShield - Tabular classification AI Model Evasion high suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Tabular classification AI Model Evasion high suspicious, high severity vulnerability detected from the AIShield. |
| AIShield - Tabular classification AI Model Evasion low suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Tabular classification AI Model Evasion Low suspicious, medium severity vulnerability detected from the AIShield. |
| AIShield - Tabular classification AI Model extraction high suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Tabular classification AI Model extraction high suspicious, high severity vulnerability detected from the AIShield. |
| AIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Timeseries Forecasting AI Model extraction high suspicious, high severity vulnerability detected from the AIShield. |
| Guardian- Token Limit Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when Token Limit Policy Violation detected from the Guardian. |
| Guardian- URL Detection Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when URL Detection Policy Violation detected from the Guardian. |
| Guardian- URL Reachability Policy Violation Detection | Analytic Rule | 📦 Solution | AIShield AI Security Monitoring | This alert creates an incident when URL Reachability Policy Violation detected from the Guardian. |
| AIShield | Workbook | 📦 Solution | AIShield AI Security Monitoring | |
| GuardianDashboard | Workbook | 📦 Solution | AIShield AI Security Monitoring | |
| AIShield | Parser | 📦 Solution | AIShield AI Security Monitoring | |
| Guardian | Parser | 📦 Solution | AIShield AI Security Monitoring | |
| AkamaiSIEMEvent | Parser | 📦 Solution | Akamai Security Events | |
| AliCloud | Parser | 📦 Solution | Alibaba Cloud | |
| Alsid Active Directory attacks pathways | Analytic Rule | 📦 Solution | Alsid For AD | Searches for triggered Indicators of Exposures related to Active Directory attacks pathways |
| Alsid DCShadow | Analytic Rule | 📦 Solution | Alsid For AD | Searches for DCShadow attacks |
| Alsid DCSync | Analytic Rule | 📦 Solution | Alsid For AD | Searches for DCSync attacks |
| Alsid Golden Ticket | Analytic Rule | 📦 Solution | Alsid For AD | Searches for Golden Ticket attacks |
| Alsid Indicators of Attack | Analytic Rule | 📦 Solution | Alsid For AD | Searches for triggered Indicators of Attack |
| Alsid Indicators of Exposures | Analytic Rule | 📦 Solution | Alsid For AD | Searches for triggered Indicators of Exposures |
| Alsid LSASS Memory | Analytic Rule | 📦 Solution | Alsid For AD | Searches for OS Credentials dumping attacks |
| Alsid Password Guessing | Analytic Rule | 📦 Solution | Alsid For AD | Searches for bruteforce Password Guessing attacks |
| Alsid Password issues | Analytic Rule | 📦 Solution | Alsid For AD | Searches for triggered Indicators of Exposures related to password issues |
| Alsid Password Spraying | Analytic Rule | 📦 Solution | Alsid For AD | Searches for Password spraying attacks |
| Alsid privileged accounts issues | Analytic Rule | 📦 Solution | Alsid For AD | Searches for triggered Indicators of Exposures related to privileged accounts issues |
| Alsid user accounts issues | Analytic Rule | 📦 Solution | Alsid For AD | Searches for triggered Indicators of Exposures related to user accounts issues |
| AlsidIoA | Workbook | 📦 Solution | Alsid For AD | |
| AlsidIoE | Workbook | 📦 Solution | Alsid For AD | |
| afad_parser 🔍 | Parser | 📦 Solution | Alsid For AD | |
| Successful API executed from a Tor exit node | Analytic Rule | 📦 Solution | Amazon Web Services | A successful API execution was detected from an IP address categorized as a TOR exit node by Threat Intelligence. |
| Changes to internet facing AWS RDS Database instances | Analytic Rule | 📦 Solution | Amazon Web Services | Amazon Relational Database Service (RDS) is scalable relational database in the cloud. If your organization have one or more AWS RDS Databases running, monitoring changes to especially internet facing... |
| Changes to Amazon VPC settings | Analytic Rule | 📦 Solution | Amazon Web Services | Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. This identifies chan... |
| Changes made to AWS CloudTrail logs | Analytic Rule | 📦 Solution | Amazon Web Services | Attackers often try to hide their steps by deleting or stopping the collection of logs that could show their activity. This alert identifies any manipulation of AWS CloudTrail, Cloudwatch/EventBridge ... |
| AWS Config Service Resource Deletion Attempts | Analytic Rule | 📦 Solution | Amazon Web Services | Detects attempts to remove a part of the AWS Config Service.The Threat Actor may manipulate the Config services decrease the visibility into the security posture of an account and / or its workload in... |
| Login to AWS Management Console without MFA | Analytic Rule | 📦 Solution | Amazon Web Services | Multi-Factor Authentication (MFA) helps you to prevent credential compromise. This alert identifies logins to the AWS Management Console without MFA. You can limit this detection to trigger for admins... |
| CloudFormation policy created then used for privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new Cloudformation policy and usage of one of the attach policy events (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique ... |
| Creation of CRUD DynamoDB policy and then privilege escalation. | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new CRUD DynamoDB policy and usage of one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation techniq... |
| Creation of new CRUD IAM policy and then privilege escalation. | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new CRUD IAM policy and usage of one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique th... |
| Creation of CRUD KMS policy and then privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new CRUD KMS policy and usage of one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique th... |
| Created CRUD S3 policy and then privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new CRUD S3 policy and afterwards used one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation techni... |
| Creation of CRUD Lambda policy and then privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new CRUD Lambda policy and usage of the attach policy events (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique that attac... |
| Creation of DataPipeline policy and then privilege escalation. | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new Datapipeline policy and usage of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique that ... |
| Creation of EC2 policy and then privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new EC2 policy and afterwards used one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique ... |
| Creation of Glue policy and then privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new Glue policy and usage one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique that atta... |
| Creation of Lambda policy and then privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new Lambda policy and usage of one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique that... |
| Creation of SSM policy and then privilege escalation | Analytic Rule | 📦 Solution | Amazon Web Services | Detected creation of new SSM policy and afterwards used one of the attach policy operations (AttachUserPolicy/AttachRolePolicy/AttachGroupPolicy). This might indicate a privilege escalation technique ... |
| Creating keys with encrypt policy without MFA | Analytic Rule | 📦 Solution | Amazon Web Services | Detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an idicator that your account is compromised and the attacker uses the encryption... |
| Monitor AWS Credential abuse or hijacking | Analytic Rule | 📦 Solution | Amazon Web Services | Looking for GetCallerIdentity Events where the UserID Type is AssumedRole An attacker who has assumed the role of a legitimate account can call the GetCallerIdentity function to determine what account... |
| EC2 Startup Shell Script Changed | Analytic Rule | 📦 Solution | Amazon Web Services | Detects changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref : https://github.com/RhinoSecurityLabs/pacu/blob/master... |
| ECR image scan findings high or critical | Analytic Rule | 📦 Solution | Amazon Web Services | AWS ECR Image scan detected critical or high-severity vulnerabilities in your container image. |
| Automatic image scanning disabled for ECR | Analytic Rule | 📦 Solution | Amazon Web Services | Image Scanning for ECR was disabled, which could lead to missing vulnerable container images in your environment. Attackers could disable the Image Scanning for defense evasion purposes. |
| Full Admin policy created and then attached to Roles, Users or Groups | Analytic Rule | 📦 Solution | Amazon Web Services | Identity and Access Management (IAM) securely manages access to AWS services and resources. Identifies when a policy is created with Full Administrators Access (Allow-Action:*,Resource:*). This poli... |
| GuardDuty detector disabled or suspended | Analytic Rule | 📦 Solution | Amazon Web Services | GuardDuty Detector was disabled or suspended, possibly by an attacker trying to avoid detection of its malicious activities. Verify with the user identity that this activity is legitimate. |
| AWS Guard Duty Alert | Analytic Rule | 📦 Solution | Amazon Web Services | Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.... |
| Changes to AWS Security Group ingress and egress settings | Analytic Rule | 📦 Solution | Amazon Web Services | A Security Group acts as a virtual firewall of an instance to control inbound and outbound traffic. Hence, ingress and egress settings changes to AWS Security Group should be monitored as these can e... |
| Changes to AWS Elastic Load Balancer security groups | Analytic Rule | 📦 Solution | Amazon Web Services | Elastic Load Balancer distributes incoming traffic across multiple instances in multiple availability Zones. This increases the fault tolerance of your applications. Unwanted changes to Elastic Load ... |
| Tampering to AWS CloudTrail logs | Analytic Rule | 📦 Solution | Amazon Web Services | Attackers often try to hide their steps by deleting or stopping the collection of logs that could show their activity. This alert identifies any manipulation of AWS CloudTrail, Cloudwatch/EventBridge... |
| Network ACL with all the open ports to a specified CIDR | Analytic Rule | 📦 Solution | Amazon Web Services | Detected network ACL with all the ports open to a specified CIDR. This could lead to potential lateral movements or initial access attacks. Make sure to mitigate this risk. |
| Suspicious overly permissive KMS key policy created | Analytic Rule | 📦 Solution | Amazon Web Services | An overly permissive key policy was created, resulting in KMS keys where the kms:Encrypt action is accessible to everyone (even outside of the organization). This could mean that your account is compr... |
| Privilege escalation with AdministratorAccess managed policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on AdministratorAccess managed policy. Attackers could use these events for privilege escalation. Verify these actions with the us... |
| Privilege escalation with admin managed policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on admin managed policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation with FullAccess managed policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on FullAccess managed policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via CloudFormation policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on CloudFormation policy. Attackers could use these events for privilege escalation. Verify these actions with the user. |
| Privilege escalation via CRUD DynamoDB policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy by CRUD DynamoDB Policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via CRUD IAM policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy by CRUD IAM policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via CRUD KMS policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy by CRUD KMS policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via CRUD Lambda policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy by CRUD Lambda policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via CRUD S3 policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy by CRUD S3 Policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via DataPipeline policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on Datapipeline policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via EC2 policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on EC2 policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via Glue policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on Glue policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via Lambda policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on Lambda policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| Privilege escalation via SSM policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected usage of AttachUserPolicy/AttachGroupPolicy/AttachRolePolicy on SSM Policy. Attackers could use these operations for privilege escalation. Verify these actions with the user. |
| RDS instance publicly exposed | Analytic Rule | 📦 Solution | Amazon Web Services | Detected publicly exposed RDS instance, which could lead to a leakage of sensitive data. |
| Successful brute force attack on S3 Bucket. | Analytic Rule | 📦 Solution | Amazon Web Services | A successful brute force attack on an S3 bucket was detected. Verify these actions, and if needed, remediate the compromise. |
| S3 bucket access point publicly exposed | Analytic Rule | 📦 Solution | Amazon Web Services | Detected S3 bucket publicly exposed via access point, which could lead to sensitive information leakage to the public. Verify the S3 object configurations. |
| S3 bucket exposed via ACL | Analytic Rule | 📦 Solution | Amazon Web Services | Detected S3 bucket publicly exposed via ACL, which could lead for sensitive information leakage to the public. Verify the S3 object configurations. |
| S3 bucket exposed via policy | Analytic Rule | 📦 Solution | Amazon Web Services | Detected S3 bucket publicly exposed via policy, this could lead for sensitive information leakage to the public. Verify the S3 object configurations. |
| S3 Object Exfiltration from Anonymous User | Analytic Rule | 📦 Solution | Amazon Web Services | Identify attempted exfiltration of S3 Bucket objects by an anonymous User |
| S3 object publicly exposed | Analytic Rule | 📦 Solution | Amazon Web Services | Detected S3 bucket that's publicly exposed, which could lead to sensitive information leakage to the public. Verify the S3 object configurations. |
| S3 bucket suspicious ransomware activity | Analytic Rule | 📦 Solution | Amazon Web Services | Suspicious S3 bucket activity indicating ransomware was detected. An attacker might download all the objects in a compromised S3 bucket, encrypt them with his own key, then upload them back to the sam... |
| SAML update identity provider | Analytic Rule | 📦 Solution | Amazon Web Services | Attackers could update the SAML provider in order to create unauthorized but valid tokens and represent them to services that trust SAML tokens from the environment. These tokens can then be used to a... |
| Policy version set to default | Analytic Rule | 📦 Solution | Amazon Web Services | An attacker with SetDefaultPolicyVersion permissions could escalate privileges through existing policy versions that are not currently in use. More about this API at https://docs.aws.amazon.com/IAM/la... |
| SSM document is publicly exposed | Analytic Rule | 📦 Solution | Amazon Web Services | Detected a SSM document that is publicly exposed, which could lead to sensitive information leakage to the public. Verify the object configurations. |
| Suspicious command sent to EC2 | Analytic Rule | 📦 Solution | Amazon Web Services | An attacker with the necessary permissions could be executing code remotely on a machine and saving the output to his own S3 bucket. Verify this action with the user identity. |
| Unauthorized EC2 Instance Setup Attempt | Analytic Rule | 📦 Solution | Amazon Web Services | A User without access tried to Run an Instance. It might be to launch a malicious Instance in AWS subscription. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-launch-unusu... |
| Creation of Access Key for IAM User | Analytic Rule | 📦 Solution | Amazon Web Services | Establishes persistence by creating an access key on an existing IAM user. This type of action should be validated by Account Admin of AWS Account. Ref : https://stratus-red-team.cloud/attack-techniqu... |
| User IAM Enumeration | Analytic Rule | 📦 Solution | Amazon Web Services | Detects enumeration of accounts configuration via api call to list different instances and services within a short period of time. WL Scanner of Cloud Account such as Wiz and threshold can be adjusted |
| NRT Login to AWS Management Console without MFA | Analytic Rule | 📦 Solution | Amazon Web Services | Multi-Factor Authentication (MFA) helps you to prevent credential compromise. This alert identifies logins to the AWS Management Console without MFA. You can limit this detection to trigger for admini... |
| Suspicious AWS CLI Command Execution | Analytic Rule | 📦 Solution | Amazon Web Services | This detection focuses on identifying potentially suspicious activities involving the execution of AWS Command Line Interface (CLI) commands, particularly focusing on reconnaissance operations. |
| Suspicious AWS EC2 Compute Resource Deployments | Analytic Rule | 📦 Solution | Amazon Web Services | This detection focused on Suspicious deployment of AWS EC2 resource (virtual machine) scale sets was detected. This behavior might indicate that the threat actor is deploying computing resources for c... |
| IAM assume role policy brute force | Hunting Query | 📦 Solution | Amazon Web Services | Several failed "assume role" attempts occurred on existing roles in the account. This could be an attacker trying to escalate privileges and move laterally by assuming roles in a compromised account. ... |
| Bucket versioning suspended | Hunting Query | 📦 Solution | Amazon Web Services | Detected Bucket versioning suspended event. Attackers could use this technique to be able to ransom buckets without the option for the victim to have a backup. |
| New access key created to user | Hunting Query | 📦 Solution | Amazon Web Services | An attacker with the CreateAccessKey permissions on other users can create an access Key ID and secret access key belonging to another user in the AWS environment for privilege escalation. |
| CreateLoginProfile detected | Hunting Query | 📦 Solution | Amazon Web Services | An attacker could use CreateLoginProfile permissions on other users for privilege escalation by creating a password to a victim user without a login profile to use to login to the AWS Console. |
| Suspicious EC2 launched without a key pair | Hunting Query | 📦 Solution | Amazon Web Services | An attacker with limited permissions, or a sophisticated attacker disguising his activity, may have launched an EC2 instance without a key pair, allowing him to execute code on the machine using the U... |
| ECR image scan findings low | Hunting Query | 📦 Solution | Amazon Web Services | AWS ECR Image scan detected low severity vulnerabilities in your container image. |
| ECR image scan findings medium | Hunting Query | 📦 Solution | Amazon Web Services | AWS ECR image scan detected medium severity vulnerabilities in your container image. |
| Excessive execution of discovery events | Hunting Query | 📦 Solution | Amazon Web Services | Several enumeration API calls were executed by the same identity. This could be an attacker trying to enumerate the compromised user/token permissions. Verify with the user identity that this activity... |
| Failed brute force on S3 bucket | Hunting Query | 📦 Solution | Amazon Web Services | Detected failed brute attempt on S3 bucket. If it is not an anonymous principle, verify with the user. |
| Multiple failed login attempts to an existing user without MFA | Hunting Query | 📦 Solution | Amazon Web Services | Failed brute force attempt detected on an existing user without MFA configurations. |
| IAM AccessDenied discovery events | Hunting Query | 📦 Solution | Amazon Web Services | The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery event... |
| Changes made to AWS IAM objects | Hunting Query | 📦 Solution | Amazon Web Services | Identity and Access Management (IAM) securely manages access to AWS services and resources. This query looks for when an API call is made to change an IAM, particularly those related to new objects be... |
| Changes made to AWS IAM policy | Hunting Query | 📦 Solution | Amazon Web Services | This query looks for when an API call is made to change an IAM, particularly those related to new policies being attached to users and roles, as well as changes to access methods and changes to accou... |
| IAM Privilege Escalation by Instance Profile attachment | Hunting Query | 📦 Solution | Amazon Web Services | An instance profile is a container for an IAM role that you can use to pass role information to an EC2 instance when the instance start. Identifies when existing role is removed and new/existing high ... |
| Lambda function throttled | Hunting Query | 📦 Solution | Amazon Web Services | Detected Lambda function throttled. Attacker could use this technique to result in Denial of Service. More about this API at https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionConcurrency.htm... |
| Lambda layer imported from external account | Hunting Query | 📦 Solution | Amazon Web Services | Detected an external account adding lambda layer, which attackers could use to inject a backdoor inside the lambda function. If this is the case, make sure to remove the layer from the function. |
| Lambda UpdateFunctionCode | Hunting Query | 📦 Solution | Amazon Web Services | This analytic is designed to detect an IAM user updating AWS lambda code via AWS CLI to gain persistent, further access into your AWS environment and to facilitate panting backdoors. An attacker may u... |
| Login profile updated | Hunting Query | 📦 Solution | Amazon Web Services | An attacker could use UpdateLoginProfile permissions for privilege escalation by changing the victim user password. More about this API at https://docs.aws.amazon.com/IAM/latest/APIReference/API_Updat... |
| Modification of route-table attributes | Hunting Query | 📦 Solution | Amazon Web Services | An attacker could modify route-table attributes in order to access resources he couldn't access before. |
| Modification of subnet attributes | Hunting Query | 📦 Solution | Amazon Web Services | An attacker could modify subnet attributes in order to access resources he couldn't access before. |
| Modification of vpc attributes | Hunting Query | 📦 Solution | Amazon Web Services | An attacker could modify vpc attributesin order to access resources he couldn't access before. |
| Network ACL deleted | Hunting Query | 📦 Solution | Amazon Web Services | An attacker could delete a network ACL and gain access to an instance from anywhere. Verify this action with the entity. |
| New AccessKey created for Root user | Hunting Query | 📦 Solution | Amazon Web Services | Attackers with the CreateAccessKey permissions for other users can create an access Key ID and secret access key belonging to another user in the AWS environment for privilege escalation. |
| CreatePolicyVersion with excessive permissions | Hunting Query | 📦 Solution | Amazon Web Services | A policy with excessive permissions detected. Attacker could use that policy to escalate privileges and for malicious activities. Verify the policy creation with the entity. |
| Privileged role attached to Instance | Hunting Query | 📦 Solution | Amazon Web Services | Identity and Access Management (IAM) securely manages access to AWS services and resources. Identifies when a Privileged role is attached to an existing instance or new instance at deployment. This i... |
| RDS instance master password changed | Hunting Query | 📦 Solution | Amazon Web Services | Detected change of the RDS Master password. Verify if this was intentional, or if it was caused by a malicious actor. |
| Risky role name created | Hunting Query | 📦 Solution | Amazon Web Services | Detections of risky role names could indicate that a malicious framework was executed in your environment. |
| S3 bucket has been deleted | Hunting Query | 📦 Solution | Amazon Web Services | Detected deletion of a S3 bucket. An attacker could delete S3 objects for impact and Denail of service purposes. |
| S3 bucket encryption modified | Hunting Query | 📦 Solution | Amazon Web Services | Detected modification of bucket encryption. An attacker could modify encryption of existing buckets for denial of service attacks. |
| Suspicious activity of STS token related to EC2 | Hunting Query | 📦 Solution | Amazon Web Services | Suspicious activity of the STS token of an EC2 machine hosted by ECS (for example, by SSRF) indicates a possible token hijacking. An attacker may have stolen the token and could abuse its permissions ... |
| Suspicious activity of STS token related to ECS | Hunting Query | 📦 Solution | Amazon Web Services | Suspicious activity of the STS token of an EC2 machine hosted by ECS (for example, by SSRF) indicates a possible token hijacking. An attacker may have stolen the token and could abuse its permissions ... |
| Suspicious activity of STS token related to Glue | Hunting Query | 📦 Solution | Amazon Web Services | Suspicious activity of the STS token of a Glue endpoint machine hosted by ECS (for example, by SSRF) indicates a possible token hijacking. An attacker may have stolen the token and could abuse its per... |
| Suspicious activity of STS Token related to Kubernetes worker node | Hunting Query | 📦 Solution | Amazon Web Services | Suspicious activity of the STS token of an EC2 machine hosted by EKS (for example, by SSRF) indicates a possible token hijacking. An attacker may have stolen the token and could abuse its permissions ... |
| Suspicious activity of STS token related to Lambda | Hunting Query | 📦 Solution | Amazon Web Services | Suspicious activity of the STS token of a Lambda function (for example, by SSRF) indicates a possible token hijacking. An attacker may have stolen the token and could abuse its permissions to escalate... |
| Suspicious credential token access of valid IAM Roles | Hunting Query | 📦 Solution | Amazon Web Services | Adversaries may generate temporary credentials of existing privileged IAM roles to access AWS resources that were not previously accessible to perform malicious actions. The credentials may be generat... |
| Unused or Unsupported Cloud Regions | Hunting Query | 📦 Solution | Amazon Web Services | Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. R... |
| AmazonWebServicesNetworkActivities | Workbook | 📦 Solution | Amazon Web Services | |
| AmazonWebServicesUserActivities | Workbook | 📦 Solution | Amazon Web Services | |
| Anvilogic Alert | Analytic Rule | 📦 Solution | Anvilogic | Alert generated by Anvilogic. |
| Azure WAF matching for Log4j vuln(CVE-2021-44228) | Analytic Rule | 📦 Solution | Apache Log4j Vulnerability Detection | This query will alert on a positive pattern match by Azure WAF for CVE-2021-44228 log4j vulnerability exploitation attempt. If possible, it then decodes the malicious command for further analysis. Re... |
| Vulnerable Machines related to log4j CVE-2021-44228 | Analytic Rule | 📦 Solution | Apache Log4j Vulnerability Detection | This query uses the Azure Defender Security Nested Recommendations data to find machines vulnerable to log4j CVE-2021-44228. Log4j is an open-source Apache logging library that is used in many Java-ba... |
| Log4j vulnerability exploit aka Log4Shell IP IOC | Analytic Rule | 📦 Solution | Apache Log4j Vulnerability Detection | Identifies a match across various data feeds for IP IOCs related to the Log4j vulnerability exploit aka Log4Shell described in CVE-2021-44228. References: https://cve.mitre.org/cgi-bin/cvename.cgi?na... |
| User agent search for log4j exploitation attempt | Analytic Rule | 📦 Solution | Apache Log4j Vulnerability Detection | This query uses various log sources having user agent data to look for log4j CVE-2021-44228 exploitation attempt based on user agent pattern. Log4j is an open-source Apache logging library that is use... |
| Possible exploitation of Apache log4j component detected | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | Query detects remote code execution vulnerability in the Log4j component of Apache. Attackers may attempt to launch arbitrary code by passing specific commands to a server, which are then logged and e... |
| Suspicious Base64 download activity detected | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | Query detects Base64 obfuscated scripts for malicious file execution. This technique is used by attackers to exploit a remote code execution vulnerability in the Apache Log4j to evade detection. |
| Possible Container Miner related artifacts detected | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | Query uses syslog data to alert on artifacts from container images used in digital cryptocurrency mining, often seen post Log4j vulnerability (CVE-2021-44228) exploitation. |
| Suspicious manipulation of firewall detected via Syslog data | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | This query searches for any suspicious manipulation of firewall often performed by attackers after exploiting remote code execution vulnerability in Log4j component of Apache for C2 communications or ... |
| Possible Linux attack toolkit detected via Syslog data | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | This query searches for usage of attack toolkits associated with massive scanning or exploitation of remote code execution vulnerability in Log4j component of Apache. |
| Malicious Connection to LDAP port for CVE-2021-44228 vulnerability | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | This query detects exploitation attempts for CVE-2021-44228 involving log4j vulnerability by looking for connections to default LDAP ports. |
| Network Connection to New External LDAP Server | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | This query detects outbound network connections using the LDAP protocol to external IP addresses that have not had an LDAP network connection in the past 14 days. This could indicate exploitation of C... |
| Linux security related process termination activity detected | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | This query alerts on attempts to terminate security monitoring processes on the host. Attackers often try to terminate such processes post-compromise to exploit the Log4j vulnerability. |
| Suspicious Shell script detected | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | This query detects post-compromise suspicious shell scripts that attackers use for downloading and executing malicious files. This technique is often used by attackers and was recently used to exploit... |
| Azure WAF Log4j CVE-2021-44228 hunting | Hunting Query | 📦 Solution | Apache Log4j Vulnerability Detection | This hunting query searches possible exploitation attempts for CVE-2021-44228 involving log4j vulnerability in Azure Web Application Firewall logs. |
| Log4jImpactAssessment | Workbook | 📦 Solution | Apache Log4j Vulnerability Detection | |
| Log4jPostCompromiseHunting | Workbook | 📦 Solution | Apache Log4j Vulnerability Detection | |
| Log4jIndicatorProcessor | Playbook | 📦 Solution | Apache Log4j Vulnerability Detection | These playbooks automate the ingest of threat indicators into the ThreatIntelligenceIndicator table of an Microsoft Sentinel workspace. Sample data for Log4j IOC can be found at https://raw.githubuser... |
| Apache - Command in URI | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects command in URI |
| Apache - Apache 2.4.49 flaw CVE-2021-41773 | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects using Apache 2.4.49 flaw CVE-2021-41773 |
| Apache - Known malicious user agent | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects known malicious user agents |
| Apache - Multiple client errors from single IP | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects multiple client errors from one source in short timeframe |
| Apache - Multiple server errors from single IP | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects multiple server errors from one source in short timeframe |
| Apache - Private IP in URL | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects requests to unusual URL |
| Apache - Put suspicious file | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects PUT or POST of suspicious file |
| Apache - Request from private IP | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects requests from private IP |
| Apache - Requests to rare files | Analytic Rule | 📦 Solution | ApacheHTTPServer | Shows requests to rare files |
| Apache - Request to sensitive files | Analytic Rule | 📦 Solution | ApacheHTTPServer | Detects request to sensitive files. |
| Apache - Top files requested with errors | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows list of files with error requests. |
| Apache - Top Top files requested | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows list of files requested |
| Apache - Rare files requested | Hunting Query | 📦 Solution | ApacheHTTPServer | Query detects rare files requested |
| Apache - Rare user agents with client errors | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows rare user agent strings with client errors |
| Apache - Rare URLs requested | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows rare URLs requested. |
| Apache - Rare user agents | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows rare user agents |
| Apache - Requests to unexisting files | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows list of requests to unexisting files |
| Apache - Unexpected Post Requests | Hunting Query | 📦 Solution | ApacheHTTPServer | Query detects Unexpected Post Requests |
| Apache - Top URLs with client errors | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows URLs list with client errors. |
| Apache - Top URLs with server errors | Hunting Query | 📦 Solution | ApacheHTTPServer | Query shows URLs list with server errors. |
| ApacheHTTPServer | Workbook | 📦 Solution | ApacheHTTPServer | |
| ApacheHTTPServer | Parser | 📦 Solution | ApacheHTTPServer | |
| ARGOS Cloud Security - Exploitable Cloud Resources | Analytic Rule | 📦 Solution | ARGOSCloudSecurity | Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment. |
| ARGOSCloudSecurityWorkbook | Workbook | 📦 Solution | ARGOSCloudSecurity | |
| Awake Security - High Match Counts By Device | Analytic Rule | 📦 Solution | AristaAwakeSecurity | This query searches for devices with unexpectedly large number of activity match. |
| Awake Security - High Severity Matches By Device | Analytic Rule | 📦 Solution | AristaAwakeSecurity | This query searches for devices with high severity event(s). |
| Awake Security - Model With Multiple Destinations | Analytic Rule | 📦 Solution | AristaAwakeSecurity | This query searches for devices with multiple possibly malicious destinations. |
| AristaAwakeSecurityWorkbook | Workbook | 📦 Solution | AristaAwakeSecurity | |
| Armis Update Alert Status | Playbook | 📦 Solution | Armis | Armis Update Alert Status playbook would be responsible to update the Alert status from the sentinel to the Armis Portal |
| ArmisActivities | Parser | 📦 Solution | Armis | |
| ArmisAlerts | Parser | 📦 Solution | Armis | |
| ArmisDevice | Parser | 📦 Solution | Armis | |
| Armorblox Needs Review Alert | Analytic Rule | 📦 Solution | Armorblox | This rule generates an alert for an Armorblox incident where the remediation action is "Needs Review". |
| ArmorbloxOverview | Workbook | 📦 Solution | Armorblox | |
| Needs-Review-Incident-Email-Notification | Playbook | 📦 Solution | Armorblox | This playbook will send an email notification when a new incident is created in Microsoft Sentinel. |
| ArubaClearPass | Parser | 📦 Solution | Aruba ClearPass | |
| ConfluenceAudit | Parser | 📦 Solution | AtlassianConfluenceAudit | |
| Jira - Global permission added | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when global permission added. |
| Jira - New site admin user | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects new site admin user. |
| Jira - New user created | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when new user was created. |
| Jira - Permission scheme updated | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when permission scheme was updated. |
| Jira - New site admin user | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects new site admin user. |
| Jira - Project roles changed | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when project roles were changed. |
| Jira - User's password changed multiple times | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when user's password was changed multiple times from different IP addresses. |
| Jira - User removed from group | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when a user was removed from group. |
| Jira - User removed from project | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when a user was removed from project. |
| Jira - Workflow scheme copied | Analytic Rule | 📦 Solution | AtlassianJiraAudit | Detects when workflow scheme was copied. |
| Jira - Blocked tasks | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for blocked tasks. |
| Jira - New users | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for new users created. |
| Jira - Project versions released | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for project versions released. |
| Jira - Updated projects | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for updated projects. |
| Jira - Project versions | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for project versions. |
| Jira - Updated users | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for updated users. |
| Jira - Updated workflows | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for updated workflows. |
| Jira - Updated workflow schemes | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for updated workflow schemes. |
| Jira - Users' IP addresses | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for users' IP addresses. |
| Jira - Workflow schemes added to projects | Hunting Query | 📦 Solution | AtlassianJiraAudit | Query searches for workflow schemes added to projects. |
| AtlassianJiraAudit | Workbook | 📦 Solution | AtlassianJiraAudit | |
| Sync Jira to Sentinel - public comments | Playbook | 📦 Solution | AtlassianJiraAudit | This Playbook will sync the public comments from JIRA to Microsoft Sentinel. |
| Create And Update Jira Issue | Playbook | 📦 Solution | AtlassianJiraAudit | This playbook will create or update incident in Jira. When incident is created, playbook will run and create issue in Jira. When incident is updated, playbook will run and add update to comment sectio... |
| Sync Jira to Sentinel - Assigned User | Playbook | 📦 Solution | AtlassianJiraAudit | This Playbook will sync the assigned user from JIRA to Microsoft Sentinel. |
| Sync Jira from Sentinel - Create incident | Playbook | 📦 Solution | AtlassianJiraAudit | This Playbook will create JIRA incidents for every Microsoft Sentinel which is created. It includes additional information such as tactics, affected user etc. |
| Sync Jira to Sentinel - Status | Playbook | 📦 Solution | AtlassianJiraAudit | This Playbook will sync the status from JIRA to Microsoft Sentinel. |
| Create Jira Issue alert-trigger | Playbook | 📦 Solution | AtlassianJiraAudit | This playbook will open a Jira Issue when a new incident is opened in Microsoft Sentinel. |
| Create Jira Issue incident-trigger | Playbook | 📦 Solution | AtlassianJiraAudit | This playbook will open a Jira Issue when a new incident is opened in Microsoft Sentinel. |
| JiraAudit | Parser | 📦 Solution | AtlassianJiraAudit | |
| Probable AdFind Recon Tool Usage | Analytic Rule | 📦 Solution | Attacker Tools Threat Protection Essentials | This query identifies the host and account that executed AdFind, by hash and filename, in addition to the flags commonly utilized by various threat actors during the reconnaissance phase. |
| Credential Dumping Tools - Service Installation | Analytic Rule | 📦 Solution | Attacker Tools Threat Protection Essentials | This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz. |
| Credential Dumping Tools - File Artifacts | Analytic Rule | 📦 Solution | Attacker Tools Threat Protection Essentials | This query detects the creation of credential dumping tools files. Several credential dumping tools export files with hardcoded file names. Ref: https://jpcertcc.github.io/ToolAnalysisResultSheet/ |
| Powershell Empire Cmdlets Executed in Command Line | Analytic Rule | 📦 Solution | Attacker Tools Threat Protection Essentials | This query identifies use of PowerShell Empire's cmdlets within the command line data of the PowerShell process, indicating potential use of the post-exploitation tool. |
| Cobalt Strike DNS Beaconing | Hunting Query | 📦 Solution | Attacker Tools Threat Protection Essentials | Cobalt Strike is a famous Pen Test tool that is used by pen testers as well as attackers alike To compromise an environment. The query tries to detect suspicious DNS queries known from Cobalt Strike... |
| Potential Impacket Execution | Hunting Query | 📦 Solution | Attacker Tools Threat Protection Essentials | This hunting query identifies execution of Impacket tool. Impacket is a popular tool used by attackers for remote service execution, Kerberos manipulation and Windows credential dumping. |
| AusCtisExportTaggedIndicators | Playbook | 📦 Solution | Australian Cyber Security Centre | This playbook gets triggered every hour and perform the following actions: 1. Get all the threat intelligence indicators from Microsoft Sentinel Workspace with given tag. 2. Filter all the indicators ... |
| Auth0 | Parser | 📦 Solution | Auth0 | |
| Auth0AM | Parser | 📦 Solution | Auth0 | |
| Access to AWS without MFA | Analytic Rule | 📦 Solution | Authomize | This detects users with access to AWS (IAM or Federated via Okta) without enabled MFA. This is a default definition by Authomize and can be updated using the edit modal. |
| Admin password not updated in 30 days | Analytic Rule | 📦 Solution | Authomize | The policy detects an administrative account where the password of the account was not updated in the last 30 days. |
| Admin SaaS account detected | Analytic Rule | 📦 Solution | Authomize | The rule detects internal admins accounts, it's recommended to review any new administrative permission. |
| AWS role with admin privileges | Analytic Rule | 📦 Solution | Authomize | The policy detects the creation of new AWS roles with administrative privileges. The policy configuration allows limiting the policy to specific accounts. |
| AWS role with shadow admin privileges | Analytic Rule | 📦 Solution | Authomize | The policy detect the creation of new AWS roles with shadow admin privileges. The policy configuration allows limiting the policy to specific accounts. |
| Lateral Movement Risk - Role Chain Length | Analytic Rule | 📦 Solution | Authomize | The policy detects chains of more than 3 roles in the account, this is a misconfiguration that can enable lateral movement. |
| Detect AWS IAM Users | Analytic Rule | 📦 Solution | Authomize | The policy detects IAM users across your AWS accounts, a practice that should be kept only for a small number of accounts. This is a default definition by Authomize and can be updated using the edit m... |
| Empty group with entitlements | Analytic Rule | 📦 Solution | Authomize | The rule detects empty groups with entitlements. |
| IaaS admin detected | Analytic Rule | 📦 Solution | Authomize | The policy detects admin users in AWS or Azure. |
| IaaS policy not attached to any identity | Analytic Rule | 📦 Solution | Authomize | The rule detects AWS policies that are not attached to any identities, meaning they can be deleted. |
| IaaS shadow admin detected | Analytic Rule | 📦 Solution | Authomize | The policy detects shadow admin users in AWS or Azure. |
| New direct access policy was granted against organizational policy | Analytic Rule | 📦 Solution | Authomize | This policy detects when access was granted directly (not via groups). This policy is defined by default by Authomize to track AWS only. It is possible to edit the existing policy or create more versi... |
| New service account gained access to IaaS resource | Analytic Rule | 📦 Solution | Authomize | This policy detects when an application or service account gained new access to your assets. This policy is defined by Authomize and can be edited to change the configuration. |
| Password Exfiltration over SCIM application | Analytic Rule | 📦 Solution | Authomize | This rule detects suspicious sync events that occurred to applications using SCIM for user provisioning. |
| Privileged Machines Exposed to the Internet | Analytic Rule | 📦 Solution | Authomize | These are AWS Ec2 machines that are exposed to the internet. You can further filter by tags so that you can, for example, find exposed machines that are also "privileged". |
| Refactor AWS policy based on activities in the last 60 days | Analytic Rule | 📦 Solution | Authomize | This is a recommended update to IAM policy on AWS. Review the policy and apply it according to change control process. Authomize will have a recommended policy to be downloaded. |
| Stale AWS policy attachment to identity | Analytic Rule | 📦 Solution | Authomize | The policy detects 'AWS policies' attached to IAM users or roles that have not used it during the last X days. It is recommended to remove unused policies from identities to reduce risk. |
| Stale IAAS policy attachment to role | Analytic Rule | 📦 Solution | Authomize | The rule detects 'IaaS policies' attached to a role that has not used them during the past X days. It is recommended to remove unused policies from identities to reduce risk. |
| Unused IaaS Policy | Analytic Rule | 📦 Solution | Authomize | The policy detects 'IaaS policies' that no one in the account has been using during the last X days. |
| User assigned to a default admin role | Analytic Rule | 📦 Solution | Authomize | The policy detects users that were assigned to one of the systems default admin roles. |
| User without MFA | Analytic Rule | 📦 Solution | Authomize | The policy detects user accounts without mutli-factor authentication |
| Admin SaaS account detected | Hunting Query | 📦 Solution | Authomize | detects internal admins accounts, it's recommended to review any new administrative permission. |
| ateral Movement Risk - Role Chain Length | Hunting Query | 📦 Solution | Authomize | detects chains of more than 3 roles in the account, this is a misconfiguration that can enable lateral movement. |
| IaaS admin detected | Hunting Query | 📦 Solution | Authomize | detects admin users in AWS or Azure. |
| IaaS shadow admin detected | Hunting Query | 📦 Solution | Authomize | detects shadow admin users in AWS or Azure. |
| Password Exfiltration over SCIM application | Hunting Query | 📦 Solution | Authomize | detects suspicious sync events that occurred to applications using SCIM for user provisioning. |
| Privileged Machines Exposed to the Internet | Hunting Query | 📦 Solution | Authomize | detects AWS instances which are exposed to the internet and can assume privileged roles. This is a default definition by Authomize and can be updated using the edit model. |
| Authomize | Workbook | 📦 Solution | Authomize | |
| AWSALBAccessLogsData | Parser | 📦 Solution | AWS ELB | |
| AWSELBFlowLogsData | Parser | 📦 Solution | AWS ELB | |
| AWSNLBAccessLogsData | Parser | 📦 Solution | AWS ELB | |
| AWS Security Hub - Detect CloudTrail trails lacking KMS encryption | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects AWS CloudTrail trails that are not configured to use server-side encryption with a customer managed KMS key using AWS Security Hub control CloudTrail.2 findings. Unencrypted CloudT... |
| AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects EC2 Security Groups that allow unrestricted (0.0.0.0/0 or ::/0) ingress to high-risk ports using AWS Security Hub control EC2.19 findings. Publicly exposed management, database, and... |
| AWS Security Hub - Detect IAM Policies allowing full administrative privileges | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects AWS IAM policies that allow full administrative ("*") privileges in violation of AWS Security Hub control IAM.1. Overly permissive policies increase the risk of privilege escalation... |
| AWS Security Hub - Detect root user lacking MFA | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings. Lack of MFA on the root user increases the r... |
| AWS Security Hub - Detect IAM root user Access Key existence | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be remo... |
| AWS Security Hub - Detect SQS Queue lacking encryption at rest | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects Amazon SQS queues without server-side encryption at rest enabled, using AWS Security Hub control SQS.1 findings. Lack of encryption for SQS queues can expose sensitive message conte... |
| AWS Security Hub - Detect SQS Queue policy allowing public access | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects Amazon SQS queues with access policies that allow public (unauthenticated or cross-account unrestricted) access, using AWS Security Hub control SQS.3 findings. Publicly accessible q... |
| AWS Security Hub - Detect SSM documents public sharing enabled | Analytic Rule | 📦 Solution | AWS Security Hub | This query detects AWS accounts where public sharing is enabled, using AWS Security Hub control SSM.7 findings. Allowing public sharing of SSM documents can expose automation content and enable unauth... |
| AWS Security Hub - CloudTrail trails without log file validation | Hunting Query | 📦 Solution | AWS Security Hub | This query finds CloudTrail trails with log file validation disabled using AWS Security Hub findings. |
| AWS Security Hub - EC2 instances with public IPv4 address | Hunting Query | 📦 Solution | AWS Security Hub | This query finds EC2 instances that have a public IPv4 address using AWS Security Hub findings (control EC2.9). |
| AWS Security Hub - IAM users with console password and no MFA | Hunting Query | 📦 Solution | AWS Security Hub | This query identifies IAM users in AWS Security Hub findings (control IAM.5) who have a console password but do not have multi-factor authentication (MFA) enabled. |
| AWS Systems Manager - Get Missing Patches for EC2 Instances | Playbook | 📦 Solution | AWS Systems Manager | When an incident is created in Microsoft Sentinel, this playbook gets triggered and perform the following actions: 1. Get the Hostnames and Private IP addresses from incident entities. 2. Get the Inst... |
| AWS Systems Manager - Get Missing Patches for EC2 Instances for given Hostname | Playbook | 📦 Solution | AWS Systems Manager | The playbook can be triggered manually from a Host Entity to get the missing patches on a managed EC2 instance. This playbook performs the following actions: 1. Get the Hostname from the Host Entity. ... |
| AWS Systems Manager - Get Missing Patches for EC2 Instances for given Private IP | Playbook | 📦 Solution | AWS Systems Manager | The playbook can be triggered manually from an IP Entity to get the missing patches on a managed EC2 instance. This playbook performs the following actions: Get the Private IP from the IP Entity. 2. G... |
| AWS Systems Manager - Run Automation Runbook | Playbook | 📦 Solution | AWS Systems Manager | When a new sentinel incident is created, this playbook gets triggered and runs the specified AWS Systems Manager Automation Runbook. The playbook will wait for the runbook execution to complete and th... |
| AWS Systems Manager - Stop Managed EC2 Instances | Playbook | 📦 Solution | AWS Systems Manager | This playbook can be used by SOC Analysts to stop malicious or compromised EC2 instances in AWS. This playbook uses AWS Systems Manager API to stop the EC2 instances. The playbook can be triggered fro... |
| AWS Systems Manager - Stop Managed EC2 Instances Host Entity Trigger | Playbook | 📦 Solution | AWS Systems Manager | This playbook can be used by SOC Analysts to stop malicious or compromised EC2 instances in AWS. The playbook can be triggered from a Host entity context in an incident. The playbook takes the Hostnam... |
| AWS Systems Manager - Stop Managed EC2 Instances IP Entity Trigger | Playbook | 📦 Solution | AWS Systems Manager | This playbook can be used by SOC Analysts to stop malicious or compromised EC2 instances in AWS. The playbook can be triggered from an IP entity context in an incident. The playbook takes the private ... |
| AWS - Disable S3 Bucket Public Access | Playbook | 📦 Solution | AWS_IAM | This playbook disables public access AWS S3 bucket. It is triggered by an incident in Microsoft Sentinel and perform the following actions: 1. Get the Bucket Name from incident entities. 2. Call the A... |
| AWS IAM - Add tag to user | Playbook | 📦 Solution | AWS_IAM | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets users from the incident. 2. [Adds tag](https://docs.aws.amazon.com/IAM/lates... |
| AWS IAM - Delete access keys | Playbook | 📦 Solution | AWS_IAM | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets users from the incident. 2. [Get list of access keys](https://docs.aws.amazo... |
| AWS IAM - Enrich incident with user info | Playbook | 📦 Solution | AWS_IAM | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets users from the incident. 2. Obtains information about users in AWS IAM. 3. A... |
| AWS Athena - Execute Query and Get Results | Playbook | 📦 Solution | AWSAthena | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. It executes the query specified during playbook setup on given database. 2. Downloads the q... |
| Microsoft Entra ID Hybrid Health AD FS New Server | Analytic Rule | 📦 Solution | Azure Activity | This detection uses AzureActivity logs (Administrative category) to identify the creation or update of a server instance in an Microsoft Entra ID Hybrid Health AD FS service. A threat actor can create... |
| Microsoft Entra ID Hybrid Health AD FS Service Delete | Analytic Rule | 📦 Solution | Azure Activity | This detection uses AzureActivity logs (Administrative category) to identify the deletion of an Microsoft Entra ID Hybrid Health AD FS service instance in a tenant. A threat actor can create a new AD ... |
| Microsoft Entra ID Hybrid Health AD FS Suspicious Application | Analytic Rule | 📦 Solution | Azure Activity | This detection uses AzureActivity logs (Administrative category) to identify a suspicious application adding a server instance to an Microsoft Entra ID Hybrid Health AD FS service or deleting the AD F... |
| Suspicious number of resource creation or deployment activities | Analytic Rule | 📦 Solution | Azure Activity | Indicates when an anomalous number of VM creations or deployment activities occur in Azure via the AzureActivity log. This query generates the baseline pattern of cloud resource creation by an individ... |
| Creation of expensive computes in Azure | Analytic Rule | 📦 Solution | Azure Activity | Identifies the creation of large size or expensive VMs (with GPUs or with a large number of virtual CPUs) in Azure. An adversary may create new or update existing virtual machines to evade defenses or... |
| Suspicious granting of permissions to an account | Analytic Rule | 📦 Solution | Azure Activity | Identifies IPs from which users grant access to other users on Azure resources and alerts when a previously unseen source IP address is used. |
| Azure Machine Learning Write Operations | Analytic Rule | 📦 Solution | Azure Activity | Shows the most prevalent users who perform write operations on Azure Machine Learning resources. List the common source IP address for each of those accounts. If an operation is not from those IP addr... |
| New CloudShell User | Analytic Rule | 📦 Solution | Azure Activity | Identifies when a user creates an Azure CloudShell for the first time. Monitor this activity to ensure only the expected users are using CloudShell. |
| Suspicious Resource deployment | Analytic Rule | 📦 Solution | Azure Activity | Identifies when a rare Resource and ResourceGroup deployment occurs by a previously unseen caller. |
| NRT Microsoft Entra ID Hybrid Health AD FS New Server | Analytic Rule | 📦 Solution | Azure Activity | This detection uses AzureActivity logs (Administrative category) to identify the creation or update of a server instance in an Microsoft Entra ID Hybrid Health AD FS service. A threat actor can create... |
| NRT Creation of expensive computes in Azure | Analytic Rule | 📦 Solution | Azure Activity | Identifies the creation of large size or expensive VMs (with GPUs or with a large number of virtual CPUs) in Azure. An adversary may create new or update existing virtual machines to evade defenses or... |
| Rare subscription-level operations in Azure | Analytic Rule | 📦 Solution | Azure Activity | This query looks for a few sensitive subscription-level events based on Azure Activity Logs. For example, this monitors for the operation name 'Create or Update Snapshot', which is used for creating b... |
| Subscription moved to another tenant | Analytic Rule | 📦 Solution | Azure Activity | This detection uses AzureActivity logs (Security category) to identify when a subscription is moved to another tenant. A threat actor may move a subscription into their own tenant to circumvent local ... |
| Mass Cloud resource deletions Time Series Anomaly | Analytic Rule | 📦 Solution | Azure Activity | This query generates the baseline pattern of cloud resource deletions by an individual and generates an anomaly when any unusual spike is detected. These anomalies from unusual or privileged users cou... |
| Microsoft Sentinel Analytics Rules Administrative Operations | Hunting Query | 📦 Solution | Azure Activity | Identifies Microsoft Sentinel Analytics Rules administrative operations |
| Anomalous Azure Operation Hunting Model | Hunting Query | 📦 Solution | Azure Activity | This query identifies Azure Operation anomalies during threat hunts. It detects new callers, IPs, IP ranges, and anomalous operations. Initially set for Run Command operations, it can be configured fo... |
| Azure storage key enumeration | Hunting Query | 📦 Solution | Azure Activity | Azure's storage key listing can expose secrets, PII, and grant VM access. Monitoring for anomalous accounts or IPs is crucial. The query generates IP clusters, correlates activities, and flags unexpec... |
| AzureActivity Administration From VPS Providers | Hunting Query | 📦 Solution | Azure Activity | Looks for administrative actions in AzureActivity from known VPS provider network ranges. This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed... |
| Azure Network Security Group NSG Administrative Operations | Hunting Query | 📦 Solution | Azure Activity | Identifies a set of Azure NSG administrative and operational detection queries for hunting activities. |
| Azure VM Run Command executed from Azure IP address | Hunting Query | 📦 Solution | Azure Activity | Identifies any Azure VM Run Command operation executed from an Azure IP address. Run Command allows an attacker or legitimate user to execute arbitrary PowerShell on a target VM. This technique has be... |
| Microsoft Sentinel Connectors Administrative Operations | Hunting Query | 📦 Solution | Azure Activity | Identifies a set of Microsoft Sentinel Data Connectors for administrative and operational detection queries for hunting activities. |
| Microsoft Sentinel Workbooks Administrative Operations | Hunting Query | 📦 Solution | Azure Activity | Identifies set of Microsoft Sentinel Workbooks administrative operational detection queries for hunting activites |
| Azure Virtual Network Subnets Administrative Operations | Hunting Query | 📦 Solution | Azure Activity | Identifies a set of Azure Virtual Network Subnets for administrative and operational detection queries for hunting activities. |
| Common deployed resources | Hunting Query | 📦 Solution | Azure Activity | This query identifies common deployed resources in Azure, like resource names and groups. It can be used with other suspicious deployment signals to evaluate if a resource is commonly deployed or uniq... |
| Creation of an anomalous number of resources | Hunting Query | 📦 Solution | Azure Activity | Looks for anomalous number of resources creation or deployment activities in azure activity log. It is best to run this query on a look back period which is at least 7 days. |
| Granting permissions to account | Hunting Query | 📦 Solution | Azure Activity | Shows the most prevalent users who grant access to others on Azure resources. List the common source IP address for each of those accounts. If an operation is not from those IP addresses, it may be wo... |
| Azure Machine Learning Write Operations | Hunting Query | 📦 Solution | Azure Activity | Shows the most prevalent users who perform write operations on Azure Machine Learning resources. List the common source IP address for each of those accounts. If an operation is not from those IP addr... |
| Port opened for an Azure Resource | Hunting Query | 📦 Solution | Azure Activity | Identifies what ports may have been opened for a given Azure Resource over the last 7 days |
| Rare Custom Script Extension | Hunting Query | 📦 Solution | Azure Activity | The Custom Script Extension in Azure executes scripts on VMs, useful for post-deployment tasks. Scripts can be from various sources and could be used maliciously. The query identifies rare custom scri... |
| AzureActivity | Workbook | 📦 Solution | Azure Activity | |
| AzureServiceHealthWorkbook | Workbook | 📦 Solution | Azure Activity | |
| Palo Alto - potential beaconing detected | Analytic Rule | 📦 Solution | Azure Cloud NGFW By Palo Alto Networks | Identifies beaconing patterns from Palo Alto Network traffic logs based on recurrent timedelta patterns. The query leverages various KQL functions to calculate time deltas and then compares it with to... |
| CloudNGFW By Palo Alto Networks - possible internal to external port scanning | Analytic Rule | 📦 Solution | Azure Cloud NGFW By Palo Alto Networks | Identifies a list of internal Source IPs (10.x.x.x Hosts) that have triggered 10 or more non-graceful tcp server resets from one or more Destination IPs which results in an "app = incomplete" designat... |
| CloudNGFW By Palo Alto Networks - Threat signatures from Unusual IP addresses | Analytic Rule | 📦 Solution | Azure Cloud NGFW By Palo Alto Networks | Identifies Palo Alto Threat signatures from unusual IP addresses which are not historically seen. This detection is also leveraged and required for MDE and PAN Fusion scenario https://docs.microsoft.... |
| Palo Alto - high-risk ports | Hunting Query | 📦 Solution | Azure Cloud NGFW By Palo Alto Networks | Identifies network connections whose ports are frequent targets of attacks and should not cross network boundaries or reach untrusted public networks. Consider updating the firewall policies to block ... |
| Palo Alto - potential beaconing detected | Hunting Query | 📦 Solution | Azure Cloud NGFW By Palo Alto Networks | Identifies beaconing patterns from PAN traffic logs based on recurrent timedelta patterns. Reference Blog:https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/detect-network-beaconing-via-i... |
| CloudNGFW-NetworkThreat | Workbook | 📦 Solution | Azure Cloud NGFW By Palo Alto Networks | |
| CloudNGFW-Overview | Workbook | 📦 Solution | Azure Cloud NGFW By Palo Alto Networks | |
| DDoS Attack IP Addresses - Percent Threshold | Analytic Rule | 📦 Solution | Azure DDoS Protection | Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation |
| DDoS Attack IP Addresses - PPS Threshold | Analytic Rule | 📦 Solution | Azure DDoS Protection | Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation |
| AzDDoSStandardWorkbook | Workbook | 📦 Solution | Azure DDoS Protection | |
| Abnormal Deny Rate for Source IP | Analytic Rule | 📦 Solution | Azure Firewall | Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, ... |
| Abnormal Port to Protocol | Analytic Rule | 📦 Solution | Azure Firewall | Identifies communication for well known protocol over a non-standard port based on learning period activity. This can indicate malicious communication (C2) or exfiltration by attackers trying to commu... |
| DDoS attack detected | Analytic Rule | 📦 Solution | Azure Firewall | Identifies DDoS attack in Azure Firewall IDPS logs. |
| Elevation of Privilege attempt detected | Analytic Rule | 📦 Solution | Azure Firewall | Identifies Elevation of Privilege attempt Azure Firewall IDPS logs. |
| High severity malicious activity detected | Analytic Rule | 📦 Solution | Azure Firewall | Identifies high severity malicious activity in Azure Firewall IDPS logs. |
| Medium severity malicious activity detected | Analytic Rule | 📦 Solution | Azure Firewall | Identifies medium severity malicious activity in Azure Firewall IDPS logs. |
| Multiple Sources Affected by the Same TI Destination | Analytic Rule | 📦 Solution | Azure Firewall | Identifies multiple machines trying to reach out to the same destination blocked by TI in Azure Firewall. This can indicate attack on the organization by the same attack group. Configurable Parameter... |
| Port Scan | Analytic Rule | 📦 Solution | Azure Firewall | Identifies a source IP scanning multiple open ports on Azure Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be comprom... |
| Port Sweep | Analytic Rule | 📦 Solution | Azure Firewall | Identifies a source IP scanning same open ports on the Azure Firewall IPs. This can indicate malicious scanning of port by an attacker, trying to reveal IPs with specific ports open in the organizatio... |
| Web Application attack detected | Analytic Rule | 📦 Solution | Azure Firewall | Identifies Web application attack in Azure Firewall IDPS logs. |
| Several deny actions registered | Analytic Rule | 📦 Solution | Azure Firewall | Identifies attack pattern when attacker tries to move, or scan, from resource to resource on the network and creates an incident when a source has more than 1 registered deny action in Azure Firewall. |
| First Time Source IP to Destination Using Port | Hunting Query | 📦 Solution | Azure Firewall | Identifies the first time a source IP communicates with a destination using a specific port based on learning period activity. Configurable Parameters: - Learning period time - learning period for th... |
| First Time Source IP to Destination | Hunting Query | 📦 Solution | Azure Firewall | Identifies the first time a source IP communicates with a destination based on a configurable learning period. Configurable Parameters: - Learning period time - learning period for threshold calculati... |
| Source IP Abnormally Connects to Multiple Destinations | Hunting Query | 📦 Solution | Azure Firewall | Identifies source IP that abnormally connects to multiple destinations according to learning period activity. This can indicate initial access attempts by attackers, trying to jump between different m... |
| Uncommon Port for Organization | Hunting Query | 📦 Solution | Azure Firewall | Identifies abnormal ports used in the organization based on learning period activity. This can indicate exfiltration attack or C2 control from machines in the organization by using new a port that has... |
| Uncommon Port to IP | Hunting Query | 📦 Solution | Azure Firewall | Identifies abnormal ports used by machines to connect to a destination IP based on learning period activity. This can indicate exfiltration attack or C2 control from machines in the organization by us... |
| AzureFirewallWorkbook-StructuredLogs | Workbook | 📦 Solution | Azure Firewall | |
| AzureFirewallWorkbook | Workbook | 📦 Solution | Azure Firewall | |
| Azure Firewall - Add IP Address to Threat Intel Allow list | Playbook | 📦 Solution | Azure Firewall | This playbook allows the SOC to automatically response to Microsoft Sentinel incidents which includes IPs, by adding the IPs to the TI Allow list in Azure Firewall Policy. |
| BlockIP-Azure Firewall New Rule | Playbook | 📦 Solution | Azure Firewall | This playbook uses the Azure Firewall connector to add IP Address to the Deny Network Rules collection based on the Microsoft Sentinel Incident |
| Block IP - Azure Firewall IP groups | Playbook | 📦 Solution | Azure Firewall | This playbook allows blocking/allowing IPs in Azure Firewall. It allows to make changes on IP groups, which are attached to rules, instead of make direct changes on Azure Firewall. It also allows usin... |
| Block IP - Azure Firewall IP groups - Entity trigger | Playbook | 📦 Solution | Azure Firewall | This playbook interacts with relevant stackholders, such incident response team, to approve blocking/allowing IPs in Azure Firewall. Playbook also involves TI statistics from VirusTotal. It allows to ... |
| BlockIP-Azure Firewall New Rule - Entity trigger | Playbook | 📦 Solution | Azure Firewall | This playbook uses the Azure Firewall connector to add IP Address to the Deny Network Rules collection based on the Microsoft Sentinel Incident |
| Mass secret retrieval from Azure Key Vault | Analytic Rule | 📦 Solution | Azure Key Vault | Identifies mass secret retrieval from Azure Key Vault observed by a single user. Mass secret retrival crossing a certain threshold is an indication of credential dump operations or mis-configured app... |
| Sensitive Azure Key Vault operations | Analytic Rule | 📦 Solution | Azure Key Vault | Identifies when sensitive Azure Key Vault operations are used. This includes: VaultDelete, KeyDelete, SecretDelete, SecretPurge, KeyPurge, SecretBackup, KeyBackup. Any Backup operations should match w... |
| NRT Sensitive Azure Key Vault operations | Analytic Rule | 📦 Solution | Azure Key Vault | Identifies when sensitive Azure Key Vault operations are used. This includes: VaultDelete, KeyDelete, SecretDelete, SecretPurge, KeyPurge, SecretBackup, KeyBackup. Any Backup operations should match w... |
| Azure Key Vault access TimeSeries anomaly | Analytic Rule | 📦 Solution | Azure Key Vault | Identifies a sudden increase in count of Azure Key Vault secret or vault access operations by CallerIPAddress. The query leverages a built-in KQL anomaly detection algorithm to find large deviations f... |
| AzureKeyVaultWorkbook | Workbook | 📦 Solution | Azure Key Vault | |
| Determine users with cluster admin role | Hunting Query | 📦 Solution | Azure kubernetes Service | This query determines the cluster-admin role assigned to users and applied to resources across the entire cluster . |
| Azure RBAC AKS created role details | Hunting Query | 📦 Solution | Azure kubernetes Service | Query get the details of role created for kube-audit. |
| AksSecurity | Workbook | 📦 Solution | Azure kubernetes Service | |
| Credential errors stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query batches of distinct SQL queries that failed with error codes that might indicate malicious attempts to gain illegitimate access to the data. When Brute Force attacks are attempted, majority... |
| Firewall errors stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query batches of distinct SQL queries that failed with error codes that might indicate malicious attempts to gain illegitimate access to the data. When attacker attempts to scan or gain access to... |
| Syntax errors stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query batches of distinct SQL queries that failed with error codes that might indicate malicious attempts to gain illegitimate access to the data. When blind type of attacks are performed (such a... |
| Drop attempts stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query detects batches of distinct SQL queries that execute (or attempt to) commands that could indicate potential security issues - such as attempts to drop tables or databases (e.g. for data van... |
| Execution attempts stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query detects batches of distinct SQL queries that execute (or attempt to) commands that could indicate potential security issues - such as attempts to execute shell commands (e.g. for running il... |
| Firewall rule manipulation attempts stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query detects batches of distinct SQL queries that execute (or attempt to) commands that could indicate potential security issues - such as attempts to manipulate firewall rules (e.g. for allowin... |
| OLE object manipulation attempts stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query detects batches of distinct SQL queries that execute (or attempt to) commands that could indicate potential security issues - such as attempts to manipulate OLE objects (e.g. for running ma... |
| Outgoing connection attempts stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | This query detects batches of distinct SQL queries that execute (or attempt to) commands that could indicate potential security issues - such as attempts to access external sites or resources (e.g. fo... |
| Affected rows stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | Goal: To detect anomalous data change/deletion. This query detects SQL queries that changed/deleted a large number of rows, which is significantly higher than normal for this database. The detection i... |
| Response rows stateful anomaly on database | Analytic Rule | 📦 Solution | Azure SQL Database solution for sentinel | Goal: To detect anomalous data exfiltration. This query detects SQL queries that accessed a large number of rows, which is significantly higher than normal for this database. The calculation is made ... |
| Anomalous Query Execution Time | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | This hunting query will detect SQL queries that have affected an unusual number of rows for the given user and application combination. It will calculate the prevalence for each row count impacted to ... |
| Boolean Blind SQL Injection | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | This hunting query will detect instances where a balanced boolean query, e.g. "true=true", is observed in an SQL query sent to the server. Balanced boolean queries are commonly used by attackers to te... |
| Anomalous Query Execution Time | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | This hunting query will detect SQL queries that took an unusually long period of time to execute based on a calculated average execution time. The query groups based on the application and the usernam... |
| Prevalence Based SQL Query Size Anomaly | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | Applications using SQL will generally make repeated similar requests for data as users interact with the application, this hunting query will find instances where an unusual number of tokens have been... |
| Suspicious SQL Stored Procedures | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | This hunting query will detect SQL queries where suspicious stored procedures are called. Suspicious procedures included in the query are based on data seen by the MSTIC Deception honeypot. |
| Time Based SQL Query Size Anomaly | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | This hunting query uses series decompose anomaly to identify periods of time where a given user account and application combination is used to send an anomalous number of parameters or SQL query token... |
| Affected rows stateful anomaly on database - hunting query | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | Goal: To detect anomalous data change/deletion. This query detects SQL queries that changed/deleted a large number of rows, which is significantly higher than normal for this database. This is a hunti... |
| Response rows stateful anomaly on database - hunting query | Hunting Query | 📦 Solution | Azure SQL Database solution for sentinel | Goal: To detect anomalous data exfiltration. This query detects SQL queries that accessed a large number of rows, which is significantly higher than normal for this database. This is a hunting query, ... |
| Workbook-AzureSQLSecurity | Workbook | 📦 Solution | Azure SQL Database solution for sentinel | |
| Front Door Premium WAF - SQLi Detection | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for a SQL Injection attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.o... |
| Front Door Premium WAF - XSS Detection | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-p... |
| AFD WAF - Code Injection | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-c... |
| AFD WAF - Path Traversal Attack | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-c... |
| App GW WAF - Code Injection | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for a Code Injection based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.o... |
| App GW WAF - Path Traversal Attack | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for a Path Traversal based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.o... |
| App Gateway WAF - Scanner Detection | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for a Scanner detection user agent based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: h... |
| App Gateway WAF - SQLi Detection | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/Top1... |
| App Gateway WAF - XSS Detection | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-communit... |
| A potentially malicious web request was executed against a web server | Analytic Rule | 📦 Solution | Azure Web Application Firewall (WAF) | Detects unobstructed Web Application Firewall (WAF) activity in sessions where the WAF blocked incoming requests by computing the ratio between blocked requests and unobstructed WAF requests in these ... |
| WebApplicationFirewallFirewallEvents | Workbook | 📦 Solution | Azure Web Application Firewall (WAF) | |
| WebApplicationFirewallGatewayAccessEvents | Workbook | 📦 Solution | Azure Web Application Firewall (WAF) | |
| WebApplicationFirewallOverview | Workbook | 📦 Solution | Azure Web Application Firewall (WAF) | |
| WebApplicationFirewallWAFTypeEvents | Workbook | 📦 Solution | Azure Web Application Firewall (WAF) | |
| Azure DevOps Agent Pool Created Then Deleted | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | As well as adding build agents to an existing pool to execute malicious activity within a pipeline, an attacker could create a complete new agent pool and use this for execution. Azure DevOps allows f... |
| Azure DevOps Audit Stream Disabled | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Azure DevOps allow for audit logs to be streamed to external storage solutions such as SIEM solutions. An attacker looking to hide malicious Azure DevOps activity from defenders may look to disable da... |
| Azure DevOps Audit Detection for known malicious tooling | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Azure DevOps has been targeted over the years with a handful of toolkits. This detection will look for some common signs known for a few of these tools. |
| Azure DevOps New Extension Added | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Extensions add additional features to Azure DevOps. An attacker could use a malicious extension to conduct malicious activity. This query looks for new extensions that are not from a configurable lis... |
| Azure DevOps PAT used with Browser | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Personal Access Tokens (PATs) are used as an alternate password to authenticate into Azure DevOps. PATs are intended for programmatic access use in code or applications. This can be prone to attacker... |
| Azure DevOps Pipeline modified by a new user | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | There are several potential pipeline steps that could be modified by an attacker to inject malicious code into the build cycle. A likely attacker path is the modification to an existing pipeline that ... |
| Azure DevOps Retention Reduced | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | AzureDevOps retains items such as run records and produced artifacts for a configurable amount of time. An attacker looking to reduce the footprint left by their malicious activity may look to reduce ... |
| Azure DevOps Variable Secret Not Secured | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Credentials used in the build process may be stored as Azure DevOps variables. To secure these variables they should be stored in KeyVault or marked as Secrets. This detection looks for new variables... |
| Azure DevOps Build Variable Modified by New User | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Variables can be configured and used at any stage of the build process in Azure DevOps to inject values. An attacker with the required permissions could modify or add to these variables to conduct mal... |
| Azure DevOps Administrator Group Monitoring | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | This detection monitors for additions to projects or project collection administration groups in an Azure DevOps Organization. |
| Azure DevOps Pull Request Policy Bypassing - Historic allow list | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | This detection builds an allow list of historic PR policy bypasses and compares to recent history, flagging pull request bypasses that are not manually in the allow list and not historically included ... |
| Azure DevOps Service Connection Addition/Abuse - Historic allow list | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | This detection builds an allow list of historic service connection use by Builds and Releases and compares to recent history, flagging growth of service connection use which are not manually included ... |
| Azure DevOps Personal Access Token (PAT) misuse | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | This Alert detects whenever a PAT is used in ways that PATs are not normally used. May require an allow list and baselining. Reference - https://docs.microsoft.com/azure/devops/organizations/accounts/... |
| Azure DevOps Pipeline Created and Deleted on the Same Day | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | An attacker with access to Azure DevOps could create a pipeline to inject artifacts used by other pipelines, or to create a malicious software build that looks legitimate by using a pipeline that inco... |
| Azure DevOps Service Connection Abuse | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Flags builds/releases that use a large number of service connections if they aren't manually in the allow list. This is to determine if someone is hijacking a build/release and adding many service con... |
| External Upstream Source Added to Azure DevOps Feed | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | The detection looks for new external sources added to an Azure DevOps feed. An allow list can be customized to explicitly allow known good sources. An attacker could look to add a malicious feed in o... |
| New Agent Added to Pool by New User or Added to a New OS Type | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | As seen in attacks such as SolarWinds attackers can look to subvert a build process by controlling build servers. Azure DevOps uses agent pools to execute pipeline tasks. An attacker could insert com... |
| New PA, PCA, or PCAS added to Azure DevOps | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | In order for an attacker to be able to conduct many potential attacks against Azure DevOps they will need to gain elevated permissions. This detection looks for users being granted key administrative... |
| NRT Azure DevOps Audit Stream Disabled | Analytic Rule | 📦 Solution | AzureDevOpsAuditing | Azure DevOps allow for audit logs to be streamed to external storage solutions such as SIEM solutions. An attacker looking to hide malicious Azure DevOps activity from defenders may look to disable da... |
| Azure DevOps- Addtional Org Admin added | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This hunting query identifies Azure DevOps activities where additional organization admin is added |
| Azure DevOps - Build Check Deleted | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This query searches for removal of build checks from the Azure DevOps pipeline. Removal of build checks are rare and may be indication of build pipeline compromise. |
| Azure DevOps - Build Deleted After Pipeline Modification | Hunting Query | 📦 Solution | AzureDevOpsAuditing | Attackers may delete builds after modifying pipelines to minimize traces. This query spots such deletions within an hour of pipeline changes, aiding in system footprint reduction. |
| Azure DevOps - Internal Upstream Package Feed Added | Hunting Query | 📦 Solution | AzureDevOpsAuditing | Attackers may introduce upstream packages into the build process to insert malicious code. This query searches for such malicious activity. If an environment has low number of events, it can be upgrad... |
| Azure DevOps - New Agent Pool Created | Hunting Query | 📦 Solution | AzureDevOpsAuditing | Compromised agent pools in pipelines can allow build process breaches. While creating agent pools isn't inherently malicious, their infrequent creation makes them notable for Azure DevOps monitoring. |
| Azure DevOps - New Package Feed Created | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This query identifies users who created new package feed to Azure DevOps pipelines, having no prior history of feed creation, suggesting possible unauthorized activity and requiring verification. |
| Azure DevOps - New PAT Operation | Hunting Query | 📦 Solution | AzureDevOpsAuditing | Using PATs for new operations may signal misuse. This query flags unfamiliar PAT-based operations, potentially indicating malicious use of a stolen PAT. |
| Azure DevOps - New Release Approver | Hunting Query | 📦 Solution | AzureDevOpsAuditing | Release approvals in Azure Pipelines, often user-authorized, can be self-approved by attackers using compromised accounts. This query identifies unusual approvers, aiding in the detection of unauthori... |
| Azure DevOps - New Release Pipeline Created | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This query identifies users who created new package feed to Azure DevOps pipelines, having no prior history of feed creation, suggesting possible unauthorized activity and requiring verification. |
| Azure DevOps - Variable Created and Deleted | Hunting Query | 📦 Solution | AzureDevOpsAuditing | The query detects additions and removals of variables in build processes in a short span of time, possibly indicating malicious activity. Promoting to a detection if few such events occur. |
| Azure DevOps Display Name Changes | Hunting Query | 📦 Solution | AzureDevOpsAuditing | Shows all users with more than 1 display name in recent history. This is to hunt for users maliciously changing their display name as a masquerading technique |
| Azure DevOps Pull Request Policy Bypassing | Hunting Query | 📦 Solution | AzureDevOpsAuditing | Looks for users bypassing Update Policies in repos |
| Azure DevOps- Microsoft Entra ID Protection Conditional Access Disabled | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This hunting query identifies Azure DevOps activities where organization Microsoft Entra ID ConditionalAccess policy disable by the admin |
| Azure DevOps- Guest users access enabled | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This hunting query identifies Azure DevOps activities where organization Guest Access policy is enabled by the admin |
| Azure DevOps- Project visibility changed to public | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This hunting query identifies Azure DevOps activities where organization project visibility changed to public project |
| Azure DevOps- Public project created | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This hunting query identifies Azure DevOps activities where a public project is created |
| Azure DevOps- Public project enabled by admin | Hunting Query | 📦 Solution | AzureDevOpsAuditing | This hunting query identifies Azure DevOps activities where organization public projects policy enabled by the admin |
| ADOAuditLogs | Parser | 📦 Solution | AzureDevOpsAuditing | |
| Azure Security Benchmark Posture Changed | Analytic Rule | 📦 Solution | AzureSecurityBenchmark | This alert is designed to monitor Azure policies aligned with the Azure Security Benchmark Regulatory Compliance initiative. The alert triggers when policy compliance falls below 70% within a 1 week t... |
| AzureSecurityBenchmark | Workbook | 📦 Solution | AzureSecurityBenchmark | |
| Notify-GovernanceComplianceTeam | Playbook | 📦 Solution | AzureSecurityBenchmark | This Security Orchestration, Automation, & Response (SOAR) capability is designed for configuration with the solution's analytics rules. When analytics rules trigger this automation notifies the gover... |
| Create-AzureDevOpsTask | Playbook | 📦 Solution | AzureSecurityBenchmark | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| Create Jira Issue | Playbook | 📦 Solution | AzureSecurityBenchmark | This playbook will open a Jira Issue when a new incident is opened in Microsoft Sentinel. |
| Barracuda 🔍 | Workbook | 📦 Solution | Barracuda CloudGen Firewall | |
| CGFWFirewallActivity | Parser | 📦 Solution | Barracuda CloudGen Firewall | |
| BETTER_MTD_Workbook | Workbook | 📦 Solution | BETTER Mobile Threat Defense (MTD) | |
| BeyondTrustPMCloud | Workbook | 📦 Solution | BeyondTrustPMCloud | |
| Bitglass - Multiple files shared with external entity | Analytic Rule | 📦 Solution | Bitglass | Detects when multiple files shared with external entity. |
| Bitglass - Impossible travel distance | Analytic Rule | 📦 Solution | Bitglass | Detects logins from different geo locations. |
| Bitglass - Multiple failed logins | Analytic Rule | 📦 Solution | Bitglass | Detects multiple failed logins. |
| Bitglass - New admin user | Analytic Rule | 📦 Solution | Bitglass | Detects new admin user. |
| Bitglass - Login from new device | Analytic Rule | 📦 Solution | Bitglass | Detects when a user logins from new device. |
| Bitglass - New risky user | Analytic Rule | 📦 Solution | Bitglass | Detects new risky user. |
| Bitglass - The SmartEdge endpoint agent was uninstalled | Analytic Rule | 📦 Solution | Bitglass | Detects when SmartEdge endpoint agent was uninstalled. |
| Bitglass - Suspicious file uploads | Analytic Rule | 📦 Solution | Bitglass | Detects suspicious file upload activity. |
| Bitglass - User login from new geo location | Analytic Rule | 📦 Solution | Bitglass | Detects user login from new geo location. |
| Bitglass - User Agent string has changed for user | Analytic Rule | 📦 Solution | Bitglass | Detects when User Agent string has changed for user. |
| Bitglass - Applications used | Hunting Query | 📦 Solution | Bitglass | Query searches for applications used. |
| Bitglass - Insecure web protocol | Hunting Query | 📦 Solution | Bitglass | Query searches for usage of http protocol. |
| Bitglass - Login failures | Hunting Query | 📦 Solution | Bitglass | Query searches for login failures. |
| Bitglass - New applications | Hunting Query | 📦 Solution | Bitglass | Query searches for new applications configured. |
| Bitglass - New users | Hunting Query | 📦 Solution | Bitglass | Query searches for new users. |
| Bitglass - Privileged login failures | Hunting Query | 📦 Solution | Bitglass | Query searches for privileged login failures. |
| Bitglass - Risky users | Hunting Query | 📦 Solution | Bitglass | Query searches for risky users. |
| Bitglass - Risky users | Hunting Query | 📦 Solution | Bitglass | Query searches for risky users. |
| Bitglass - Uncategorized resources | Hunting Query | 📦 Solution | Bitglass | Query searches for uncategorized resources. |
| Bitglass - User devices | Hunting Query | 📦 Solution | Bitglass | Query searches for user devices. |
| Bitglass | Workbook | 📦 Solution | Bitglass | |
| Bitglass | Parser | 📦 Solution | Bitglass | |
| BitSight - compromised systems detected | Analytic Rule | 📦 Solution | BitSight | Rule helps to detect whenever there is a compromised systems found in BitSight. |
| BitSight - diligence risk category detected | Analytic Rule | 📦 Solution | BitSight | Rule helps to detect whenever there is a diligence risk category found in BitSight. |
| BitSight - drop in company ratings | Analytic Rule | 📦 Solution | BitSight | Rule helps to detect when there is a drop of 10% or more in BitSight company ratings. |
| BitSight - drop in the headline rating | Analytic Rule | 📦 Solution | BitSight | Rule helps to detect if headline ratings is drop in BitSight. |
| BitSight - new alert found | Analytic Rule | 📦 Solution | BitSight | Rule helps to detect a new alerts generated in BitSight. |
| BitSight - new breach found | Analytic Rule | 📦 Solution | BitSight | Rule helps to detect a new breach generated in BitSight. |
| BitSightWorkbook | Workbook | 📦 Solution | BitSight | |
| BitSightAlerts | Parser | 📦 Solution | BitSight | |
| BitSightBreaches | Parser | 📦 Solution | BitSight | |
| BitSightCompanyDetails | Parser | 📦 Solution | BitSight | |
| BitSightCompanyRatings | Parser | 📦 Solution | BitSight | |
| BitSightDiligenceHistoricalStatistics | Parser | 📦 Solution | BitSight | |
| BitSightDiligenceStatistics | Parser | 📦 Solution | BitSight | |
| BitSightFindingsData | Parser | 📦 Solution | BitSight | |
| BitSightFindingsSummary | Parser | 📦 Solution | BitSight | |
| BitSightGraphData | Parser | 📦 Solution | BitSight | |
| BitSightIndustrialStatistics | Parser | 📦 Solution | BitSight | |
| BitSightObservationStatistics | Parser | 📦 Solution | BitSight | |
| BitwardenEventLogsAuthentication | Workbook | 📦 Solution | Bitwarden | |
| BitwardenEventLogsOrganization | Workbook | 📦 Solution | Bitwarden | |
| BitwardenEventLogsVaultItems | Workbook | 📦 Solution | Bitwarden | |
| BitwardenEventLogs | Parser | 📦 Solution | Bitwarden | |
| CylancePROTECT-old 🔍 | Parser | 📦 Solution | Blackberry CylancePROTECT | |
| CylancePROTECT | Parser | 📦 Solution | Blackberry CylancePROTECT | |
| blacklens Insights | Analytic Rule | 📦 Solution | Blacklens | Creates incidents from blacklens.io Attack Surface Management alerts ingested into the blacklens_CL table. Alert severity is mapped dynamically from the source data. |
| Retrieve Alert from Microsoft Sentinel and Trigger a Blink Workflow via Webhook | Playbook | 📦 Solution | BlinkOps | Send a webhook request to a Blink workflow trigger whenever a new alert is created in Microsoft Sentinel |
| Retrieve Incident from Microsoft Sentinel and Trigger a Blink Workflow via Webhook | Playbook | 📦 Solution | BlinkOps | Send a webhook request to a Blink workflow trigger whenever a new Incident is created in Microsoft Sentinel |
| BloodHound Attack Path Finding - Add Key Credential Link Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Add Key Credential Link Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - Add Member Privileges on Tier Zero Security Groups | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Add Member Privileges on Tier Zero Security Groups |
| BloodHound Attack Path Finding - Add Members to Tier Zero Group | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Add Members to Tier Zero Group |
| BloodHound Attack Path Finding - AddOwner Role on Tier Zero Resource | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - AddOwner Role on Tier Zero Resource |
| BloodHound Attack Path Finding - Add Owner to Tier Zero Object via MS Graph App Role | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Add Owner to Tier Zero Object via MS Graph App Role |
| BloodHound Attack Path Finding - Add Secret to Tier Zero Principal | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Add Secret to Tier Zero Principal |
| BloodHound Attack Path Finding - AddSelf Privilege on Tier Zero Security Groups | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - AddSelf Privilege on Tier Zero Security Groups |
| BloodHound Attack Path Finding - Admins on Tier Zero Computers | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Admins on Tier Zero Computers |
| BloodHound Attack Path Finding - AKS Contributor Role on Tier Zero Managed Cluster | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - AKS Contributor Role on Tier Zero Managed Cluster |
| BloodHound Attack Path Finding - AllExtended Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - AllExtended Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - App Admin Control of Tier Zero Principal | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - App Admin Control of Tier Zero Principal |
| BloodHound Attack Path Finding - Avere Contributor Role on Tier Zero Virtual Machine | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Avere Contributor Role on Tier Zero Virtual Machine |
| BloodHound Attack Path Finding - Large Default Groups With Resource-Based Constrained Delegation Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Resource-Based Constrained Delegation Privileges |
| BloodHound Attack Path Finding - Add Resource-Based Constrained Delegation Privileges on Tier Zero Computers | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Add Resource-Based Constrained Delegation Privileges on Tier Zero Computers |
| BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to ADCS (ESC8) Attack | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to ADCS (ESC8) Attack |
| BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAP Attack | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAP Attack |
| BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAPS Attack | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAPS Attack |
| BloodHound Attack Path Finding - Computers Vulnerable to Coercion-Based NTLM Relay to SMB Attack | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Computers Vulnerable to Coercion-Based NTLM Relay to SMB Attack |
| BloodHound Attack Path Finding - Cloud App Admin Over Tier Zero Principal | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Cloud App Admin Over Tier Zero Principal |
| BloodHound Attack Path Finding - Command Execution on Tier Zero Virtual Machine | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Command Execution on Tier Zero Virtual Machine |
| BloodHound Attack Path Finding - Constrained Delegation on Tier Zero Computers | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Constrained Delegation on Tier Zero Computers |
| BloodHound Attack Path Finding - Contributor Role on Tier Zero Automation Account | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Contributor Role on Tier Zero Automation Account |
| BloodHound Attack Path Finding - Contributor Role on Tier Zero Resource | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Contributor Role on Tier Zero Resource |
| BloodHound Attack Path Finding - DCOM Users on Tier Zero Computers | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - DCOM Users on Tier Zero Computers |
| BloodHound Attack Path Finding - ForceChangePassword Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - ForceChangePassword Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - GenericAll Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - GenericAll Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - GenericWrite Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - GenericWrite Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - Get Certifcates on Tier Zero Key Vault | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Get Certifcates on Tier Zero Key Vault |
| BloodHound Attack Path Finding - Get Keys on Tier Zero Key Vault | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Get Keys on Tier Zero Key Vault |
| BloodHound Attack Path Finding - Get Secrets on Tier Zero Key Vault | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Get Secrets on Tier Zero Key Vault |
| BloodHound Attack Path Finding - Kerberoastable User Accounts | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Kerberoastable User Accounts |
| BloodHound Attack Path Finding - Kerberos Delegation on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Kerberos Delegation on Tier Zero Objects |
| BloodHound Attack Path Finding - Key Vault Contributor Role on Tier Zero Resource | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Key Vault Contributor Role on Tier Zero Resource |
| BloodHound Attack Path Finding - Large Default Groups in DCOM Users Groups | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups in DCOM Users Groups |
| BloodHound Attack Path Finding - Large Default Groups in Local Administrator Groups | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups in Local Administrator Groups |
| BloodHound Attack Path Finding - Large Default Groups in PS Remote Users Groups | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups in PS Remote Users Groups |
| BloodHound Attack Path Finding - Large Default Groups in SQL Admins Groups | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups in SQL Admins Groups |
| BloodHound Attack Path Finding - Large Default Groups With Add Key Credential Link Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Add Key Credential Link Privileges |
| BloodHound Attack Path Finding - Large Default Groups With Add Member Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Add Member Privileges |
| BloodHound Attack Path Finding - Large Default Groups With Add Self Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Add Self Privileges |
| BloodHound Attack Path Finding - Large Default Groups With All Extended Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With All Extended Privileges |
| BloodHound Attack Path Finding - Large Default Groups With ForceChangePassword Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With ForceChangePassword Privileges |
| BloodHound Attack Path Finding - Large Default Groups With GenericAll Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With GenericAll Privileges |
| BloodHound Attack Path Finding - Large Default Groups With GenericWrite Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With GenericWrite Privileges |
| BloodHound Attack Path Finding - Large Default Groups With Limited Ownership Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Limited Ownership Privileges |
| BloodHound Attack Path Finding - Large Default Groups With Ownership Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Ownership Privileges |
| BloodHound Attack Path Finding - Large Default Groups With RDP Access | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With RDP Access |
| BloodHound Attack Path Finding - Large Default Groups With Read GMSA Password Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Read GMSA Password Privileges |
| BloodHound Attack Path Finding - Large Default Groups With Read LAPS Password Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With Read LAPS Password Privileges |
| BloodHound Attack Path Finding - Large Default Groups With WriteAccountRestrictions Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With WriteAccountRestrictions Privileges |
| BloodHound Attack Path Finding - Large Default Groups With WriteDacl Privilege | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With WriteDacl Privilege |
| BloodHound Attack Path Finding - Large Default Groups With WriteGpLink Privilege | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With WriteGpLink Privilege |
| BloodHound Attack Path Finding - Large Default Groups With WriteOwnerLimitedRights Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With WriteOwnerLimitedRights Privileges |
| BloodHound Attack Path Finding - Large Default Groups With WriteOwner Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With WriteOwner Privileges |
| BloodHound Attack Path Finding - Large Default Groups With WriteServicePrincipalName Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Groups With WriteServicePrincipalName Privileges |
| BloodHound Attack Path Finding - Large Default Group With SyncLapsPassword Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Large Default Group With SyncLapsPassword Privileges |
| BloodHound Attack Path Finding - Legacy SID History on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Legacy SID History on Tier Zero Objects |
| BloodHound Attack Path Finding - Limited Ownership Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Limited Ownership Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - Logic App Contributor Role on Tier Zero Logic App | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Logic App Contributor Role on Tier Zero Logic App |
| BloodHound Attack Path Finding - Logons From Tier Zero Users | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Logons From Tier Zero Users |
| BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC10 Scenario A Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC10 Scenario A Privileges |
| BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC13 Privileges Against Tier Zero Group | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC13 Privileges Against Tier Zero Group |
| BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC1 Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC1 Privileges |
| BloodHound Attack Path Finding - Non Tier Zero Resource Assigned to Tier Zero Service Principal | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non Tier Zero Resource Assigned to Tier Zero Service Principal |
| BloodHound Attack Path Finding - Owner Role on Tier Zero Resource | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Owner Role on Tier Zero Resource |
| BloodHound Attack Path Finding - Ownership of Tier Zero Principal | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Ownership of Tier Zero Principal |
| BloodHound Attack Path Finding - Ownership Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Ownership Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - PS Remote Users on Tier Zero Computers | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - PS Remote Users on Tier Zero Computers |
| BloodHound Attack Path Finding - RDP Users on Tier Zero Computers | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - RDP Users on Tier Zero Computers |
| BloodHound Attack Path Finding - Read GMSA Password Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Read GMSA Password Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - ReadLapsPassword Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - ReadLapsPassword Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - AS-REP Roastable User Accounts | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - AS-REP Roastable User Accounts |
| BloodHound Attack Path Finding - Reset a Tier Zero User's Password | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Reset a Tier Zero User's Password |
| BloodHound Attack Path Finding - SQL Admin Users on Tier Zero Computers | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - SQL Admin Users on Tier Zero Computers |
| BloodHound Attack Path Finding - SyncLapsPassword Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - SyncLapsPassword Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - Non-Tier Zero AD User Synced to Tier Zero Entra User | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero AD User Synced to Tier Zero Entra User |
| BloodHound Attack Path Finding - Tier Zero SMSA Installed on Non-Tier Zero Computer | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Tier Zero SMSA Installed on Non-Tier Zero Computer |
| BloodHound Attack Path Finding - Non-Tier Zero Computer Hosting EnterpriseCA Trusted for NT Authentication | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Computer Hosting EnterpriseCA Trusted for NT Authentication |
| BloodHound Attack Path Finding - Non-Tier Zero Entra User Synced to Tier Zero AD User | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Entra User Synced to Tier Zero AD User |
| BloodHound Attack Path Finding - Tier Zero Group Control via MS Graph App Role | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Tier Zero Group Control via MS Graph App Role |
| BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero App Roles | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero App Roles |
| BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero Entra ID Role | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero Entra ID Role |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC10 Scenario B Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC10 Scenario B Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC3 Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC3 Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC4 Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC4 Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario A Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario A Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario B Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario B Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario A Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario A Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario B Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario B Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principals With DCSync Privileges | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principals With DCSync Privileges |
| BloodHound Attack Path Finding - Non-Tier Zero Principal Trusted for Unconstrained Delegation | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Non-Tier Zero Principal Trusted for Unconstrained Delegation |
| BloodHound Attack Path Finding - Tier Zero Service Principal Control via MS Graph App Role | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Tier Zero Service Principal Control via MS Graph App Role |
| BloodHound Attack Path Finding - User Access Admin Role on Tier Zero Resource | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - User Access Admin Role on Tier Zero Resource |
| BloodHound Attack Path Finding - VM Admin Login Role on Tier Zero System | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - VM Admin Login Role on Tier Zero System |
| BloodHound Attack Path Finding - VM Contributor Role on Tier Zero System | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - VM Contributor Role on Tier Zero System |
| BloodHound Attack Path Finding - Website Contributor Role on Tier Zero Resource | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Website Contributor Role on Tier Zero Resource |
| BloodHound Attack Path Finding - Write Account Restrictions Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - Write Account Restrictions Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - WriteDacl Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - WriteDacl Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - WriteGpLink Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - WriteGpLink Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - WriteOwnerLimitedRights Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - WriteOwnerLimitedRights Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - WriteOwner Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - WriteOwner Privileges on Tier Zero Objects |
| BloodHound Attack Path Finding - WriteServicePrincipalName Privileges on Tier Zero Objects | Analytic Rule | 📦 Solution | BloodHound Enterprise | BloodHound Attack Path Finding - WriteServicePrincipalName Privileges on Tier Zero Objects |
| BloodHoundEnterpriseAttackPathDetails | Workbook | 📦 Solution | BloodHound Enterprise | |
| BloodHoundEnterpriseAttackPathOverview | Workbook | 📦 Solution | BloodHound Enterprise | |
| BloodHoundEnterpriseAuditLogs | Workbook | 📦 Solution | BloodHound Enterprise | |
| BloodHoundEnterpriseTierZeroSearch | Workbook | 📦 Solution | BloodHound Enterprise | |
| BloodHoundFindingTrends | Workbook | 📦 Solution | BloodHound Enterprise | |
| BloodHoundPostureHistory | Workbook | 📦 Solution | BloodHound Enterprise | |
| Box - Abmormal user activity | Analytic Rule | 📦 Solution | Box | Detects spikes (deviations from avarage) in user activity. |
| Box - Executable file in folder | Analytic Rule | 📦 Solution | Box | Detects executable files in folders. |
| Box - Forbidden file type downloaded | Analytic Rule | 📦 Solution | Box | Detects when new user downloads forbidden file types. |
| Box - Inactive user login | Analytic Rule | 📦 Solution | Box | Detects user login after long inactivity period. |
| Box - Item shared to external entity | Analytic Rule | 📦 Solution | Box | Detects when an item was shared to external entity. |
| Box - Many items deleted by user | Analytic Rule | 📦 Solution | Box | Detects when a user deletes many items in short period of time. |
| Box - New external user | Analytic Rule | 📦 Solution | Box | Detects when new user created with SourceLogin containing non-corporate domain. |
| Box - File containing sensitive data | Analytic Rule | 📦 Solution | Box | Detects files which potentialy may contain sensitive data such as passwords, authentication tokens, secret keys. |
| Box - User logged in as admin | Analytic Rule | 📦 Solution | Box | Detects when user logged in as admin. |
| Box - User role changed to owner | Analytic Rule | 📦 Solution | Box | Detects when user collaboration role is changed to owner. |
| Box - IP list for admin users | Hunting Query | 📦 Solution | Box | Query shows iplist for admin users. You can check for suspicious IPs or new IPs. |
| Box - Deleted users | Hunting Query | 📦 Solution | Box | Query shows deleted user accounts. |
| Box - Inactive admin users | Hunting Query | 📦 Solution | Box | Query shows inactive admin accounts (admin users which last login time is more than 30 days). |
| Box - Inactive users | Hunting Query | 📦 Solution | Box | Query shows inactive user accounts (users which last login time is more than 30 days). |
| Box - New users | Hunting Query | 📦 Solution | Box | Query shows new user accounts. |
| Box - Suspicious or sensitive files | Hunting Query | 📦 Solution | Box | Query searches for potentially suspicious files or files which can contain sensitive information such as passwords, secrets. |
| Box - Downloaded data volume per user | Hunting Query | 📦 Solution | Box | Query shows downloaded data volume per user. |
| Box - New users | Hunting Query | 📦 Solution | Box | Query shows user permissions(groups) changes. |
| Box - Users with owner permissions | Hunting Query | 📦 Solution | Box | Query shows users with newly added owner permissions. |
| Box - Uploaded data volume per user | Hunting Query | 📦 Solution | Box | Query shows uploaded data volume per user. |
| Box | Workbook | 📦 Solution | Box | |
| BoxEvents | Parser | 📦 Solution | Box | |
| SymantecDLP | Parser | 📦 Solution | Broadcom SymantecDLP | |
| Account Elevated to New Role | Analytic Rule | 📦 Solution | Business Email Compromise - Financial Fraud | Detects an account that is elevated to a new role where that account has not had that role in the last 14 days. Role elevations are a key mechanism for gaining permissions, monitoring which users ha... |
| Authentication Method Changed for Privileged Account | Analytic Rule | 📦 Solution | Business Email Compromise - Financial Fraud | Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https... |
| Malicious BEC Inbox Rule | Analytic Rule | 📦 Solution | Business Email Compromise - Financial Fraud | Often times after the initial compromise in a BEC attack the attackers create inbox rules to delete emails that contain certain keywords related to their BEC attack. This is done so as to limit abili... |
| Privileged Account Permissions Changed | Analytic Rule | 📦 Solution | Business Email Compromise - Financial Fraud | Detects changes to permissions assigned to admin users. Threat actors may try and increase permission scope by adding additional roles to already privileged accounts. Review any modifications to ensur... |
| Suspicious access of BEC related documents | Analytic Rule | 📦 Solution | Business Email Compromise - Financial Fraud | This query looks for users with suspicious spikes in the number of files accessed that relate to topics commonly accessed as part of Business Email Compromise (BEC) attacks. The query looks for access... |
| Suspicious access of BEC related documents in AWS S3 buckets | Analytic Rule | 📦 Solution | Business Email Compromise - Financial Fraud | This query looks for users with suspicious spikes in the number of files accessed that relate to topics commonly accessed as part of Business Email Compromise (BEC) attacks. The query looks for access... |
| User Added to Admin Role | Analytic Rule | 📦 Solution | Business Email Compromise - Financial Fraud | Detects a user being added to a new privileged role. Monitor these additions to ensure the users are made eligible for these roles are intended to have these levels of access. Ref: https://docs.micr... |
| S3 Bucket outbound Data transfer anomaly | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | Identifies S3 data transfer spikes using GetObject API, BytesTransferredOut, and KQL anomaly detection. Investigate sudden action frequency increases. Adjust scorethreshold to 3+ to reduce noise. |
| Suspicious Data Access to S3 Bucket from Unknown IP | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | This query identifies unusual access to cloud storage, particularly from IPs not historically seen accessing the bucket or downloading files. It can be limited to private buckets with sensitive files ... |
| Email Forwarding Configuration with SAP download | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | This query detects external email forwarding with SAP download for sensitive financial transactions. Such activity by attackers may lead to financial gain, IP theft, or operational disruption. |
| Login attempts using Legacy Auth | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | This query identifies use of legacy authentication in Microsoft Entra ID sign-in activity, which can bypass Azure Conditional Access policies. It includes UEBA logs IdentityInfo and BehaviorAnalytics ... |
| Microsoft Entra ID signins from new locations | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | This query identifies new Microsoft Entra ID sign-in locations compared to historical data, potentially indicating password spraying or brute force attacks. It includes UEBA logs IdentityInfo and Beha... |
| Office Mail Rule Creation with suspicious archive mail move activity | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | Hunting query to detect new inbox rule creation with activity of mail moved from inbox to archive folder within 12minutes.Though such activities could be legitimate some attackers may use these techni... |
| Risky Sign-in with new MFA method | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | This query identifies new MFA methods added to an account within 6 hours of a medium or high risk sign-in session. It includes UEBA logs IdentityInfo and BehaviorAnalytics for context. |
| High count download from a SAP Privileged account | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | This query detects high counts of download from a sensitive SAP Privileged account. A pre-built watchlist is leveraged to identify the privileged users that are under extra restrictions. |
| Successful Signin From Non-Compliant Device | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | Detects successful sign ins from devices marked non-compliant. Best practice is to block sign ins from non-complaint devices, however if allowed monitor these events to ensure they do not lead to othe... |
| User Accounts - New Single Factor Auth | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | Identifies users whose single Factor Auth Events in scenarios where it has not been seen before, or where only multi factor auth has been observed. |
| User Accounts - Unusual authentications occurring when countries do not conduct normal business operations. | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | Identifies users whose single Factor Auth Events in scenarios where it has not been seen before, or where only multi factor auth has been observed. |
| User detection added to privilege groups based in Watchlist | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | Based on a Watchlist Detects when a user has been added to a privileged group/role. We can exclude from the wathclist the users for whom we do not want this alert to be triggered |
| User Login IP Address Teleportation | Hunting Query | 📦 Solution | Business Email Compromise - Financial Fraud | This query identifies users logging in from two different countries within a specified time window, potentially indicating VPN use. It includes UEBA logs IdentityInfo and BehaviorAnalytics for context... |
| Censys | Workbook | 📦 Solution | Censys | |
| Censys Add Incident Comment | Playbook | 📦 Solution | Censys | This playbook is triggered via HTTP request and is designed to be used as a sub-playbook by other Censys playbooks (CensysIncidentEnrichment, CensysEntityEnrichmentHost, CensysEntityEnrichmentCertific... |
| Censys Alert Enrichment | Playbook | 📦 Solution | Censys | This playbook is triggered by a Microsoft Sentinel Alert. It extracts IP addresses, domains, and certificate file hashes (SHA256) from alert entities, then queries the Censys API to retrieve enrichmen... |
| Censys Alert Rescan | Playbook | 📦 Solution | Censys | This playbook is triggered manually via HTTP request from a workbook or automation. It accepts input parameters including IOC Type (Host or Web Property), IP, Port, Protocol, Transport Protocol, Hostn... |
| Censys Entity Enrichment - Certificate | Playbook | 📦 Solution | Censys | This playbook is triggered automatically when a FileHash entity is detected in a Microsoft Sentinel incident, based on an automation rule. Upon triggering, it extracts the FileHash (certificate finger... |
| Censys Entity Enrichment - Host | Playbook | 📦 Solution | Censys | This playbook is triggered automatically when an IP entity is detected in a Microsoft Sentinel incident, based on an automation rule. Upon triggering, it extracts the IP address from the entity and qu... |
| Censys Entity Enrichment - Web Property | Playbook | 📦 Solution | Censys | This playbook is triggered automatically when a DNS entity (domain name) is detected in a Microsoft Sentinel incident, based on an automation rule. Upon triggering, it extracts the domain name from th... |
| Censys Host History | Playbook | 📦 Solution | Censys | This playbook is triggered manually via HTTP request, typically invoked from a Microsoft Sentinel workbook. It retrieves historical timeline data for a specified host (IP address) from the Censys API ... |
| Censys Incident Enrichment | Playbook | 📦 Solution | Censys | This playbook will be triggered when any automation rule is attached or manually invoked. This will fetch associated IPs, Host(Domains) and SHAs from incident and make associated API calls to retrieve... |
| Censys Ad-Hoc IOC Lookup | Playbook | 📦 Solution | Censys | This playbook will be triggered from the workbook. This will fetch associated IPs, Host(Domains) and SHAs from user input provided in the Ad-Hoc IOC Lookup Dashboard and make API calls to retrieve Cen... |
| Censys Related Infrastructure | Playbook | 📦 Solution | Censys | This playbook retrieves related infrastructure details for Censys entities (hosts, certificates, or web properties) using the Censys Pivot Analysis API. It accepts an IOC Value (hosts, certificates, o... |
| Censys Rescan | Playbook | 📦 Solution | Censys | This playbook will be triggered manually. This will fetch associated IPs from the incident and make API calls to retrieve Censys data and enrich the incident with additional information as Incident co... |
| CheckPoint | Workbook | 📦 Solution | Check Point | |
| checkpoint-add-host-to-group | Playbook | 📦 Solution | Check Point | This playbook will create Check Point objects and add to block group |
| Check Point Exposure Management - Alert Ingestion Anomaly | Analytic Rule | 📦 Solution | Check Point Cyberint Alerts | Detects when no Check Point Exposure Management alerts have been ingested into the argsentdc_CL table for an extended period. This may indicate a failure in the CCP data connector or the Importer play... |
| CPEMAlertOverview | Workbook | 📦 Solution | Check Point Cyberint Alerts | |
| Check Point EM - Importer (Alerts → Sentinel Incidents) | Playbook | 📦 Solution | Check Point Cyberint Alerts | Queries the argsentdc_CL custom table (populated by the CCP data connector) for recent alerts and creates corresponding Microsoft Sentinel incidents. |
| Check Point Exposure Management - Manual Status Update (Sentinel → Argos) | Playbook | 📦 Solution | Check Point Cyberint Alerts | On-demand playbook that reads the current Sentinel incident status and pushes it to the corresponding alert(s). Triggered manually from the incident actions menu. |
| Check Point Exposure Management - Exporter (Sentinel → Argos) | Playbook | 📦 Solution | Check Point Cyberint Alerts | When a Sentinel incident status changes, this playbook pushes the update to the corresponding alert(s). Includes tag-based loop prevention to avoid circular sync with Importer. |
| Check Point Exposure Management - Credential Leak Validation and Response | Playbook | 📦 Solution | Check Point Cyberint Alerts | When a new Microsoft Sentinel incident is created for leaked credentials, this playbook queries the Check Point Exposure Management credential leak API for the affected domain, enriches the incident w... |
| Check Point Exposure Management - Phishing Takedown | Playbook | 📦 Solution | Check Point Cyberint Alerts | When a new Microsoft Sentinel incident is created for a phishing website alert, this playbook extracts the phishing URL, evaluates confidence and severity thresholds, submits a takedown request to Che... |
| Check Point Exposure Management - Vulnerability Exploitation Monitoring | Playbook | 📦 Solution | Check Point Cyberint Alerts | When a new Microsoft Sentinel incident is created containing CVE identifiers, this playbook enriches each CVE using the Check Point CVE Intelligence API (EPSS, CPEM score, exploitation evidence, PoC a... |
| Check Point Exposure Management - Fetch Attachments On-Demand | Playbook | 📦 Solution | Check Point Cyberint Alerts | On-demand playbook that fetches alert attachments and analysis report for a Sentinel incident, surfacing the results as an incident comment. |
| Check Point Exposure Management - IOC Enrichment and Triage | Playbook | 📦 Solution | Check Point Cyberint Alerts | When a new Microsoft Sentinel incident is created, this playbook enriches IOC entities (IPs, domains, file hashes, URLs) using the Check Point Exposure Management threat intelligence API and adds enri... |
| CPEMAlerts | Parser | 📦 Solution | Check Point Cyberint Alerts | |
| CheckPhish - Get URL reputation | Playbook | 📦 Solution | CheckPhish by Bolster | This playbooks will be used to submit URL to CheckPhish and gets the repution of URL (Scan result) |
| CiscoACIEvent | Parser | 📦 Solution | Cisco ACI | |
| CiscoETD | Workbook | 📦 Solution | Cisco ETD | |
| Block URL - Cisco Firepower | Playbook | 📦 Solution | Cisco Firepower EStreamer | This playbook allows blocking of FQDNs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The ... |
| Block IP - Cisco Firepower | Playbook | 📦 Solution | Cisco Firepower EStreamer | This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Ne... |
| Block IP - Take Action from Teams - Cisco Firepower | Playbook | 📦 Solution | Cisco Firepower EStreamer | This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Ne... |
| CiscoISE - ISE administrator password has been reset | Analytic Rule | 📦 Solution | Cisco ISE | Detects when the ISE administrator password has been reset. |
| CiscoISE - Attempt to delete local store logs | Analytic Rule | 📦 Solution | Cisco ISE | Detects when attempt to delete local store logs failed. |
| CiscoISE - Backup failed | Analytic Rule | 📦 Solution | Cisco ISE | Detects when backup activity failed. |
| CiscoISE - Certificate has expired | Analytic Rule | 📦 Solution | Cisco ISE | Detects certificate expiration. |
| CiscoISE - Command executed with the highest privileges from new IP | Analytic Rule | 📦 Solution | Cisco ISE | Detects command execution with PrivilegeLevel - 15 from new source. |
| CiscoISE - Command executed with the highest privileges by new user | Analytic Rule | 📦 Solution | Cisco ISE | Detects command execution with PrivilegeLevel - 15 by user for wich there was no such activity detected earlier. |
| CiscoISE - Device changed IP in last 24 hours | Analytic Rule | 📦 Solution | Cisco ISE | Detects when device changes IP address in last 24 hours. |
| CiscoISE - Device PostureStatus changed to non-compliant | Analytic Rule | 📦 Solution | Cisco ISE | Detects when device changes PostureStatus from "Compliant". |
| CiscoISE - Log collector was suspended | Analytic Rule | 📦 Solution | Cisco ISE | Detects when log collector was suspended. |
| CiscoISE - Log files deleted | Analytic Rule | 📦 Solution | Cisco ISE | Detects log file deleting activity. |
| CiscoISE - Authentication attempts to suspended user account | Hunting Query | 📦 Solution | Cisco ISE | Search authentication attempts to suspended user account. |
| CiscoISE - Dynamic authorization failed | Hunting Query | 📦 Solution | Cisco ISE | Search for dynamic authorization failed events. |
| CiscoISE - Expired certificate in the client certificates chain | Hunting Query | 📦 Solution | Cisco ISE | Search for expired certificates in the client certificates chain. |
| CiscoISE - Failed authentication events | Hunting Query | 📦 Solution | Cisco ISE | Search for failed authentication events. |
| CiscoISE - Failed login attempts via SSH CLI (users) | Hunting Query | 📦 Solution | Cisco ISE | Search for Failed login attempts via SSH CLI users. |
| CiscoISE - Guest authentication failed | Hunting Query | 📦 Solution | Cisco ISE | Search Guest authentication failed events. |
| CiscoISE - Guest authentication succeeded | Hunting Query | 📦 Solution | Cisco ISE | Search for successful Guest authentication events. |
| CiscoISE - Rare or new useragent | Hunting Query | 📦 Solution | Cisco ISE | Search for rare useragent values. |
| CiscoISE - Sources with high number of 'Failed Authentication' events | Hunting Query | 📦 Solution | Cisco ISE | Search sources with high number of Failed Authentication events. |
| CiscoISE - Attempts to suspend the log collector | Hunting Query | 📦 Solution | Cisco ISE | Search for attempts to suspend the log collector. |
| CiscoISE | Workbook | 📦 Solution | Cisco ISE | |
| CiscoISE-False Positives Clear Policies | Playbook | 📦 Solution | Cisco ISE | This playbook gets triggered when a new sentinel incident is created 1.For each MAC address (MACAddress provided in the alert custom entities) in the incident checks if it is was rejected in Cisco ISE... |
| CiscoISE-SuspendGuestUser | Playbook | 📦 Solution | Cisco ISE | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. For each Account in the incident suspends user in Cisco ISE by its name. 2. Adds comment to... |
| CiscoISE-TakeEndpointActionFromTeams | Playbook | 📦 Solution | Cisco ISE | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Sends an adaptive card to the Teams channel where the analyst can choose an action to be ta... |
| CiscoISEEvent | Parser | 📦 Solution | Cisco ISE | |
| Cisco SDWAN - Intrusion Events | Analytic Rule | 📦 Solution | Cisco SD-WAN | This Analytic rule will monitor Intrusion events in Cisco syslog data based on the provided Signature ID. This will create an incident if that Signature ID is found in the specified time range. |
| Cisco SDWAN - IPS Event Threshold | Analytic Rule | 📦 Solution | Cisco SD-WAN | This analytic rule will monitor specific IPS event in the data. |
| Cisco SDWAN - Maleware Events | Analytic Rule | 📦 Solution | Cisco SD-WAN | This analytic rule will monitor Malware Events in Syslog and Netflow Data |
| Cisco SDWAN - Monitor Critical IPs | Analytic Rule | 📦 Solution | Cisco SD-WAN | This analytic rule will monitor critical IPs in Syslog and Netflow Data. |
| CiscoSDWAN | Workbook | 📦 Solution | Cisco SD-WAN | |
| CiscoSDWANIntrusionLogicAPP | Playbook | 📦 Solution | Cisco SD-WAN | This playbook provides an end-to-end example of adding a comment in the generated incident. |
| CiscoSDWANLogicAPP | Playbook | 📦 Solution | Cisco SD-WAN | This playbook provides an end-to-end example of sending an email, posting a message to the Microsoft Teams channel, and creating 3rd party ticket for the suspicious activity found in the data. |
| CiscoSDWANReport | Playbook | 📦 Solution | Cisco SD-WAN | This playbook provides an end-to-end example of sending an email for suspicious activity found in the data. |
| CiscoSDWANNetflow 🔍 | Parser | 📦 Solution | Cisco SD-WAN | |
| CiscoSyslogFW6LogSummary 🔍 | Parser | 📦 Solution | Cisco SD-WAN | |
| CiscoSyslogUTD 🔍 | Parser | 📦 Solution | Cisco SD-WAN | |
| MapNetflowUsername 🔍 | Parser | 📦 Solution | Cisco SD-WAN | |
| StealthwatchEvent | Parser | 📦 Solution | Cisco Secure Cloud Analytics | |
| Cisco SE High Events Last Hour | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | Find events from Cisco Secure Endpoint that are of High severity in the last hour. |
| Cisco SE - Connection to known C2 server | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | This rule is triggered when connection to known C2 is detected from host. |
| Cisco SE - Dropper activity on host | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | Detects possible dropper activity on host. |
| Cisco SE - Generic IOC | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | This rule is triggered when generic IOC is observed on host. |
| Cisco SE - Malware execusion on host | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | Detects malware execution on host. |
| Cisco SE - Malware outbreak | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | Detects possible malware outbreak. |
| Cisco SE - Multiple malware on host | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | This rule triggers when multiple malware where detected on host. |
| Cisco SE - Policy update failure | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | Detects policy updates failures. |
| Cisco SE - Ransomware Activity | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | This rule is triggered when possible ransomware activity is detected on host. |
| Cisco SE - Unexpected binary file | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | Detects binary files in uncommon locations. |
| Cisco SE - Possible webshell | Analytic Rule | 📦 Solution | Cisco Secure Endpoint | Detects possible webshell on host. |
| Cisco SE - Infected hosts | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for infected hosts. |
| Cisco SE - Infected users | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for infected users. |
| Cisco SE - User Logins | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for user logins to management console. |
| Cisco SE - Malicious files | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for malicious files. |
| Cisco SE - Modified agents on hosts | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for hosts with modified agent settings. |
| Cisco SE - Rare scanned files | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for rare scanned files. |
| Cisco SE - Scanned files | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for scanned files. |
| Cisco SE - Suspicious powershel downloads | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for suspicious powershell downloads. |
| Cisco SE - Uncommon application behavior | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for uncommon application behavior events. |
| Cisco SE - Vulnerable applications | Hunting Query | 📦 Solution | Cisco Secure Endpoint | Query searches for vulnerable applications on hosts. |
| Cisco Secure Endpoint Overview | Workbook | 📦 Solution | Cisco Secure Endpoint | |
| CiscoSecureEndpoint | Parser | 📦 Solution | Cisco Secure Endpoint | |
| CiscoUCS | Parser | 📦 Solution | Cisco UCS | |
| Cisco ASA - average attack detection rate increase | Analytic Rule | 📦 Solution | CiscoASA | This will help you determine if Cisco ASA devices are under heavier attack than normal over the last hour versus the previous 6 hours based on DeviceEventClassID 733100 References: https://www.cisco.c... |
| Cisco ASA - threat detection message fired | Analytic Rule | 📦 Solution | CiscoASA | Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105 Resources: https://www.cisco.com/... |
| Cisco | Workbook | 📦 Solution | CiscoASA | |
| Block IP - Cisco ASA | Playbook | 📦 Solution | CiscoASA | This playbook allows blocking/allowing of IPs in Cisco ASA, using a Network Object Group. The Network Object Group itself should be part of an Access Control Entry. |
| Cisco ASA - Create or remove access rules on an interface for IP Addresses | Playbook | 📦 Solution | CiscoASA | This playbook allows blocking/unblocking of IPs in Cisco ASA, using **Access Control Entries** which will be created in an access control list. |
| Cisco ASA - Create or Inbound Access Rule On Interface | Playbook | 📦 Solution | CiscoASA | This playbook allows blocking/unblocking of IPs in Cisco ASA, using **Access Rules** which will be created on an interface. |
| Cisco Duo - Admin user deleted | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when admin user is deleted. |
| Cisco Duo - Multiple admin 2FA failures | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when multiple admin 2FA failures occurs. |
| Cisco Duo - Admin password reset | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when admin's password was reset. |
| Cisco Duo - AD sync failed | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when AD syncronization failed. |
| Cisco Duo - Multiple user login failures | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when multiple user login failures occurs. |
| Cisco Duo - Multiple users deleted | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when multiple users were deleted. |
| Cisco Duo - New access device | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects new access device. |
| Cisco Duo - Admin user created | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when new admin user is created. |
| Cisco Duo - Authentication device new location | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects new location of authentication device. |
| Cisco Duo - Unexpected authentication factor | Analytic Rule | 📦 Solution | CiscoDuoSecurity | Detects when unexpected authentication factor used. |
| Cisco Duo - Admin failure authentications | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for administrator issue completing secondary authentication. |
| Cisco Duo - Delete actions | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for delete actions performed by admin users. |
| Cisco Duo - Admin failure authentications | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches admin failure authentication events. |
| Cisco Duo - Authentication errors | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for authentication errors. |
| Cisco Duo - Authentication error reasons | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for authentication error reasons. |
| Cisco Duo - Deleted users | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for deleted users. |
| Cisco Duo - Fraud authentications | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for fraud authentication events. |
| Cisco Duo - New users | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for new users created. |
| Cisco Duo - Devices with vulnerable OS | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for devices with vulnerable OS. |
| Cisco Duo - Devices with unsecure settings | Hunting Query | 📦 Solution | CiscoDuoSecurity | Query searches for devices with unsecure settings. |
| CiscoDuo | Workbook | 📦 Solution | CiscoDuoSecurity | |
| CiscoDuo | Parser | 📦 Solution | CiscoDuoSecurity | |
| CiscoMerakiWorkbook | Workbook | 📦 Solution | CiscoMeraki | |
| Block Device Client - Cisco Meraki | Playbook | 📦 Solution | CiscoMeraki | This playbook checks if malicious device client is blocked by Cisco Meraki network. |
| Block IP Address - Cisco Meraki | Playbook | 📦 Solution | CiscoMeraki | This playbook checks if malicious IP address is blocked or unblocked by Cisco Meraki MX network. |
| Block URL - Cisco Meraki | Playbook | 📦 Solution | CiscoMeraki | This playbook checks if malicious URL is blocked in Cisco Meraki network. |
| IP Address Enrichment - Cisco Meraki | Playbook | 📦 Solution | CiscoMeraki | This playbook checks if malicious IP address is blocked or unblocked by Cisco Meraki MX network. |
| URL Enrichment - Cisco Meraki | Playbook | 📦 Solution | CiscoMeraki | This playbook checks if malicious URL is blocked or unblocked by Cisco Meraki network. |
| CiscoMeraki | Parser | 📦 Solution | CiscoMeraki | |
| Cisco SEG - DLP policy violation | Analytic Rule | 📦 Solution | CiscoSEG | Detects DLP policy violation. |
| Cisco SEG - Malicious attachment not blocked | Analytic Rule | 📦 Solution | CiscoSEG | Detects mails with malicious attachments which were not blocked. |
| Cisco SEG - Multiple large emails sent to external recipient | Analytic Rule | 📦 Solution | CiscoSEG | Detects possible data exfiltration. |
| Cisco SEG - Multiple suspiciuos attachments received | Analytic Rule | 📦 Solution | CiscoSEG | Detects possibly phishing emails. |
| Cisco SEG - Possible outbreak | Analytic Rule | 📦 Solution | CiscoSEG | Detects possible outbreak activity. |
| Cisco SEG - Potential phishing link | Analytic Rule | 📦 Solution | CiscoSEG | Detects mails with suspicious links. |
| Cisco SEG - Suspicious link | Analytic Rule | 📦 Solution | CiscoSEG | Detects mails with suspicious links. |
| Cisco SEG - Suspicious sender domain | Analytic Rule | 📦 Solution | CiscoSEG | Detects suspicious sender domain age. |
| Cisco SEG - Unexpected link | Analytic Rule | 📦 Solution | CiscoSEG | Detects mails with suspicious links. |
| Cisco SEG - Unexpected attachment | Analytic Rule | 📦 Solution | CiscoSEG | Detects possibly malicious attachments. |
| Cisco SEG - Unscannable attacment | Analytic Rule | 📦 Solution | CiscoSEG | Detects unscannable attachments in mails. |
| Cisco SEG - Dropped incoming mails | Hunting Query | 📦 Solution | CiscoSEG | Query searches for dropped mails. |
| Cisco SEG - Dropped outgoing mails | Hunting Query | 📦 Solution | CiscoSEG | Query searches for dropped outgoing mails. |
| Cisco SEG - DKIM failures | Hunting Query | 📦 Solution | CiscoSEG | Query searches for mails with DKIM failure status. |
| Cisco SEG - DMARK failures | Hunting Query | 📦 Solution | CiscoSEG | Query searches for mails with DMARK failure status. |
| Cisco SEG - SPF failures | Hunting Query | 📦 Solution | CiscoSEG | Query searches for mails with SPF failure status. |
| Cisco SEG - Failed incoming TLS connections | Hunting Query | 📦 Solution | CiscoSEG | Query searches failed TLS incoming connections. |
| Cisco SEG - Failed outgoing TLS connections | Hunting Query | 📦 Solution | CiscoSEG | Query searches failed TLS outgoing connections. |
| Cisco SEG - Insecure protocol | Hunting Query | 📦 Solution | CiscoSEG | Query searches for connections with insecure protocol. |
| Cisco SEG - Sources of spam mails | Hunting Query | 📦 Solution | CiscoSEG | Query searches for sources of spam mails. |
| Cisco SEG - Top users receiving spam mails | Hunting Query | 📦 Solution | CiscoSEG | Query searches for top users receiving spam mails. |
| CiscoSEG | Workbook | 📦 Solution | CiscoSEG | |
| CiscoSEGEvent | Parser | 📦 Solution | CiscoSEG | |
| Cisco Cloud Security - Connection to non-corporate private network | Analytic Rule | 📦 Solution | CiscoUmbrella | IP addresses of broadband links that usually indicates users attempting to access their home network, for example for a remote session to a home computer. |
| Cisco Cloud Security - Connection to Unpopular Website Detected | Analytic Rule | 📦 Solution | CiscoUmbrella | Detects first connection to an unpopular website (possible malicious payload delivery). |
| Cisco Cloud Security - Crypto Miner User-Agent Detected | Analytic Rule | 📦 Solution | CiscoUmbrella | Detects suspicious user agent strings used by crypto miners in proxy logs. |
| Cisco Cloud Security - Empty User Agent Detected | Analytic Rule | 📦 Solution | CiscoUmbrella | Rule helps to detect empty and unusual user agent indicating web browsing activity by an unusual process other than a web browser. |
| Cisco Cloud Security - Hack Tool User-Agent Detected | Analytic Rule | 📦 Solution | CiscoUmbrella | Detects suspicious user agent strings used by known hack tools |
| Cisco Cloud Security - Windows PowerShell User-Agent Detected | Analytic Rule | 📦 Solution | CiscoUmbrella | Rule helps to detect Powershell user-agent activity by an unusual process other than a web browser. |
| Cisco Cloud Security - Rare User Agent Detected | Analytic Rule | 📦 Solution | CiscoUmbrella | Rule helps to detect a rare user-agents indicating web browsing activity by an unusual process other than a web browser. |
| Cisco Cloud Security - Request Allowed to harmful/malicious URI category | Analytic Rule | 📦 Solution | CiscoUmbrella | It is reccomended that these Categories shoud be blocked by policies because they provide harmful/malicious content.. |
| Cisco Cloud Security - Request to blocklisted file type | Analytic Rule | 📦 Solution | CiscoUmbrella | Detects request to potentially harmful file types (.ps1, .bat, .vbs, etc.). |
| Cisco Cloud Security - URI contains IP address | Analytic Rule | 📦 Solution | CiscoUmbrella | Malware can use IP address to communicate with C2. |
| Cisco Cloud Security - Anomalous FQDNs for domain | Hunting Query | 📦 Solution | CiscoUmbrella | Large number of FQDNs for domain may be indicator of suspicious domain. |
| Cisco Cloud Security - 'Blocked' User-Agents. | Hunting Query | 📦 Solution | CiscoUmbrella | Shows User-Agent values which requests were blocked |
| Cisco Cloud Security - DNS Errors. | Hunting Query | 📦 Solution | CiscoUmbrella | Shows error DNS requests. |
| Cisco Cloud Security - DNS requests to unreliable categories. | Hunting Query | 📦 Solution | CiscoUmbrella | Shows requests to URI categories which heavily are used in Initial Access stage by threat actiors and may contain malicious content. |
| Cisco Cloud Security - Higher values of count of the Same BytesIn size | Hunting Query | 📦 Solution | CiscoUmbrella | Calculate the count of BytesIn per Source-Destination pair over 24 hours. Higher values may indicate beaconing. |
| Cisco Cloud Security - High values of Uploaded Data | Hunting Query | 📦 Solution | CiscoUmbrella | A normal user activity consists mostly of downloading data. Uploaded data is usually small unless there is a file/data upload to a website. Calculate the sum of BytesOut per Source-Destination pair ov... |
| Cisco Cloud Security - Possible connection to C2. | Hunting Query | 📦 Solution | CiscoUmbrella | Calculate the count of BytesIn per Source-Destination pair over 12/24 hours. Higher values may indicate beaconing. C2 servers reply with the same data, making BytesIn value the same. |
| Cisco Cloud Security - Possible data exfiltration | Hunting Query | 📦 Solution | CiscoUmbrella | A normal user activity consists mostly of downloading data. Uploaded data is usually small unless there is a file/data upload to a website. Calculate the sum of BytesOut per Source-Destination pair ov... |
| Cisco Cloud Security - Proxy 'Allowed' to unreliable categories. | Hunting Query | 📦 Solution | CiscoUmbrella | Shows allowed requests to URI categories which heavily are used in Initial Access stage by threat actiors and may contain malicious content. |
| Cisco Cloud Security - Requests to uncategorized resources | Hunting Query | 📦 Solution | CiscoUmbrella | Shows requests to URL where UrlCategory is not set. |
| CiscoUmbrella | Workbook | 📦 Solution | CiscoUmbrella | |
| CiscoUmbrella-AddIpToDestinationList | Playbook | 📦 Solution | CiscoUmbrella | This playbook creates a team notification and once acted on team notification it adds the IP to Cisco Cloud Security's destination list and also add's comment to incident. For more details, click [her... |
| CiscoUmbrella-AssignPolicyToIdentity | Playbook | 📦 Solution | CiscoUmbrella | This playbook provides an automated way to associate an identity to an existing policy in Cisco Cloud Security. For more details, click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solut... |
| CiscoUmbrella-BlockDomain | Playbook | 📦 Solution | CiscoUmbrella | This playbook showcases an example of triggering an incident within a targeted Teams channel and opening up a ticket within Service Now. Additionally The playbook will also list playbooks that can be ... |
| CiscoUmbrella-GetDomainInfo | Playbook | 📦 Solution | CiscoUmbrella | This playbook is used to get Security Information about a particular domain. It provides details such as security scores, reputation and other security-related metadata that can help assess if the dom... |
| Cisco_Umbrella | Parser | 📦 Solution | CiscoUmbrella | |
| Cisco WSA - Access to unwanted site | Analytic Rule | 📦 Solution | CiscoWSA | Detects when users attempting to access sites from high risk category. |
| Cisco WSA - Unexpected uploads | Analytic Rule | 📦 Solution | CiscoWSA | Detects unexpected file uploads. |
| Cisco WSA - Multiple errors to resource from risky category | Analytic Rule | 📦 Solution | CiscoWSA | Detects multiple connection errors to resource from risky category. |
| Cisco WSA - Multiple errors to URL | Analytic Rule | 📦 Solution | CiscoWSA | Detects multiple connection errors to URL. |
| Cisco WSA - Multiple infected files | Analytic Rule | 📦 Solution | CiscoWSA | Detects multiple infected files on same source. |
| Cisco WSA - Multiple attempts to download unwanted file | Analytic Rule | 📦 Solution | CiscoWSA | Detects when multiple attempts to download unwanted file occur. |
| Cisco WSA - Suspected protocol abuse | Analytic Rule | 📦 Solution | CiscoWSA | Detects possible protocol abuse. |
| Cisco WSA - Internet access from public IP | Analytic Rule | 📦 Solution | CiscoWSA | Detects internet access from public IP. |
| Cisco WSA - Unexpected file type | Analytic Rule | 📦 Solution | CiscoWSA | Detects unexpected file type. |
| Cisco WSA - Unexpected URL | Analytic Rule | 📦 Solution | CiscoWSA | Detects unexpected URL. |
| Cisco WSA - Unscannable file or scan error | Analytic Rule | 📦 Solution | CiscoWSA | Detects unscanned downloaded file. |
| Cisco WSA - Blocked files | Hunting Query | 📦 Solution | CiscoWSA | Query searches for blocked files. |
| Cisco WSA - Rare aplications | Hunting Query | 📦 Solution | CiscoWSA | Query searches for rare applications. |
| Cisco WSA - Top aplications | Hunting Query | 📦 Solution | CiscoWSA | Query searches for top applications. |
| Cisco WSA - Top URLs | Hunting Query | 📦 Solution | CiscoWSA | Query searches for top URLs. |
| Cisco WSA - Uncategorized URLs | Hunting Query | 📦 Solution | CiscoWSA | Query searches for uncategorized URLs. |
| Cisco WSA - Uploaded files | Hunting Query | 📦 Solution | CiscoWSA | Query searches for uploaded files. |
| Cisco WSA - Rare URL with error | Hunting Query | 📦 Solution | CiscoWSA | Query searches for rare URLs with errors. |
| Cisco WSA - URL shorteners | Hunting Query | 📦 Solution | CiscoWSA | Query searches connections to Url shorteners resources. |
| Cisco WSA - Potentially risky resources | Hunting Query | 📦 Solution | CiscoWSA | Query searches for potentially risky resources. |
| Cisco WSA - User errors | Hunting Query | 📦 Solution | CiscoWSA | Query searches for user errors during accessing resource. |
| CiscoWSA | Workbook | 📦 Solution | CiscoWSA | |
| CiscoWSAEvent | Parser | 📦 Solution | CiscoWSA | |
| CitrixADCEvent | Parser | 📦 Solution | Citrix ADC | |
| CitrixADCEventOld 🔍 | Parser | 📦 Solution | Citrix ADC | |
| CitrixAnalytics | Workbook | 📦 Solution | Citrix Analytics CCF | |
| Citrix | Workbook | 📦 Solution | Citrix Analytics for Security | |
| CitrixWAF | Workbook | 📦 Solution | Citrix Web App Firewall | |
| Claroty - Asset Down | Analytic Rule | 📦 Solution | Claroty | Triggers asset is down. |
| Claroty - Critical baseline deviation | Analytic Rule | 📦 Solution | Claroty | Detects when critical deviation from baseline occurs. |
| Claroty - Login to uncommon location | Analytic Rule | 📦 Solution | Claroty | Detects user login to uncommon location. |
| Claroty - Multiple failed logins by user | Analytic Rule | 📦 Solution | Claroty | Detects multiple failed logins by same user. |
| Claroty - Multiple failed logins to same destinations | Analytic Rule | 📦 Solution | Claroty | Detects multiple failed logins to same destinations. |
| Claroty - New Asset | Analytic Rule | 📦 Solution | Claroty | Triggers when a new asset has been added into the environment. |
| Claroty - Policy violation | Analytic Rule | 📦 Solution | Claroty | Detects policy violations. |
| Claroty - Suspicious activity | Analytic Rule | 📦 Solution | Claroty | Detects suspicious behavior that is generally indicative of malware. |
| Claroty - Suspicious file transfer | Analytic Rule | 📦 Solution | Claroty | Detects suspicious file transfer activity. |
| Claroty - Threat detected | Analytic Rule | 📦 Solution | Claroty | Detects Collection of known malware commands and control servers. |
| Claroty - Baseline deviation | Hunting Query | 📦 Solution | Claroty | Query searches for baseline deviation events. |
| Claroty - Conflict assets | Hunting Query | 📦 Solution | Claroty | Query searches for conflicting assets. |
| Claroty - Critical Events | Hunting Query | 📦 Solution | Claroty | Query searches for critical severity events. |
| Claroty - PLC logins | Hunting Query | 📦 Solution | Claroty | Query searches for PLC login security alerts. |
| Claroty - Network scan sources | Hunting Query | 📦 Solution | Claroty | Query searches for sources of network scans. |
| Claroty - Network scan targets | Hunting Query | 📦 Solution | Claroty | Query searches for targets of network scans. |
| Claroty - User failed logins | Hunting Query | 📦 Solution | Claroty | Query searches for login failure events. |
| Claroty - Unapproved access | Hunting Query | 📦 Solution | Claroty | Query searches for unapproved access events. |
| Claroty - Unresolved alerts | Hunting Query | 📦 Solution | Claroty | Query searches for alerts with unresolved status. |
| Claroty - Write and Execute operations | Hunting Query | 📦 Solution | Claroty | Query searches for operations with Write and Execute accesses. |
| ClarotyOverview | Workbook | 📦 Solution | Claroty | |
| ClarotyEvent | Parser | 📦 Solution | Claroty | |
| Multi-Factor Authentication Disabled for a User | Analytic Rule | 📦 Solution | Cloud Identity Threat Protection Essentials | Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to deactivate MFA for a user. |
| New External User Granted Admin Role | Analytic Rule | 📦 Solution | Cloud Identity Threat Protection Essentials | This query will detect instances where a newly invited external user is granted an administrative role. By default this query will alert on any granted administrative role, however this can be modifie... |
| Application Granted EWS Permissions | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query finds AD applications with EWS permissions to read user mailboxes. Threat actors could misuse these for persistent mailbox access. Ensure these permissions are legitimately granted and nece... |
| Detect Disabled Account Sign-in Attempts by Account Name | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query searches for failed attempts to sign-in to disabled accounts summarized by account name. This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contex... |
| Detect Disabled Account Sign-in Attempts by IP Address | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query searches for failed sign-in attempts to disabled accounts summarized by the IP originating IP address. |
| Sign-ins from Nord VPN Providers | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query tracks sign-ins via Nord VPN using a daily-updated API. Investigate unfamiliar sign-ins from VPNs unless common in your organization. It now includes UEBA logs IdentityInfo and BehaviorAnal... |
| Sign-ins From VPS Providers | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query finds successful logons from known VPS providers with suspicious token patterns. It's not exhaustive but covers prevalent providers. Now includes UEBA logs IdentityInfo and BehaviorAnalytic... |
| Interactive STS refresh token modifications | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query monitors STS refresh token changes by Service Principals/Applications excluding DirectorySync. It could be due to admins adjusting tokens or for improved login experience. Includes an allow... |
| Suspicious Sign-ins to Privileged Account | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query identifies sign-ins from non-compliant or MFA-less devices to privileged accounts using a pre-built watchlist. Microsoft Sentinel offers customizable watchlist templates for your environmen... |
| User Granted Access and Grants Access to Other Users | Hunting Query | 📦 Solution | Cloud Identity Threat Protection Essentials | This query identifies when a new user is granted access and starts granting access to other users. This can help you identify rogue or malicious user behavior. |
| Azure Key Vault Access Policy Manipulation | Hunting Query | 📦 Solution | Cloud Service Threat Protection Essentials | This query identifies instances where a user is added and subsequently removed from an Azure Key Vault access policy within a short duration, which could indicate attempts to credential access and per... |
| Azure Resources Assigned Public IP Addresses | Hunting Query | 📦 Solution | Cloud Service Threat Protection Essentials | This query identifies instances when public IP addresses are assigned to Azure Resources and show connections to those resources. |
| Cloudflare - Bad client IP | Analytic Rule | 📦 Solution | Cloudflare | Detects requests from IP with bad reputation index. |
| Cloudflare - Empty user agent | Analytic Rule | 📦 Solution | Cloudflare | Detects requests where user agent is empty. |
| Cloudflare - Multiple error requests from single source | Analytic Rule | 📦 Solution | Cloudflare | Detects multiple failure requests from single source in short timeframe. |
| Cloudflare - Multiple user agents for single source | Analytic Rule | 📦 Solution | Cloudflare | Detects requests with different user agents from one source in short timeframe. |
| Cloudflare - Client request from country in blocklist | Analytic Rule | 📦 Solution | Cloudflare | Detects requests from countries which are in blocklist. |
| Cloudflare - Unexpected POST requests | Analytic Rule | 📦 Solution | Cloudflare | Detects post requests to unusual extensions. |
| Cloudflare - Unexpected client request | Analytic Rule | 📦 Solution | Cloudflare | Detects client requests to unusual client request. |
| Cloudflare - Unexpected URI | Analytic Rule | 📦 Solution | Cloudflare | Detects client requests to unusual URI. |
| Cloudflare - WAF Allowed threat | Analytic Rule | 📦 Solution | Cloudflare | Detects WAF "Allowed" action on threat events. |
| Cloudflare - XSS probing pattern in request | Analytic Rule | 📦 Solution | Cloudflare | Detects XSS probing patterns. |
| Cloudflare - Client errors | Hunting Query | 📦 Solution | Cloudflare | Query searches for client related errors. |
| Cloudflare - Client TLS errors | Hunting Query | 📦 Solution | Cloudflare | Query searches for client TLS errors. |
| Cloudflare - Files requested | Hunting Query | 📦 Solution | Cloudflare | Query searches for files requested. |
| Cloudflare - Rare user agents | Hunting Query | 📦 Solution | Cloudflare | Query searches rare user agent strings. |
| Cloudflare - Server errors | Hunting Query | 📦 Solution | Cloudflare | Query searches for server related errors. |
| Cloudflare - Server TLS errors | Hunting Query | 📦 Solution | Cloudflare | Query searches for server TLS errors. |
| Cloudflare - Top Network rules | Hunting Query | 📦 Solution | Cloudflare | Query searches top network rules triggered. |
| Cloudflare - Top WAF rules | Hunting Query | 📦 Solution | Cloudflare | Query searches top WAF rules triggered. |
| Cloudflare - Unexpected countries | Hunting Query | 📦 Solution | Cloudflare | Query searches requests by country and helps to identify requests coming from unexpected countries. |
| Cloudflare - Unexpected edge response | Hunting Query | 📦 Solution | Cloudflare | Query searches for unexpected EdgeResponseStatus values. |
| Cloudflare | Workbook | 📦 Solution | Cloudflare | |
| Cloudflare | Parser | 📦 Solution | Cloudflare | |
| Cloudflare - Bad client IP | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects requests from IP with bad reputation index. |
| Cloudflare - Empty user agent | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects requests where user agent is empty. |
| Cloudflare - Multiple error requests from single source | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects multiple failure requests from single source in short timeframe. |
| Cloudflare - Multiple user agents for single source | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects requests with different user agents from one source in short timeframe. |
| Cloudflare - Client request from country in blocklist | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects requests from countries which are in blocklist. |
| Cloudflare - Unexpected POST requests | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects post requests to unusual extensions. |
| Cloudflare - Unexpected client request | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects client requests to unusual client request. |
| Cloudflare - Unexpected URI | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects client requests to unusual URI. |
| Cloudflare - WAF Allowed threat | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects WAF "Allowed" action on threat events. |
| Cloudflare - XSS probing pattern in request | Analytic Rule | 📦 Solution | Cloudflare CCF | Detects XSS probing patterns. |
| Cloudflare - Client errors | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches for client related errors. |
| Cloudflare - Client TLS errors | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches for client TLS errors. |
| Cloudflare - Files requested | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches for files requested. |
| Cloudflare - Rare user agents | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches rare user agent strings. |
| Cloudflare - Server errors | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches for server related errors. |
| Cloudflare - Server TLS errors | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches for server TLS errors. |
| Cloudflare - Top Network rules | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches top network rules triggered. |
| Cloudflare - Top WAF rules | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches top WAF rules triggered. |
| Cloudflare - Unexpected countries | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches requests by country and helps to identify requests coming from unexpected countries. |
| Cloudflare - Unexpected edge response | Hunting Query | 📦 Solution | Cloudflare CCF | Query searches for unexpected EdgeResponseStatus values. |
| Cloudflare | Workbook | 📦 Solution | Cloudflare CCF | |
| Cloudflare | Parser | 📦 Solution | Cloudflare CCF | |
| CofenseIntelligenceThreatIndicators | Workbook | 📦 Solution | CofenseIntelligence | |
| CofenseTriageThreatIndicators | Workbook | 📦 Solution | CofenseTriage | |
| Cognni Incidents for Highly Sensitive Business Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which highly sensitive business information was placed at risk by user sharing. |
| Cognni Incidents for Highly Sensitive Financial Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which highly sensitive financial information was placed at risk by user sharing. |
| Cognni Incidents for Highly Sensitive Governance Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which highly sensitive governance information was placed at risk by user sharing. |
| Cognni Incidents for Highly Sensitive HR Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which highly sensitive HR information was placed at risk by user sharing. |
| Cognni Incidents for Highly Sensitive Legal Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which highly sensitive legal information was placed at risk by user sharing. |
| Cognni Incidents for Low Sensitivity Business Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which low sensitivity business information] was placed at risk by user sharing. |
| Cognni Incidents for Low Sensitivity Financial Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which low sensitivity financial information was placed at risk by user sharing. |
| Cognni Incidents for Low Sensitivity Governance Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which low sensitivity governance information] was placed at risk by user sharing. |
| Cognni Incidents for Low Sensitivity HR Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which low sensitive HR information was placed at risk by user sharing. |
| Cognni Incidents for Low Sensitivity Legal Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which low sensitivity legal information was placed at risk by user sharing. |
| Cognni Incidents for Medium Sensitivity Business Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which medium sensitivity business information was placed at risk by user sharing. |
| Cognni Incidents for Medium Sensitivity Financial Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which medium sensitive financial information was placed at risk by user sharing. |
| Cognni Incidents for Medium Sensitivity Governance Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which medium sensitivity governance information was placed at risk by user sharing. |
| Cognni Incidents for Medium Sensitivity HR Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which medium sensitivity HR information was placed at risk by user sharing. |
| Cognni Incidents for Medium Sensitivity Legal Information | Analytic Rule | 📦 Solution | Cognni | Display incidents in which medium sensitivity legal information was placed at risk by user sharing. |
| CognniIncidentsWorkbook | Workbook | 📦 Solution | Cognni | |
| Close Cohesity Helios Incident | Playbook | 📦 Solution | CohesitySecurity | This playbook closes the corresponding Cohesity DataHawk (Helios) ticket. |
| Cohesity Create or Update ServiceNow incident | Playbook | 📦 Solution | CohesitySecurity | This playbook creates and updates the incident in the ServiceNow platform. |
| Delete Cohesity incident blobs | Playbook | 📦 Solution | CohesitySecurity | This playbook deletes the blobs on Azure storage created by an incident that is generated by Cohesity function apps. |
| Restore From Last Cohesity Snapshot | Playbook | 📦 Solution | CohesitySecurity | This playbook restores the latest good Data Hawk (Helios) snapshot. |
| Cohesity Incident Email | Playbook | 📦 Solution | CohesitySecurity | This playbook sends an email to the recipient with the details related to the incidents. |
| CEFOverviewWorkbook | Workbook | 📦 Solution | Common Event Format | |
| Commvault Cloud Alert | Analytic Rule | 📦 Solution | Commvault Security IQ | This query identifies Alerts from Commvault Cloud. |
| Commvault Disable Data Aging Logic App Playbook | Playbook | 📦 Solution | Commvault Security IQ | This Logic App executes when called upon by an Automation Rule. Accessing the KeyVault to retrieve various credentials, it executes a specific runbook depending on the use case. |
| Commvault Disable SAML Provider Logic App Playbook | Playbook | 📦 Solution | Commvault Security IQ | This Logic App executes when called upon by an Automation Rule. Accessing the KeyVault to retrieve various credentials, it executes a specific runbook depending on the use case. |
| Commvault Disable User Logic App Playbook | Playbook | 📦 Solution | Commvault Security IQ | This Logic App executes when called upon by an Automation Rule. Accessing the KeyVault to retrieve various credentials, it executes a specific runbook depending on the use case. |
| CDM_ContinuousDiagnostics&Mitigation_PostureChanged | Analytic Rule | 📦 Solution | ContinuousDiagnostics&Mitigation | This alert is designed to monitor Azure policies aligned with the Continuous Diagnostics & Mitigation (CDM) Program. The alert triggers when policy compliance falls below 70% within a 1 week timeframe... |
| CDM_ContinuousDiagnostics&Mitigation_Posture | Hunting Query | 📦 Solution | ContinuousDiagnostics&Mitigation | This hunting query is designed to monitor Azure policies aligned with the Continuous Diagnostics & Mitigation (CDM) Program. It provides a policy check assessment of current CDM policy status across c... |
| ContinuousDiagnostics&Mitigation | Workbook | 📦 Solution | ContinuousDiagnostics&Mitigation | |
| Contrast Blocks | Analytic Rule | 📦 Solution | Contrast Protect | Creates Incidents for Blocked events sourced from the Contrast Protect agent. |
| Contrast Exploits | Analytic Rule | 📦 Solution | Contrast Protect | Creates Incidents for Exploit events sourced from the Contrast Protect agent. |
| Contrast Probes | Analytic Rule | 📦 Solution | Contrast Protect | Creates Incidents for Probed events sourced from the Contrast Protect agent. |
| Contrast Suspicious | Analytic Rule | 📦 Solution | Contrast Protect | Creates Incidents for Suspicious events sourced from the Contrast Protect agent. |
| ContrastProtect | Workbook | 📦 Solution | Contrast Protect | |
| Contrast ADR - EDR Alert Correlation | Analytic Rule | 📦 Solution | ContrastADR | Correlates Contrast ADR incidents with specific high-risk attack patterns including command injection, deserialization attacks, and file upload vulnerabilities. This rule identifies confirmed security... |
| Contrast ADR - WAF Alert Correlation | Analytic Rule | 📦 Solution | ContrastADR | Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on at... |
| Contrast ADR - Exploited Attack Event | Analytic Rule | 📦 Solution | ContrastADR | Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security con... |
| Contrast ADR - Exploited Attack in Production | Analytic Rule | 📦 Solution | ContrastADR | Detects successful exploitation of security vulnerabilities in production environments as identified by Contrast ADR. This rule triggers on confirmed exploited attacks in production systems, requiring... |
| Contrast ADR - DLP SQL Injection Correlation | Analytic Rule | 📦 Solution | ContrastADR | Detects successful SQL injection attacks identified by Contrast ADR and correlates them with WAF/DLP logs. This rule identifies critical database security breaches that have bypassed initial defenses ... |
| Contrast ADR - Security Incident Alert | Analytic Rule | 📦 Solution | ContrastADR | Monitors Contrast ADR security incidents across all applications and environments. This rule creates alerts for all security incidents detected by Contrast Security ADR, providing comprehensive visibi... |
| ContrastADR_Command_Injection_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_Cross_Site_Scripting_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_Expression_Language_Injection_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_HTTP_Method_Tampering_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_JNDI_Injection_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_Path_Traversal_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_SQL_Injection_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_Untrusted_Deserialization_Workbook | Workbook | 📦 Solution | ContrastADR | |
| ContrastADR_XML External_Entity_Injection_Injection_Workbook | Workbook | 📦 Solution | ContrastADR | |
| Contrast_alert_event_parser | Parser | 📦 Solution | ContrastADR | |
| Contrast_incident_parser | Parser | 📦 Solution | ContrastADR | |
| Corelight - C2 DGA Detected Via Repetitive Failures | Analytic Rule | 📦 Solution | Corelight | Detects large amounts of DNS resolution failures. |
| Corelight - External Proxy Detected | Analytic Rule | 📦 Solution | Corelight | Detects external proxy usage. |
| Corelight - Forced External Outbound SMB | Analytic Rule | 📦 Solution | Corelight | Detects SMB requests that originate internally and communicate with an external IP address. |
| Corelight - Multiple Compressed Files Transferred over HTTP | Analytic Rule | 📦 Solution | Corelight | Detects compressed archives transferre over HTTP. |
| Corelight - Multiple files sent over HTTP with abnormal requests | Analytic Rule | 📦 Solution | Corelight | Detects sources sending multiple compressed files greater than 10MBs sent over HTTP in a short amount of time. |
| Corelight - Network Service Scanning Multiple IP Addresses | Analytic Rule | 📦 Solution | Corelight | Identify scanning of services that may be available on the internal network. |
| Corelight - Possible Webshell | Analytic Rule | 📦 Solution | Corelight | Detects post requests to unusual extensions. |
| Corelight - Possible Webshell (Rare PUT or POST) | Analytic Rule | 📦 Solution | Corelight | Detects rare post requests to a single webserver location. |
| Corelight - SMTP Email containing NON Ascii Characters within the Subject | Analytic Rule | 📦 Solution | Corelight | Detects where an emails contain non ascii characters within the Subject. |
| Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request | Analytic Rule | 📦 Solution | Corelight | Detects when an HTTP request was made to a domain that was using unicode/punycode. |
| Corelight - Abnormal Email Subject | Hunting Query | 📦 Solution | Corelight | Query searches for emails with NON-Ascii characters within the Subject . |
| Corelight - Compressed Files Transferred over HTTP | Hunting Query | 📦 Solution | Corelight | Query searches for top sources which transferred compressed archives over HTTP. |
| Corelight - Top sources of data transferred | Hunting Query | 📦 Solution | Corelight | Query searches for top sources by transferred data over period of time. |
| Corelight - External Facing Services | Hunting Query | 📦 Solution | Corelight | Query searches for external facing services. |
| Corelight - Files in logs | Hunting Query | 📦 Solution | Corelight | Query searches for files which where seen in logs over period of time. |
| Corelight - File uploads by source | Hunting Query | 📦 Solution | Corelight | Query searches for files uploaded over period of time by each source. |
| Corelight - Multiple Remote SMB Connections from single client | Hunting Query | 📦 Solution | Corelight | Detects when a single source is connecting to many different SMB or file shares. |
| Corelight - Obfuscated binary filenames | Hunting Query | 📦 Solution | Corelight | Query searches for downloaded obfuscated binary file names. |
| Corelight - Rare PUT or POST | Hunting Query | 📦 Solution | Corelight | Query searches for rare post requests to a single location. |
| Corelight - Repetitive DNS Failures | Hunting Query | 📦 Solution | Corelight | Query searches for repetitive DNS resolution failures from single host. |
| Corelight | Workbook | 📦 Solution | Corelight | |
| Corelight_Alert_Aggregations | Workbook | 📦 Solution | Corelight | |
| Corelight_AWS_VPC_Flow | Workbook | 📦 Solution | Corelight | |
| Corelight_Data_Explorer | Workbook | 📦 Solution | Corelight | |
| Corelight_Security_Workflow | Workbook | 📦 Solution | Corelight | |
| Corelight_Sensor_Overview | Workbook | 📦 Solution | Corelight | |
| Corelight | Parser | 📦 Solution | Corelight | |
| corelight_anomaly | Parser | 📦 Solution | Corelight | |
| corelight_bacnet | Parser | 📦 Solution | Corelight | |
| corelight_capture_loss | Parser | 📦 Solution | Corelight | |
| corelight_cip | Parser | 📦 Solution | Corelight | |
| corelight_conn | Parser | 📦 Solution | Corelight | |
| corelight_conn_agg | Parser | 📦 Solution | Corelight | |
| corelight_conn_long | Parser | 📦 Solution | Corelight | |
| corelight_conn_red | Parser | 📦 Solution | Corelight | |
| corelight_corelight_burst | Parser | 📦 Solution | Corelight | |
| corelight_corelight_metrics_disk | Parser | 📦 Solution | Corelight | |
| corelight_corelight_metrics_iface | Parser | 📦 Solution | Corelight | |
| corelight_corelight_metrics_memory | Parser | 📦 Solution | Corelight | |
| corelight_corelight_metrics_system | Parser | 📦 Solution | Corelight | |
| corelight_corelight_metrics_zeek_doctor | Parser | 📦 Solution | Corelight | |
| corelight_corelight_overall_capture_loss | Parser | 📦 Solution | Corelight | |
| corelight_corelight_profiling | Parser | 📦 Solution | Corelight | |
| corelight_datared | Parser | 📦 Solution | Corelight | |
| corelight_dce_rpc | Parser | 📦 Solution | Corelight | |
| corelight_dga | Parser | 📦 Solution | Corelight | |
| corelight_dhcp | Parser | 📦 Solution | Corelight | |
| corelight_dnp3 | Parser | 📦 Solution | Corelight | |
| corelight_dns | Parser | 📦 Solution | Corelight | |
| corelight_dns_agg | Parser | 📦 Solution | Corelight | |
| corelight_dns_red | Parser | 📦 Solution | Corelight | |
| corelight_dpd | Parser | 📦 Solution | Corelight | |
| corelight_encrypted_dns | Parser | 📦 Solution | Corelight | |
| corelight_enip | Parser | 📦 Solution | Corelight | |
| corelight_enip_debug | Parser | 📦 Solution | Corelight | |
| corelight_enip_list_identity | Parser | 📦 Solution | Corelight | |
| corelight_etc_viz | Parser | 📦 Solution | Corelight | |
| corelight_files | Parser | 📦 Solution | Corelight | |
| corelight_files_agg | Parser | 📦 Solution | Corelight | |
| corelight_files_red | Parser | 📦 Solution | Corelight | |
| corelight_first_seen | Parser | 📦 Solution | Corelight | |
| corelight_ftp | Parser | 📦 Solution | Corelight | |
| corelight_generic_dns_tunnels | Parser | 📦 Solution | Corelight | |
| corelight_generic_icmp_tunnels | Parser | 📦 Solution | Corelight | |
| corelight_http | Parser | 📦 Solution | Corelight | |
| corelight_http2 | Parser | 📦 Solution | Corelight | |
| corelight_http_agg | Parser | 📦 Solution | Corelight | |
| corelight_http_red | Parser | 📦 Solution | Corelight | |
| corelight_icmp_specific_tunnels | Parser | 📦 Solution | Corelight | |
| corelight_intel | Parser | 📦 Solution | Corelight | |
| corelight_ipsec | Parser | 📦 Solution | Corelight | |
| corelight_irc | Parser | 📦 Solution | Corelight | |
| corelight_iso_cotp | Parser | 📦 Solution | Corelight | |
| corelight_kerberos | Parser | 📦 Solution | Corelight | |
| corelight_known_certs | Parser | 📦 Solution | Corelight | |
| corelight_known_devices | Parser | 📦 Solution | Corelight | |
| corelight_known_domains | Parser | 📦 Solution | Corelight | |
| corelight_known_hosts | Parser | 📦 Solution | Corelight | |
| corelight_known_names | Parser | 📦 Solution | Corelight | |
| corelight_known_remotes | Parser | 📦 Solution | Corelight | |
| corelight_known_services | Parser | 📦 Solution | Corelight | |
| corelight_known_users | Parser | 📦 Solution | Corelight | |
| corelight_local_subnets | Parser | 📦 Solution | Corelight | |
| corelight_local_subnets_dj | Parser | 📦 Solution | Corelight | |
| corelight_local_subnets_graphs | Parser | 📦 Solution | Corelight | |
| corelight_log4shell | Parser | 📦 Solution | Corelight | |
| corelight_modbus | Parser | 📦 Solution | Corelight | |
| corelight_mqtt_connect | Parser | 📦 Solution | Corelight | |
| corelight_mqtt_publish | Parser | 📦 Solution | Corelight | |
| corelight_mqtt_subscribe | Parser | 📦 Solution | Corelight | |
| corelight_mysql | Parser | 📦 Solution | Corelight | |
| corelight_notice | Parser | 📦 Solution | Corelight | |
| corelight_ntlm | Parser | 📦 Solution | Corelight | |
| corelight_ntp | Parser | 📦 Solution | Corelight | |
| corelight_ocsp | Parser | 📦 Solution | Corelight | |
| corelight_openflow | Parser | 📦 Solution | Corelight | |
| corelight_packet_filter | Parser | 📦 Solution | Corelight | |
| corelight_pe | Parser | 📦 Solution | Corelight | |
| corelight_profinet | Parser | 📦 Solution | Corelight | |
| corelight_profinet_dce_rpc | Parser | 📦 Solution | Corelight | |
| corelight_profinet_debug | Parser | 📦 Solution | Corelight | |
| corelight_radius | Parser | 📦 Solution | Corelight | |
| corelight_rdp | Parser | 📦 Solution | Corelight | |
| corelight_reporter | Parser | 📦 Solution | Corelight | |
| corelight_rfb | Parser | 📦 Solution | Corelight | |
| corelight_s7comm | Parser | 📦 Solution | Corelight | |
| corelight_signatures | Parser | 📦 Solution | Corelight | |
| corelight_sip | Parser | 📦 Solution | Corelight | |
| corelight_smartpcap | Parser | 📦 Solution | Corelight | |
| corelight_smartpcap_stats | Parser | 📦 Solution | Corelight | |
| corelight_smb_files | Parser | 📦 Solution | Corelight | |
| corelight_smb_mapping | Parser | 📦 Solution | Corelight | |
| corelight_smtp | Parser | 📦 Solution | Corelight | |
| corelight_smtp_links | Parser | 📦 Solution | Corelight | |
| corelight_snmp | Parser | 📦 Solution | Corelight | |
| corelight_socks | Parser | 📦 Solution | Corelight | |
| corelight_software | Parser | 📦 Solution | Corelight | |
| corelight_specific_dns_tunnels | Parser | 📦 Solution | Corelight | |
| corelight_ssh | Parser | 📦 Solution | Corelight | |
| corelight_ssl | Parser | 📦 Solution | Corelight | |
| corelight_ssl_agg | Parser | 📦 Solution | Corelight | |
| corelight_ssl_red | Parser | 📦 Solution | Corelight | |
| corelight_stats | Parser | 📦 Solution | Corelight | |
| corelight_stepping | Parser | 📦 Solution | Corelight | |
| corelight_stun | Parser | 📦 Solution | Corelight | |
| corelight_stun_nat | Parser | 📦 Solution | Corelight | |
| corelight_suricata_corelight | Parser | 📦 Solution | Corelight | |
| corelight_suricata_eve | Parser | 📦 Solution | Corelight | |
| corelight_suricata_stats | Parser | 📦 Solution | Corelight | |
| corelight_suricata_zeek_stats | Parser | 📦 Solution | Corelight | |
| corelight_suri_aggregations | Parser | 📦 Solution | Corelight | |
| corelight_syslog | Parser | 📦 Solution | Corelight | |
| corelight_tds | Parser | 📦 Solution | Corelight | |
| corelight_tds_rpc | Parser | 📦 Solution | Corelight | |
| corelight_tds_sql_batch | Parser | 📦 Solution | Corelight | |
| corelight_traceroute | Parser | 📦 Solution | Corelight | |
| corelight_tunnel | Parser | 📦 Solution | Corelight | |
| corelight_unknown_smartpcap | Parser | 📦 Solution | Corelight | |
| corelight_util_stats | Parser | 📦 Solution | Corelight | |
| corelight_vpn | Parser | 📦 Solution | Corelight | |
| corelight_weird | Parser | 📦 Solution | Corelight | |
| corelight_weird_agg | Parser | 📦 Solution | Corelight | |
| corelight_weird_red | Parser | 📦 Solution | Corelight | |
| corelight_weird_stats | Parser | 📦 Solution | Corelight | |
| corelight_wireguard | Parser | 📦 Solution | Corelight | |
| corelight_x509 | Parser | 📦 Solution | Corelight | |
| corelight_x509_red | Parser | 📦 Solution | Corelight | |
| corelight_zeek_doctor | Parser | 📦 Solution | Corelight | |
| CorelightAggregationsEnrichment1 | Watchlist | 📦 Solution | Corelight | |
| CorelightAggregationsEnrichment2 | Watchlist | 📦 Solution | Corelight | |
| CorelightDNSPortDesc | Watchlist | 📦 Solution | Corelight | |
| CorelightGeoCountries | Watchlist | 📦 Solution | Corelight | |
| CorelightInferencesDesc | Watchlist | 📦 Solution | Corelight | |
| Cortex XDR Incident - High | Analytic Rule | 📦 Solution | Cortex XDR | A new incident was created in the Cortex XDR portal with a severity "High". Click on the events for incident details. |
| Cortex XDR Incident - Low | Analytic Rule | 📦 Solution | Cortex XDR | A new incident was created in the Cortex XDR portal with a severity "Low". Click on the events for incident details. |
| Cortex XDR Incident - Medium | Analytic Rule | 📦 Solution | Cortex XDR | A new incident was created in the Cortex XDR portal with a severity "Medium". Click on the events for incident details. |
| PaloAltoCortexXDR | Parser | 📦 Solution | Cortex XDR | |
| CriblAccess | Parser | 📦 Solution | Cribl | |
| CriblAudit | Parser | 📦 Solution | Cribl | |
| CriblInternal | Parser | 📦 Solution | Cribl | |
| CriblUIAccess | Parser | 📦 Solution | Cribl | |
| Critical or High Severity Detections by User | Analytic Rule | 📦 Solution | CrowdStrike Falcon Endpoint Protection | Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user |
| Critical Severity Detection | Analytic Rule | 📦 Solution | CrowdStrike Falcon Endpoint Protection | Creates an incident when a CrowdStrike Falcon sensor detection is triggered with a Critical Severity |
| CrowdStrikeFalconEndpointProtection | Workbook | 📦 Solution | CrowdStrike Falcon Endpoint Protection | |
| Crowdstrike API authentication | Playbook | 📦 Solution | CrowdStrike Falcon Endpoint Protection | This is Crowdstrike base template which is used to generate access token and this is used in actual crowdstrike templates. This playbook gets triggered when a new Http request is created and this is b... |
| Isolate endpoint - Crowdstrike | Playbook | 📦 Solution | CrowdStrike Falcon Endpoint Protection | When a new Microsoft Sentinel incident is created, this playbook gets triggered and performs below actions: |
| Endpoint enrichment - Crowdstrike | Playbook | 📦 Solution | CrowdStrike Falcon Endpoint Protection | When a new Microsoft Sentinel incident is created, this playbook gets triggered and performs below actions: |
| CrowdStrikeFalconEventStream | Parser | 📦 Solution | CrowdStrike Falcon Endpoint Protection | |
| CrowdStrikeReplicator | Parser | 📦 Solution | CrowdStrike Falcon Endpoint Protection | |
| CrowdStrikeReplicatorV2 | Parser | 📦 Solution | CrowdStrike Falcon Endpoint Protection | |
| CrowdStrikeReplicator_future 🔍 | Parser | 📦 Solution | CrowdStrike Falcon Endpoint Protection | |
| Antivirus Detected an Infected File | Analytic Rule | 📦 Solution | CTERA | Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers. |
| CTERA Mass Access Denied Detection Analytic | Analytic Rule | 📦 Solution | CTERA | This analytic rule detects and alerts when access denied operations generated by the CTERA Edge Filer goes over a predefined threshold |
| CTERA Mass Deletions Detection Analytic | Analytic Rule | 📦 Solution | CTERA | This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer |
| CTERA Mass Permissions Changes Detection Analytic | Analytic Rule | 📦 Solution | CTERA | This analytic rule detects and alerts when access denied operations generated by the CTERA Edge Filer goes over a predefined threshold |
| Ransom Protect Detected a Ransomware Attack | Analytic Rule | 📦 Solution | CTERA | Monitors CTERA platform to detect potential ransomware attacks detected by CTERA Ransom Protect AI engine. |
| Ransom Protect User Blocked | Analytic Rule | 📦 Solution | CTERA | Detects malicious users blocked by CTERA Ransom Protect AI engine. |
| CTERA Batch Access Denied Detection | Hunting Query | 📦 Solution | CTERA | This query detects access denied events generated by the CTERA Edge Filer |
| CTERA Batch File Deletions Detection | Hunting Query | 📦 Solution | CTERA | This query detects file deletions generated by the CTERA Edge Filer. |
| CTERA Permission Change Detection | Hunting Query | 📦 Solution | CTERA | This query detects permission changes generated by the CTERA Edge Filer. |
| CTERA_Workbook | Workbook | 📦 Solution | CTERA | |
| CyberBlindSpot - Any Issue Detected 🔍 | Analytic Rule | 📦 Solution | CTM360 | Generic alert that triggers when ANY CyberBlindSpot issue/incident is detected in the logs. Extracts nested metadata from RawPayload. |
| HackerView - Any Issue Detected 🔍 | Analytic Rule | 📦 Solution | CTM360 | Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload. |
| CBSLog_Parser 🔍 | Parser | 📦 Solution | CTM360 | |
| CBS_BreachedCredentials_Parser 🔍 | Parser | 📦 Solution | CTM360 | |
| CBS_CompromisedCards_Parser 🔍 | Parser | 📦 Solution | CTM360 | |
| CBS_DomainInfringement_Parser 🔍 | Parser | 📦 Solution | CTM360 | |
| CBS_MalwareLogs_Parser 🔍 | Parser | 📦 Solution | CTM360 | |
| CBS_SubdomainInfringement_Parser 🔍 | Parser | 📦 Solution | CTM360 | |
| HackerViewLog_Parser 🔍 | Parser | 📦 Solution | CTM360 | |
| CyberArkEPV | Workbook | 📦 Solution | CyberArk Privilege Access Manager (PAM) Events | |
| CyberArk - High-Risk Actions Outside Business Hours | Analytic Rule | 📦 Solution | CyberArkAudit | Detects privileged or destructive actions (delete/disable/rotate/elevate/etc.) occurring outside standard business hours. Useful for insider misuse or compromised admin detection. |
| CyberArk - Multiple Failed Actions Followed by Success (15m) | Analytic Rule | 📦 Solution | CyberArkAudit | Detects 3+ failed actions against an account followed by a success in a short window, indicating brute-force or credential guessing. |
| CyberArk - Sensitive Safe/Permission/Entitlement Changes (with customData) | Analytic Rule | 📦 Solution | CyberArkAudit | Alerts on control-plane modifications: safes, permissions, roles, entitlements, policy changes. Leverages customData fields such as changeType/role/permission/policy/entitlement to reduce misses. |
| CyberArkEPM - Attack attempt not blocked | Analytic Rule | 📦 Solution | CyberArkEPM | This rule triggers on attack attempt which was not blocked by CyberArkEPM. |
| CyberArkEPM - MSBuild usage as LOLBin | Analytic Rule | 📦 Solution | CyberArkEPM | Detects usage of msbuild tool as LOLBin. |
| CyberArkEPM - Multiple attack types | Analytic Rule | 📦 Solution | CyberArkEPM | This rule triggers on multiple attack attemts triggered by same user. |
| CyberArkEPM - Uncommon Windows process started from System folder | Analytic Rule | 📦 Solution | CyberArkEPM | Detects when uncommon windows proccess is started from System folder. |
| CyberArkEPM - Possible execution of Powershell Empire | Analytic Rule | 📦 Solution | CyberArkEPM | Detects possible execution of Powershell Empire. |
| CyberArkEPM - Process started from different locations | Analytic Rule | 📦 Solution | CyberArkEPM | Detects when process started from different locations on a host. |
| CyberArkEPM - Uncommon process Internet access | Analytic Rule | 📦 Solution | CyberArkEPM | Detects access to the Internet by uncommon processes. |
| CyberArkEPM - Renamed Windows binary | Analytic Rule | 📦 Solution | CyberArkEPM | Detects renamed windows binaries. |
| CyberArkEPM - Unexpected executable extension | Analytic Rule | 📦 Solution | CyberArkEPM | Detects Windows executable with unexpected extension. |
| CyberArkEPM - Unexpected executable location | Analytic Rule | 📦 Solution | CyberArkEPM | Detects program run from unexpected location. |
| CyberArkEPM - Elevation requests | Hunting Query | 📦 Solution | CyberArkEPM | Query shows elevation requests. |
| CyberArkEPM - Powershell downloads | Hunting Query | 📦 Solution | CyberArkEPM | Query shows powershell downloads. |
| CyberArkEPM - Powershell scripts execution parameters | Hunting Query | 📦 Solution | CyberArkEPM | Query shows powershell scripts execution parameters. |
| CyberArkEPM - Processes with Internet access attempts | Hunting Query | 📦 Solution | CyberArkEPM | Query shows processes which attempted to access Internet. |
| CyberArkEPM - Processes run as admin | Hunting Query | 📦 Solution | CyberArkEPM | Query shows processes run as admin. |
| CyberArkEPM - Process hash changed | Hunting Query | 📦 Solution | CyberArkEPM | Query shows processes which hash has been changed recently. |
| CyberArkEPM - Rare process run by users | Hunting Query | 📦 Solution | CyberArkEPM | Query shows rare process run by users. |
| CyberArkEPM - Rare process vendors | Hunting Query | 📦 Solution | CyberArkEPM | Query shows rare process vendors. |
| CyberArkEPM - Scripts executed on hosts | Hunting Query | 📦 Solution | CyberArkEPM | Query shows scripts which where executed on hosts. |
| CyberArkEPM - Suspicious activity attempts | Hunting Query | 📦 Solution | CyberArkEPM | Query shows suspicious activity attempts. |
| CyberArkEPM | Workbook | 📦 Solution | CyberArkEPM | |
| CyberArkEPM | Parser | 📦 Solution | CyberArkEPM | |
| CMMC 2.0 Level 1 (Foundational) Readiness Posture | Analytic Rule | 📦 Solution | CybersecurityMaturityModelCertification(CMMC)2.0 | CMMC 2.0 Level 1 (Foundational) assessments have deviated from configured threshold baselines. This alert is triggered when CMMC2.0 policy compliance is assessed below 70% compliance in 7 days. |
| CMMC 2.0 Level 2 (Advanced) Readiness Posture | Analytic Rule | 📦 Solution | CybersecurityMaturityModelCertification(CMMC)2.0 | CMMC 2.0 Level 2 (Advanced) assessments have deviated from configured threshold baselines. This alert is triggered when CMMC2.0 policy compliance is assessed below 70% compliance in 7 days. |
| CybersecurityMaturityModelCertification_CMMCV2 | Workbook | 📦 Solution | CybersecurityMaturityModelCertification(CMMC)2.0 | |
| Create-AzureDevOpsTask | Playbook | 📦 Solution | CybersecurityMaturityModelCertification(CMMC)2.0 | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| Create Jira Issue | Playbook | 📦 Solution | CybersecurityMaturityModelCertification(CMMC)2.0 | This playbook will open a Jira Issue when a new incident is opened in Microsoft Sentinel. |
| Notify_GovernanceComplianceTeam | Playbook | 📦 Solution | CybersecurityMaturityModelCertification(CMMC)2.0 | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| Cybersixgill Actionable alerts | Hunting Query | 📦 Solution | Cybersixgill-Actionable-Alerts | View Cybersixgill Actionable alerts for last 30 days |
| ActionableAlertsDashboard | Workbook | 📦 Solution | Cybersixgill-Actionable-Alerts | |
| ActionableAlertsList | Workbook | 📦 Solution | Cybersixgill-Actionable-Alerts | |
| Cybersixgill-Alert-Status-Update | Playbook | 📦 Solution | Cybersixgill-Actionable-Alerts | This playbook will update status of Cybersixgill Alerts when respective incident status is updated in Microsoft Sentinel |
| Delete-Cybersixgill-Alert | Playbook | 📦 Solution | Cybersixgill-Actionable-Alerts | This playbook will delete Alert on Cybersixgill portal when resective Incident is deleted in Microsoft Sentinel |
| Cyble Advisory Alerts Advisory 🔍 | Analytic Rule | 📦 Solution | Cyble Vision | Generates Microsoft Sentinel incidents from Cyble Advisory service alerts. Advisory alerts provide intelligence and context related to monitored keywords.Severity is normalized using MappedSeverity fo... |
| Cyble Vision Alerts Assets | Analytic Rule | 📦 Solution | Cyble Vision | Scheduled rule that creates incidents for asset alerts using saved parser Alerts_assets. Mandatory custom details: MappedSeverity, Status, AlertID, Service. |
| Cyble Vision Alerts Bitbucket | Analytic Rule | 📦 Solution | Cyble Vision | Detects exposed secrets in Bitbucket repositories using the Alerts_bit_bucket parser. Creates one incident per matched secret. Includes decoder, detector, commit, file, and repository context for SOC ... |
| Cyble Vision Alerts Cloud Storage | Analytic Rule | 📦 Solution | Cyble Vision | Detects cloud storage objects/paths discovered in ingestion (uses Alerts_cloud_storage parser). Creates incidents for discovered S3/GCS/Azure blob objects, includes bucket/object/url, size and workflo... |
| Cyble Vision Alerts Compromised Endpoint Cookies | Analytic Rule | 📦 Solution | Cyble Vision | Detects compromised browser cookies associated with monitored entities. Identifies exposed authentication cookies with future expiry, enabling potential session hijacking or persistent unauthorized ac... |
| Cyble Vision Alerts Compromised Files | Analytic Rule | 📦 Solution | Cyble Vision | Detects compromised files containing credential or logon data (stealer logs) related to monitored entities. Uses Alerts_compromised_files parser to expose file paths, log objects, and extracted email ... |
| CybleVision Alerts Cyber Crime Forum Alerts | Analytic Rule | 📦 Solution | Cyble Vision | Detects discussions, marketplace posts, threat actor activity, and intelligence mentions from cybercrime forums. Extracts discussion metadata, topic details, URLs, emails, phone numbers, and content u... |
| Cyble Vision Alerts Darkweb Data Breaches | Analytic Rule | 📦 Solution | Cyble Vision | Detects darkweb credential leakage and data breach records from CybleVision. Extracts leaked username, email, password hashes, registration dates, and metadata using the Alerts_DarkwebDataBreaches par... |
| CybleVision Alerts Darkweb Marketplace Alerts | Analytic Rule | 📦 Solution | Cyble Vision | Detects stolen credentials, financial information, stealer logs, and related payloads listed on Darkweb marketplaces such as RussianMarket. Extracts card data, victim info, metadata, and marketplace c... |
| Cyble Vision Alerts Darkweb Ransomware Leak | Analytic Rule | 📦 Solution | Cyble Vision | A ransomware threat actor has posted victim data on the dark web. This alert includes leaked documents, threat actor name, victim organization, timestamps, and extracted text content for SOC triage. |
| Cyble Vision Alerts Website Defacement Content | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when monitored websites show new or suspicious content referencing known defacement patterns. Supports investigation into potential web compromise incidents. |
| Cyble Vision Alerts Website Defacement Keyword | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when monitored defacement keywords appear on a website, indicating potential early signs of website compromise or defacement-related activity. |
| Cyble Vision Alerts Website Defacement URL | Analytic Rule | 📦 Solution | Cyble Vision | Detects suspicious or unexpected changes to monitored URLs which may indicate website tampering or defacement. |
| Cyble Vision Alerts Discord Keyword | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when monitored keywords or risky content appear in Discord channels. Useful for detecting data leakage, impersonation, abuse or reputational threats originating from social platforms. |
| Cyble Vision Alerts Docker | Analytic Rule | 📦 Solution | Cyble Vision | Detects Docker Hub container entries related to monitored keywords. Uses Alerts_docker parser. Includes metadata such as developer, stars, downloads, and image URL. Raises one incident per alert. |
| Cyble Vision Alerts Domain Expiry Alert | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when a monitored domain is about to expire. Expired domains risk service disruption, takeover, or misuse by adversaries. |
| Cyble Vision Alerts Domain Watchlist | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when monitored domain DNS records change (A, NS, MX, TXT, SOA). DNS record changes may indicate misconfiguration, domain takeover attempts, or infrastructure shifts requiring review. |
| Cyble Vision Alerts Flash Report | Analytic Rule | 📦 Solution | Cyble Vision | Detects new threat intelligence flash reports from CybleVision. Extracts company-level context and report identifiers for triage. |
| Cyble Vision Alerts Github | Analytic Rule | 📦 Solution | Cyble Vision | This alert generates incidents for Github |
| Cyble Vision Alerts Hacktivism | Analytic Rule | 📦 Solution | Cyble Vision | Detects hacktivist activity (Telegram posts, defacements, site takedowns, etc.) using the Alerts_Hacktivism parser. Extracts post content, attacker/team,domains, links, IPs, media and metadata for tri... |
| Cyble Vision Alerts I2P Monitoring | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when I2P content is detected related to monitored keywords. Useful for identifying extremist narratives, radicalization indicators, or harmful ideological campaigns spreading through I2P hidd... |
| Cyble Vision Alerts IOC'S | Analytic Rule | 📦 Solution | Cyble Vision | Detects malicious Indicators of Compromise such as IPs, domains, URLs, and hashes. Extracts IOC type, behaviour tags, risk rating, and timestamps using Alerts_IOCs parser. Triggers an incident with ma... |
| Cyble Vision Alerts IP Risk Score | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when the risk score for a monitored IP increases significantly. This may indicate new malicious behavior or updated threat intelligence classification. |
| Cyble Vision Alerts Leaked Credentials | Analytic Rule | 📦 Solution | Cyble Vision | Detects leaked credentials identified by CybleVision ingestion and triggers an incident with mapped entities, severity, and details. |
| Cyble Vision Alerts Malicious Ads Detected | Analytic Rule | 📦 Solution | Cyble Vision | Generates an incident when Cyble Intelligence detects a malicious advertisement, malvertising activity, or redirect attempting to impersonate a legitimate brand. |
| CybleVision Alerts Mobile Apps | Analytic Rule | 📦 Solution | Cyble Vision | Detects suspicious, unauthorized or impersonating mobile applications from 3rd-party marketplaces using CybleVision data. Extracts metadata, screenshots, developer, package name, and detailed app attr... |
| Cyble Vision Alerts News Feed Alert | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when monitored keywords are found in external news feeds. Helps analysts track relevant cybersecurity news, advisories, or threat intelligence updates tied to monitored entities. |
| Cyble Vision Alerts New Vulnerability Detected | Analytic Rule | 📦 Solution | Cyble Vision | A newly detected CVE has been associated with a monitored keyword or asset. This may indicate exposure to newly published or exploited vulnerabilities. |
| Cyble Vision Alerts OSINT Mention Detected | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when Cyble detects an OSINT mention related to monitored keywords, entities, or brand identifiers. OSINT findings may indicate data leaks, expose content, targeting activity, impersonation, o... |
| Cyble Vision Alerts OT/ICS Threat Activity Detected | Analytic Rule | 📦 Solution | Cyble Vision | This alert indicates detection of OT/ICS-related network activity involving industrial control protocols (e.g., IEC104). May indicate probing, reconnaissance, or attempted access against critical infr... |
| Cyble Vision Alerts Pastebin | Analytic Rule | 📦 Solution | Cyble Vision | Cyble detected a paste containing references to monitored keywords or domains. Pastebin/Gist exposure may indicate data leakage or threat actor activity referencing the organization. |
| Cyble Vision Alerts Phishing Domain Detected | Analytic Rule | 📦 Solution | Cyble Vision | Cyble detected a phishing website impersonating a monitored brand. This alert provides landing page, host, screenshot, status and configured keyword for SOC triage. |
| Cyble Vision Alerts Physical Threat Alert | Analytic Rule | 📦 Solution | Cyble Vision | Creates an incident for physical threats identified by Cyble Intelligence such as explosions, safety incidents, riots, or violence. Each alert generates a single incident for SOC evaluation. |
| Cyble Vision Alerts Postman API Exposure Detection | Analytic Rule | 📦 Solution | Cyble Vision | Detects exposed Postman requests, collections or endpoints referencing monitored entities. Alerts analysts to possible API enumeration, leaked endpoints, or unintended exposure. |
| Cyble Vision Alerts Product Vulnerability Detected | Analytic Rule | 📦 Solution | Cyble Vision | Detects product vulnerability updates (CVE) for monitored products. Triggers SOC triage when a product vulnerability is reported or updated for a monitored product/version. |
| Cyble Vision Alerts Social Media Monitoring | Analytic Rule | 📦 Solution | Cyble Vision | Detects and CybleVision 'social_media_monitoring' alerts into a single incident. |
| Cyble Vision Alerts SSL Certificate Expiry | Analytic Rule | 📦 Solution | Cyble Vision | Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security is... |
| CybleVision Alerts Stealer Logs | Analytic Rule | 📦 Solution | Cyble Vision | Detects credential theft and information-stealer malware logs. Extracts stolen credentials, URLs, device info, IPs, domains, and metadata using the Alerts_StealerLogs parser. |
| Cyble Vision Alerts Discovered Subdomain | Analytic Rule | 📦 Solution | Cyble Vision | Triggers when a new subdomain is detected for a monitored keyword/domain. |
| Cyble Vision Alerts Suspicious Domain | Analytic Rule | 📦 Solution | Cyble Vision | This Rule generates Cyble Vision Alerts for Service - Suspicious Domain severity LOW |
| CybleVision Alerts Telegram Mentions | Analytic Rule | 📦 Solution | Cyble Vision | Detects mentions of monitored keywords across Telegram channels and groups. Extracts message content, URLs, chat metadata, user identity, and timestamps. |
| Cyble Vision Alerts TOR Links | Analytic Rule | 📦 Solution | Cyble Vision | Detects Tor marketplace, darkweb link, and onion domain alerts from CybleVision. Uses the Alerts_TorLinks parser to extract onion URLs, search engines, search keywords, content, and identifiers. Incid... |
| Cyble Vision Alerts Vulnerability | Analytic Rule | 📦 Solution | Cyble Vision | Detects SSL/TLS and application vulnerabilities from CybleVision. Extracts host, IP, port, severity, vulnerability ID and first-seen metadata using the Alerts_Vulnerability parser. Incidents grouped p... |
| Cyble Vision Alerts Cyble Web Applications | Analytic Rule | 📦 Solution | Cyble Vision | Creates an incident for each discovered or exposed web application detected by Cyble Intelligence. Useful for SOC teams to investigate externally facing login portals, misconfigurations, and exposed i... |
| CybleVisionAlertsWorkbook | Workbook | 📦 Solution | Cyble Vision | |
| CybleVisionAlert_Status_Update | Playbook | 📦 Solution | Cyble Vision | This Logic App updates Cyble alert status and severity based on Microsoft Sentinel incident changes. It supports automatic updates via automation rules and interprets user-applied tags to determine th... |
| Cyble-IOC_Enrichment-Playbook | Playbook | 📦 Solution | Cyble Vision | This playbook leverages the Cyble API to enrich IP, Domain, Url & Hash indicators, found in Microsoft Sentinel incidents, with the following context: Risk Score, Confidence, etc. The enrichment conten... |
| Cyble-ThreatIntelligence-Ingest-Playbook | Playbook | 📦 Solution | Cyble Vision | This playbook imports IoC lists from Cyble and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes. This playbook depends on Cyble-ThreatIntelligence-Ingest tha... |
| Alerts_advisory | Parser | 📦 Solution | Cyble Vision | |
| Alerts_assets | Parser | 📦 Solution | Cyble Vision | |
| Alerts_bit_bucket | Parser | 📦 Solution | Cyble Vision | |
| Alerts_cloud_storage | Parser | 📦 Solution | Cyble Vision | |
| Alerts_compromised_endpoints_cookies | Parser | 📦 Solution | Cyble Vision | |
| Alerts_compromised_files | Parser | 📦 Solution | Cyble Vision | |
| Alerts_cyber_crime_forums | Parser | 📦 Solution | Cyble Vision | |
| Alerts_darkweb_data_breaches | Parser | 📦 Solution | Cyble Vision | |
| Alerts_darkweb_marketplaces | Parser | 📦 Solution | Cyble Vision | |
| Alerts_darkweb_ransomware | Parser | 📦 Solution | Cyble Vision | |
| Alerts_defacement_content | Parser | 📦 Solution | Cyble Vision | |
| Alerts_defacement_keyword | Parser | 📦 Solution | Cyble Vision | |
| Alerts_defacement_url | Parser | 📦 Solution | Cyble Vision | |
| Alerts_discord | Parser | 📦 Solution | Cyble Vision | |
| Alerts_docker | Parser | 📦 Solution | Cyble Vision | |
| Alerts_domain_expiry | Parser | 📦 Solution | Cyble Vision | |
| Alerts_domain_watchlist | Parser | 📦 Solution | Cyble Vision | |
| Alerts_flash_report | Parser | 📦 Solution | Cyble Vision | |
| Alerts_github | Parser | 📦 Solution | Cyble Vision | |
| Alerts_hacktivism | Parser | 📦 Solution | Cyble Vision | |
| Alerts_i2p | Parser | 📦 Solution | Cyble Vision | |
| Alerts_iocs | Parser | 📦 Solution | Cyble Vision | |
| Alerts_ip_risk_score | Parser | 📦 Solution | Cyble Vision | |
| Alerts_leaked_credentials | Parser | 📦 Solution | Cyble Vision | |
| Alerts_malicious_ads | Parser | 📦 Solution | Cyble Vision | |
| Alerts_mobile_apps | Parser | 📦 Solution | Cyble Vision | |
| Alerts_news_feed | Parser | 📦 Solution | Cyble Vision | |
| Alerts_new_vulnerability | Parser | 📦 Solution | Cyble Vision | |
| Alerts_osint | Parser | 📦 Solution | Cyble Vision | |
| Alerts_ot_ics | Parser | 📦 Solution | Cyble Vision | |
| Alerts_pastebin | Parser | 📦 Solution | Cyble Vision | |
| Alerts_phishing | Parser | 📦 Solution | Cyble Vision | |
| Alerts_physical_threats | Parser | 📦 Solution | Cyble Vision | |
| Alerts_postman | Parser | 📦 Solution | Cyble Vision | |
| Alerts_product_vulnerability | Parser | 📦 Solution | Cyble Vision | |
| Alerts_ransomware_updates | Parser | 📦 Solution | Cyble Vision | |
| Alerts_social_media_monitoring | Parser | 📦 Solution | Cyble Vision | |
| Alerts_ssl_expiry | Parser | 📦 Solution | Cyble Vision | |
| Alerts_stealer_logs | Parser | 📦 Solution | Cyble Vision | |
| Alerts_subdomains | Parser | 📦 Solution | Cyble Vision | |
| Alerts_suspicious_domains | Parser | 📦 Solution | Cyble Vision | |
| Alerts_telegram_mentions | Parser | 📦 Solution | Cyble Vision | |
| Alerts_tor_links | Parser | 📦 Solution | Cyble Vision | |
| Alerts_vulnerability | Parser | 📦 Solution | Cyble Vision | |
| Alerts_web_applications | Parser | 📦 Solution | Cyble Vision | |
| Attempted VBScript Stored in Non-Run CurrentVersion Registry Key Value | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Identify potential new registry key name that is a non-autorun and non-run key in the HKLM\Software\Microsoft\Windows\CurrentVersion\ registry key containing VBScript in the key value value. |
| Excessive Windows Discovery and Execution Processes - Potential Malware Installation | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Utilizes a list of commonly abused LOLB an attacker or malware would execute in quick succession. The presence of multiple executions of the programs within the list can be indicative of an infection ... |
| LSASS Memory Dumping using WerFault.exe - Command Identification | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Identifies WerFault.exe creating a memory dump of lsass.exe (Local Security Authority Subsystem Service, a process responsible for the enforcement of security policies on Windows systems, which genera... |
| Metasploit / Impacket PsExec Process Creation Activity | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Meant to detect process creations containing names consistent with the schema used by Metasploit or Impacket's PsExec tool. Metasploit and Impacket's PsExec tooling is used by malicious actors for lat... |
| Potential Maldoc Execution Chain Observed | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Detect the aftermath of a successfully delivered and executed maldoc (Microsoft Office). Indicates an Office document was opened from an email or download/link, spawned a suspicious execution, and att... |
| Powershell Encoded Command Execution | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Looks for valid variations of the -EncodedCommand parameter. Commonly used to encode or obfuscate commands, and not all occurrences are malicious. |
| PowerShell Pastebin Download | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Detects PowerShell commands downloading and execute code hosted on Pastebin and other services. This technique has been used by malicious actors to distribute malware, in particular it has been used b... |
| Prohibited Applications Spawning cmd.exe or powershell.exe | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Hunts for commonly utilized Microsoft programs (Word, Excel, Publisher, etc) and other programs known to malicious launch powershell or cmd, such as Internet Explorer, Chrome and Firefox. |
| Proxy VBScript Execution via CurrentVersion Registry Key | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Identifies VBScript proxy execution through a registry key in \Microsoft\Windows\CurrentVersion. |
| Rundll32 or cmd Executing Application from Explorer - Potential Malware Execution Chain | Hunting Query | 📦 Solution | Cyborg Security HUNTER | Identifies when rundll32 or cmd.exe is utilized to launch a malicious DLL or executable from explorer.exe. Indicative of a cmd window or LNK file executing a program or malware due to a user clicking ... |
| CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. Such certificates do not meet modern encryption standards and are co... |
| CYFIRMA - Attack Surface - Weak Certificate Exposure - Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. Such certificates do not meet modern encryption standards and are con... |
| CYFIRMA - Attack Surface - Cloud Weakness High Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This rule detects cloud storage buckets (e.g., AWS S3) that are publicly accessible without authentication. Such misconfigurations can lead to data exfiltration, compliance violations, and reputatio... |
| CYFIRMA - Attack Surface - Cloud Weakness Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This rule detects cloud storage buckets (e.g., AWS S3) that are publicly accessible without authentication. Such misconfigurations can lead to data exfiltration, compliance violations, and reputatio... |
| CYFIRMA - Attack Surface - Configuration High Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | This alert is generated when CYFIRMA detects a critical misconfiguration in a public-facing asset or service. Such misconfigurations may include exposed admin interfaces, default credentials, open di... |
| CYFIRMA - Attack Surface - Configuration Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | This alert is generated when CYFIRMA detects a critical misconfiguration in a public-facing asset or service. Such misconfigurations may include exposed admin interfaces, default credentials, open di... |
| CYFIRMA - Attack Surface - Malicious Domain/IP Reputation High Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This alert is raised when CYFIRMA detects a critical reputation score for an IP address linked to your infrastructure. The IP has been previously associated with hacking activity and web application... |
| CYFIRMA - Attack Surface - Malicious Domain/IP Reputation Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This alert is raised when CYFIRMA detects a critical reputation score for an IP address linked to your infrastructure. The IP has been previously associated with hacking activity and web application... |
| CYFIRMA - Attack Surface - Domain/IP Vulnerability Exposure High Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This rule is triggered when CYFIRMA identifies publicly exposed vulnerabilities on domains or IP addresses within your organization's attack surface. These vulnerabilities may include outdated softwa... |
| CYFIRMA - Attack Surface - Domain/IP Vulnerability Exposure Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This rule is triggered when CYFIRMA identifies publicly exposed vulnerabilities on domains or IP addresses within your organization's attack surface. These vulnerabilities may include outdated softwa... |
| CYFIRMA - Attack Surface - Open Ports High Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This rule is triggered when CYFIRMA identifies open and publicly accessible ports on internet-facing assets. Exposed services may include SSH, RDP, HTTP, or other potentially sensitive ports, increas... |
| CYFIRMA - Attack Surface - Open Ports Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Attack Surface | "This rule is triggered when CYFIRMA identifies open and publicly accessible ports on internet-facing assets. Exposed services may include SSH, RDP, HTTP, or other potentially sensitive ports, increas... |
| CYFIRMA - Brand Intelligence - Domain Impersonation High Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This analytics rule detects high-risk domain impersonation activity, where newly registered or existing domains closely resemble the legitimate brand name or organizational assets. These suspicious ... |
| CYFIRMA - Brand Intelligence - Domain Impersonation Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This analytics rule detects high-risk domain impersonation activity, where newly registered or existing domains closely resemble the legitimate brand name or organizational assets. These suspicious ... |
| CYFIRMA - Brand Intelligence - Executive/People Impersonation High Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This rule detects potential impersonation of executive or high-profile individuals across digital platforms such as social media. Such impersonation can be used to mislead stakeholders, perform soci... |
| CYFIRMA - Brand Intelligence - Executive/People Impersonation Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This rule detects potential impersonation of executive or high-profile individuals across digital platforms such as social media. Such impersonation can be used to mislead stakeholders, perform soci... |
| CYFIRMA - Brand Intelligence - Malicious Mobile App High Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This analytic rule detects instances where malicious or unauthorized mobile applications are discovered mimicking legitimate brand assets. Such impersonations may be distributed through unofficial a... |
| CYFIRMA - Brand Intelligence - Malicious Mobile App Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This analytic rule detects instances where malicious or unauthorized mobile applications are discovered mimicking legitimate brand assets. Such impersonations may be distributed through unofficial a... |
| CYFIRMA - Brand Intelligence - Product/Solution High Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This alert is raised when CYFIRMA detects a critical reputation score for an IP address linked to your infrastructure. The IP has been previously associated with hacking activity and web application... |
| CYFIRMA - Brand Intelligence - Product/Solution Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "This alert is raised when CYFIRMA detects a critical reputation score for an IP address linked to your infrastructure. The IP has been previously associated with hacking activity and web application... |
| CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "Detects high-severity alerts related to impersonation of official social media handles associated with your brand. These spoofed accounts may be used for phishing, disinformation, or fraud campaigns... |
| CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Brand Intelligence | "Detects high-severity alerts related to impersonation of official social media handles associated with your brand. These spoofed accounts may be used for phishing, disinformation, or fraud campaigns... |
| CYFIRMA - Compromised Employees Detection Rule | Analytic Rule | 📦 Solution | Cyfirma Compromised Accounts | "Identifies and alerts on internal employee accounts that have been compromised, based on CYFIRMA's threat intelligence. This rule captures the latest exposure of user credentials, IP addresses, hostn... |
| CYFIRMA - Customer Accounts Leaks Detection Rule | Analytic Rule | 📦 Solution | Cyfirma Compromised Accounts | "Detects recent leaks of customer account credentials based on CYFIRMA's threat intelligence. This rule surfaces the latest credential exposures, including email, username, and breach metadata. It... |
| CYFIRMA - Public Accounts Leaks Detection Rule | Analytic Rule | 📦 Solution | Cyfirma Compromised Accounts | "Detects exposed public-facing account credentials as identified in CYFIRMA's threat intelligence feeds. This rule monitors for credentials leaked through third-party breaches, dark web sources, or pu... |
| CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - Medium severity Command & Control Network Indicators with Block Recommendation Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - Medium severity Command & Control Network Indicators with Monitor Recommendation Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - High severity File Hash Indicators with Block Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This query retrieves file hash indicators marked for blocking, with no assigned role, from the CyfirmaIndicators_CL table. It extracts MD5, SHA1, and SHA256 hashes and includes threat metadata for u... |
| CYFIRMA - Medium severity File Hash Indicators with Block Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This query retrieves file hash indicators marked for blocking, with no assigned role, from the CyfirmaIndicators_CL table. It extracts MD5, SHA1, and SHA256 hashes and includes threat metadata for u... |
| CYFIRMA - High severity File Hash Indicators with Monitor Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This query retrieves file hash indicators marked for Monitoring, with no assigned role, from the CyfirmaIndicators_CL table. It extracts MD5, SHA1, and SHA256 hashes and includes threat metadata for... |
| CYFIRMA - Medium severity File Hash Indicators with Monitor Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This query retrieves file hash indicators marked for Monitoring, with no assigned role, from the CyfirmaIndicators_CL table. It extracts MD5, SHA1, and SHA256 hashes and includes threat metadata for... |
| CYFIRMA - High severity File Hash Indicators with Block Action and Malware | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query retrieves file hash indicators (MD5, SHA1, SHA256) from the CyfirmaIndicators_CL table within the last 5 minutes. It filters records with a confidence score of 80 or higher, containin... |
| CYFIRMA - Medium severity File Hash Indicators with Block Action and Malware | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query retrieves file hash indicators (MD5, SHA1, SHA256) from the CyfirmaIndicators_CL table within the last 5 minutes. It filters records with a confidence score of 80 or higher, containin... |
| CYFIRMA - High severity File Hash Indicators with Monitor Action and Malware | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query retrieves file hash indicators (MD5, SHA1, SHA256) from the CyfirmaIndicators_CL table within the last 5 minutes. It filters records with a confidence score of 80 or higher, containin... |
| CYFIRMA - Medium severity File Hash Indicators with Monitor Action and Malware | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query retrieves file hash indicators (MD5, SHA1, SHA256) from the CyfirmaIndicators_CL table within the last 5 minutes. It filters records with a confidence score of 80 or higher, containin... |
| CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoi... |
| CYFIRMA - High severity Malicious Network Indicators with Block Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This rule detects network-based indicators such as IP addresses, domains, and URLs reported by CYFIRMA threat intelligence with a recommended action of 'Block' and no specified role. These indicator... |
| CYFIRMA - Medium severity Malicious Network Indicators with Block Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This rule detects network-based indicators such as IP addresses, domains, and URLs reported by CYFIRMA threat intelligence with a recommended action of 'Block' and no specified role. These indicator... |
| CYFIRMA - High severity Malicious Network Indicators with Monitor Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This rule detects high-confidence network-based indicators such as IP addresses, domains, and URLs reported by CYFIRMA threat intelligence with a recommended action of 'Monitor' and no specified role... |
| CYFIRMA - Medium severity Malicious Network Indicators with Monitor Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This rule detects Network indicators such as IP addresses, domains, and URLs reported by CYFIRMA threat intelligence with a recommended action of 'Monitor' and no specified role. These indicators ma... |
| CYFIRMA - High severity Malicious Phishing Network Indicators - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule identifies network-based indicators such as URLs, IP addresses, and domains related to phishing campaigns, as reported by CYFIRMA threat intelligence. These indicators are flagge... |
| CYFIRMA - Medium severity Malicious Phishing Network Indicators - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule identifies network indicators such as URLs, IP addresses, and domains related to phishing campaigns, as reported by CYFIRMA threat intelligence. These indicators are flagged with... |
| CYFIRMA - High severity Malicious Phishing Network Indicators - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule identifies network-based indicators such as URLs, IP addresses, and domains related to phishing campaigns, as reported by CYFIRMA threat intelligence. These indicators are flagge... |
| CYFIRMA - Medium severity Malicious Phishing Network Indicators - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule identifies network-based indicators such as URLs, IP addresses, and domains related to phishing campaigns, as reported by CYFIRMA threat intelligence. These indicators are flagge... |
| CYFIRMA - High severity TOR Node Network Indicators - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query identifies network-based indicators from CYFIRMA intelligence that are associated with the role 'TOR'. These indicators may include IP addresses, domains, and URLs related to Tor netw... |
| CYFIRMA - Medium severity TOR Node Network Indicators - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query identifies network-based indicators from CYFIRMA intelligence that are associated with the role 'TOR'. These indicators may include IP addresses, domains, and URLs related to Tor netw... |
| CYFIRMA - High severity TOR Node Network Indicators - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query identifies network-based indicators from CYFIRMA intelligence that are associated with the role 'TOR'. These indicators may include IP addresses, domains, and URLs related to Tor netw... |
| CYFIRMA - Medium severity TOR Node Network Indicators - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query identifies network-based indicators from CYFIRMA intelligence that are associated with the role 'TOR'. These indicators may include IP addresses, domains, and URLs related to Tor netw... |
| CYFIRMA - High severity Trojan File Hash Indicators with Block Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query extracts file hash indicators associated with Trojan activity from the CyfirmaIndicators_CL table. It specifically targets indicators containing file hashes linked to Trojan behavior ... |
| CYFIRMA - Medium severity Trojan File Hash Indicators with Block Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query extracts file hash indicators associated with Trojan activity from the CyfirmaIndicators_CL table. It specifically targets indicators containing file hashes linked to Trojan behavior ... |
| CYFIRMA - High severity Trojan File Hash Indicators with Monitor Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query extracts file hash indicators associated with Trojan activity from the CyfirmaIndicators_CL table. It specifically targets indicators containing file hashes linked to Trojan behavior ... |
| CYFIRMA - Medium severity Trojan File Hash Indicators with Monitor Action Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This KQL query extracts file hash indicators associated with Trojan activity from the CyfirmaIndicators_CL table. It specifically targets indicators containing file hashes linked to Trojan behavior ... |
| CYFIRMA - High severity Trojan Network Indicators - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators flagged by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These indicators may represent attacker-controll... |
| CYFIRMA - Medium severity Trojan Network Indicators - Block Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators flagged by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These indicators may represent attacker-controll... |
| CYFIRMA - High severity Trojan Network Indicators - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators flagged by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These indicators may represent attacker-controll... |
| CYFIRMA - Medium severity Trojan Network Indicators - Monitor Recommended Rule | Analytic Rule | 📦 Solution | Cyfirma Cyber Intelligence | "This analytics rule detects network-based indicators flagged by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These indicators may represent attacker-controll... |
| CYFIRMA - Data Breach and Web Monitoring - Dark Web High Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "Detects critical alerts from CYFIRMA related to sensitive data or credentials leaked on dark web forums. These events often indicate unauthorized access or compromise of enterprise systems, cloud en... |
| CYFIRMA - Data Breach and Web Monitoring - Dark Web Medium Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "Detects critical alerts from CYFIRMA related to sensitive data or credentials leaked on dark web forums. These events often indicate unauthorized access or compromise of enterprise systems, cloud en... |
| CYFIRMA - Data Breach and Web Monitoring - Phishing Campaign Detection Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "Detects phishing campaigns targeting enterprise domains, as identified through CYFIRMA's Data Breach and Dark Web Monitoring. These alerts may include malicious URLs used for credential harvesting, ... |
| CYFIRMA - Data Breach and Web Monitoring - Phishing Campaign Detection Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "Detects phishing campaigns targeting enterprise domains, as identified through CYFIRMA's Data Breach and Dark Web Monitoring. These alerts may include malicious URLs used for credential harvesting, ... |
| CYFIRMA - Data Breach and Web Monitoring - Ransomware Exposure Detected Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This analytics rule detects high-severity ransomware threats targeting the organization, as reported by CYFIRMA's Dark Web and Data Breach Intelligence feeds. The alert is generated when threat acto... |
| CYFIRMA - Data Breach and Web Monitoring - Ransomware Exposure Detected Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This analytics rule detects high-severity ransomware threats targeting the organization, as reported by CYFIRMA's Dark Web and Data Breach Intelligence feeds. The alert is generated when threat acto... |
| CYFIRMA - Social and Public Exposure - Confidential Files Information Exposure Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This rule detects high-severity alerts from CYFIRMA regarding exposure of confidential files or forms linked to internal or client-related information, publicly accessible on platforms. These exposu... |
| CYFIRMA - Social and Public Exposure - Confidential Files Information Exposure Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This rule detects Medium-severity alerts from CYFIRMA regarding exposure of confidential files or forms linked to internal or client-related information, publicly accessible on platforms. These expo... |
| CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This analytics rule detects high severity alerts from CYFIRMA indicating exposure of Personally Identifiable Information (PII) or Confidential Information (CII) in public or unsecured sources. Such ... |
| CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This analytics rule detects high severity alerts from CYFIRMA indicating exposure of Personally Identifiable Information (PII) or Confidential Information (CII) in public or unsecured sources. Such ... |
| CYFIRMA - Social and Public Exposure - Social Media Threats Activity Detected Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This rule detects high-severity social threat alerts from CYFIRMA related to impersonation, fake profiles, or malicious activities on social platforms that may target executives, brands, or employees... |
| CYFIRMA - Social and Public Exposure - Social Media Threats Activity Detected Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This rule detects medium-severity social threat alerts from CYFIRMA related to impersonation, fake profiles, or malicious activities on social platforms that may target executives, brands, or employe... |
| CYFIRMA - Social and Public Exposure - Source Code Exposure on Public Repositories Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This rule triggers when CYFIRMA detects source code related to internal or enterprise domains exposed on public platforms like GitHub. Such exposure may lead to intellectual property leakage or help... |
| CYFIRMA - Social and Public Exposure - Source Code Exposure on Public Repositories Rule | Analytic Rule | 📦 Solution | Cyfirma Digital Risk | "This rule triggers when CYFIRMA detects source code related to internal or enterprise domains exposed on public platforms like GitHub. Such exposure may lead to intellectual property leakage or help... |
| CYFIRMA - High Severity Asset based Vulnerabilities Rule Alert | Analytic Rule | 📦 Solution | Cyfirma Vulnerabilities Intel | "This rule detects high severity asset-based vulnerabilities from CYFIRMA's vulnerability intelligence data. It identifies vulnerabilities with a confidence score of 80 or higher, excluding those cat... |
| CYFIRMA - Medium Severity Asset based Vulnerabilities Rule Alert | Analytic Rule | 📦 Solution | Cyfirma Vulnerabilities Intel | "This rule detects medium severity asset-based vulnerabilities from CYFIRMA's vulnerability intelligence data. It identifies vulnerabilities with a confidence score of 50 or higher, excluding those c... |
| CYFIRMA - High Severity Attack Surface based Vulnerabilities Rule Alert | Analytic Rule | 📦 Solution | Cyfirma Vulnerabilities Intel | "This rule detects high severity attack surface-based vulnerabilities from CYFIRMA's vulnerability intelligence data. It identifies vulnerabilities with a confidence score of 80 or higher, excluding ... |
| CYFIRMA - Medium Severity Attack Surface based Vulnerabilities Rule | Analytic Rule | 📦 Solution | Cyfirma Vulnerabilities Intel | "This rule detects medium severity attack surface-based vulnerabilities from CYFIRMA's vulnerability intelligence data. It identifies vulnerabilities with a confidence score of 50 or higher, excluding... |
| Cyjax | Workbook | 📦 Solution | Cyjax | |
| Cyjax Add Comment To Incident | Playbook | 📦 Solution | Cyjax | This playbook is triggered via HTTP request and is designed to be used as a sub-playbook by other Cyjax playbooks (CyjaxIncidentEnrichment). It receives enrichment data (host, domain, hash, URL, Email... |
| Cyjax Ad Hoc Enrichment | Playbook | 📦 Solution | Cyjax | This playbook is triggered via HTTP request and is designed to get IOC value from workbook provided by user and fetch it's related data from Cyjax and Ingest it into Log Analytics Workspace which will... |
| Cyjax Data Breaches | Playbook | 📦 Solution | Cyjax | This playbook is triggered manually from a Data Breaches Tab from Cyjax Workbook in Microsoft Sentinel. It fetches email credential breach data from Cyjax based on user provided inputs (Query, Since, ... |
| Cyjax Domain Monitor | Playbook | 📦 Solution | Cyjax | This playbook is triggered manually from a Domain Monitor Tab from Cyjax Workbook in Microsoft Sentinel. It fetches domain monitor data from Cyjax based on user provided inputs (Since, Until and Query... |
| Cyjax Incident Enrichment | Playbook | 📦 Solution | Cyjax | This playbook is triggered manually or automatically from a incident in Microsoft Sentinel. It iterates through each entity in the incident (IP addresses, DNS/Domain names, file hashes, URL and Emails... |
| CyjaxCorrelate | Parser | 📦 Solution | Cyjax | |
| CyjaxThreatIndicator | Parser | 📦 Solution | Cyjax | |
| Cynerio - IoT - Default password | Analytic Rule | 📦 Solution | Cynerio | User signed in using default credentials |
| Cynerio - Exploitation Attempt of IoT device | Analytic Rule | 📦 Solution | Cynerio | Exploitation Attempt of IoT device - Attack detection |
| Cynerio - IoT - Weak password | Analytic Rule | 📦 Solution | Cynerio | User signed in using weak credentials |
| Cynerio - Medical device scanning | Analytic Rule | 📦 Solution | Cynerio | Medical device is scanned with vulnerability scanner |
| Cynerio - Suspicious Connection to External Address | Analytic Rule | 📦 Solution | Cynerio | Suspicious Connection to External Address |
| CynerioOverviewWorkbook | Workbook | 📦 Solution | Cynerio | |
| CynerioEvent_Authentication 🔍 | Parser | 📦 Solution | Cynerio | |
| CynerioEvent_NetworkSession 🔍 | Parser | 📦 Solution | Cynerio | |
| Cyren to SentinelOne IOC Automation | Playbook | 📦 Solution | Cyren-SentinelOne-ThreatIntelligence | This playbook fetches IP reputation and/or malware URL threat intelligence indicators from the Cyren CCF API feed and creates corresponding IOC indicators in SentinelOne for automated threat detection... |
| Cyren Feed Outage Detection | Analytic Rule | 📦 Solution | CyrenThreatIntelligence | Detects when the Cyren threat intelligence feed has not ingested any data for 6 or more hours. This may indicate a connectivity issue with the data connector, API authentication problems, or upstream ... |
| Cyren High-Risk IP Indicators | Analytic Rule | 📦 Solution | CyrenThreatIntelligence | Detects high-risk IP indicators (risk score >= 80) from Cyren threat intelligence feeds in the last 24 hours. These IPs are associated with malicious activity such as malware distribution, phishing, o... |
| Cyren High-Risk URL Indicators | Analytic Rule | 📦 Solution | CyrenThreatIntelligence | Detects high-risk URL indicators (risk score >= 80) from Cyren malware URL threat intelligence feeds in the last 24 hours. These URLs are associated with malware distribution, phishing campaigns, or o... |
| CyrenThreatIntelligenceDashboard | Workbook | 📦 Solution | CyrenThreatIntelligence | |
| Detecting Suspicious PowerShell Command Executions | Hunting Query | 📦 Solution | Cyware | Query identifies users denied registration for multiple webinars or recordings but successfully registered for at least one event. Threshold variable adjusts number of events user needs to be rejected... |
| Match Cyware Intel Watchlist Items With Common Logs | Hunting Query | 📦 Solution | Cyware | Query to match common security log identifiers with IOCs held by the Cyware Intel watchlist that is created automatically by Cyware |
| Detecting Suspicious PowerShell Command Executions | Hunting Query | 📦 Solution | Cyware | Spot connections to rarely accessed external domains that are present in your watchlist, which could signify data exfiltration attempts or C2 communication. |
| Send Microsoft Sentinel Incident To Cyware Orchestrate | Playbook | 📦 Solution | Cyware | Send Microsoft Sentinel Incident To Cyware Orchestrate |
| D3 Smart SOAR - High or critical severity incident detected | Analytic Rule | 📦 Solution | D3SmartSOAR | Identifies when a D3 Smart SOAR incident with High or Critical severity is ingested. This helps security teams prioritize response to the most impactful incidents reported by D3 Smart SOAR. |
| Darktrace Model Breach | Analytic Rule | 📦 Solution | Darktrace | This rule creates Microsoft Sentinel Alerts based on Darktrace Model Breaches, fetched every 5 minutes. |
| Darktrace System Status | Analytic Rule | 📦 Solution | Darktrace | This rule creates Microsoft Sentinel Alerts based on Darktrace system status alerts for health monitoring, fetched every 5 minutes. |
| Darktrace AI Analyst | Analytic Rule | 📦 Solution | Darktrace | This rule creates Microsoft Sentinel Incidents based on Darktrace AI Analyst Incidents, fetched every 5 minutes. |
| DarktraceWorkbook | Workbook | 📦 Solution | Darktrace | |
| Dataminr - urgent alerts detected | Analytic Rule | 📦 Solution | Dataminr Pulse | Rule helps to detect whenever there is an alert found which has urgent alert-type in Dataminr. |
| DataminrPulseAlerts | Workbook | 📦 Solution | Dataminr Pulse | |
| DataminrPulseAlertEnrichment | Playbook | 📦 Solution | Dataminr Pulse | This playbook provides an end-to-end example of how alert enrichment works. This will extract the IP, Domain, HostName, URL or Hashes from the generated incident and call the Get alerts API of Datamin... |
| DataminrPulseAlerts | Parser | 📦 Solution | Dataminr Pulse | |
| DataminrPulseCyberAlerts | Parser | 📦 Solution | Dataminr Pulse | |
| DataminrPulseAsset | Watchlist | 📦 Solution | Dataminr Pulse | |
| DataminrPulseVulnerableDomain | Watchlist | 📦 Solution | Dataminr Pulse | |
| DataminrPulseVulnerableHash | Watchlist | 📦 Solution | Dataminr Pulse | |
| DataminrPulseVulnerableIp | Watchlist | 📦 Solution | Dataminr Pulse | |
| DataminrPulseVulnerableMalware | Watchlist | 📦 Solution | Dataminr Pulse | |
| Datawiza - massive errors detected | Analytic Rule | 📦 Solution | Datawiza | "This rule is designed to identify when the system is experiencing abnormal errors." |
| DelineaWorkbook | Workbook | 📦 Solution | Delinea Secret Server | |
| DEV-0270 New User Creation | Analytic Rule | 📦 Solution | Dev 0270 Detection and Hunting | The following query tries to detect creation of a new user using a known DEV-0270 username/password schema |
| Dev-0270 Malicious Powershell usage | Analytic Rule | 📦 Solution | Dev 0270 Detection and Hunting | DEV-0270 heavily uses powershell to achieve their objective at various stages of their attack. To locate powershell related activity tied to the actor, Microsoft Sentinel customers can run the followi... |
| Dev-0270 Registry IOC - September 2022 | Analytic Rule | 📦 Solution | Dev 0270 Detection and Hunting | The query below identifies modification of registry by Dev-0270 actor to disable security feature as well as to add ransom notes |
| Dev-0270 WMIC Discovery | Analytic Rule | 📦 Solution | Dev 0270 Detection and Hunting | The query below identifies dllhost.exe using WMIC to discover additional hosts and associated domains in the environment. |
| test | Hunting Query | 📦 Solution | DEV-0537DetectionandHunting | test |
| Digital Guardian - Sensitive data transfer over insecure channel | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects sensitive data transfer over insecure channel. |
| Digital Guardian - Exfiltration using DNS protocol | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects exfiltration using DNS protocol. |
| Digital Guardian - Exfiltration to online fileshare | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects exfiltration to online fileshare. |
| Digital Guardian - Exfiltration to private email | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects exfiltration to private email. |
| Digital Guardian - Exfiltration to external domain | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects exfiltration to external domain. |
| Digital Guardian - Bulk exfiltration to external domain | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects bulk exfiltration to external domain. |
| Digital Guardian - Multiple incidents from user | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects multiple incidents from user. |
| Digital Guardian - Possible SMTP protocol abuse | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects possible SMTP protocol abuse. |
| Digital Guardian - Unexpected protocol | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects RDP protocol usage for data transfer which is not common. |
| Digital Guardian - Incident with not blocked action | Analytic Rule | 📦 Solution | Digital Guardian Data Loss Prevention | Detects when incident has not block action. |
| Digital Guardian - Incident domains | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for incident domains. |
| Digital Guardian - Files sent by users | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for files sent by users. |
| Digital Guardian - Users' incidents | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for users' incidents. |
| Digital Guardian - Insecure file transfer sources | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for insecure file transfer sources. |
| Digital Guardian - Inspected files | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for inspected files. |
| Digital Guardian - New incidents | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for new incidents. |
| Digital Guardian - Rare destination ports | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for rare destination ports. |
| Digital Guardian - Rare network protocols | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches rare network protocols. |
| Digital Guardian - Rare Urls | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for rare Urls. |
| Digital Guardian - Urls used | Hunting Query | 📦 Solution | Digital Guardian Data Loss Prevention | Query searches for URLs used. |
| DigitalGuardian | Workbook | 📦 Solution | Digital Guardian Data Loss Prevention | |
| DigitalGuardianDLPEvent | Parser | 📦 Solution | Digital Guardian Data Loss Prevention | |
| Digital Shadows Incident Creation for exclude-app | Analytic Rule | 📦 Solution | Digital Shadows | Digital Shadows Analytic rule for generating Microsoft Sentinel incidents for the data ingested by app polling for excluded classifications |
| Digital Shadows Incident Creation for include-app | Analytic Rule | 📦 Solution | Digital Shadows | Digital Shadows Analytic rule for generating Microsoft Sentinel incidents for the data ingested by app polling for included classifications |
| DigitalShadows | Workbook | 📦 Solution | Digital Shadows | |
| Digital Shadows Playbook to Update Incident Status | Playbook | 📦 Solution | Digital Shadows | This playbook will update the status of Microsoft Sentinel incidents to match the status of the alerts imported from Digital Shadows SearchLight |
| Detect excessive NXDOMAIN DNS queries - Anomaly based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule makes use of the series decompose anomaly method to generate an alert when client requests excessive amount of DNS queries to non-existent domains. This helps in identifying possible C2 comm... |
| Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule generates an alert when the configured threshold for DNS queries to non-existent domains is breached. This helps in identifying possible C2 communications. It utilizes [ASIM](https://aka.ms/... |
| Detect DNS queries reporting multiple errors from different clients - Anomaly Based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule makes use of the series decompose anomaly method to generate an alert when multiple clients report errors for the same DNS query. This rule monitors DNS traffic over a period of 14 days to d... |
| Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule creates an alert when multiple clients report errors for the same DNS query. This helps in identifying possible similar C2 communications originating from different clients. It utilizes [ASI... |
| Ngrok Reverse Proxy on Network (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This detection identifies the top four Ngrok domains from DNS resolution. Ngrok reverse proxy can bypass network defense. While not inherently harmful, it has been used for malicious activities recent... |
| Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Anomaly based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule makes use of the series decompose anomaly method to detect clients with a high NXDomain response count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s... |
| Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Static threshold based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). An alert is generated when a new IP addre... |
| Rare client observed with high reverse DNS lookup count - Anomaly based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule makes use of the series decompose anomaly method to identify clients with high reverse DNS counts. This helps in detecting the possible initial phases of an attack, like discovery and reconn... |
| Rare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution) | Analytic Rule | 📦 Solution | DNS Essentials | This rule identifies clients with high reverse DNS counts, which could be carrying out reconnaissance or discovery activity. This helps in detecting the possible initial phases of an attack, like disc... |
| [Anomaly] Anomalous Increase in DNS activity by clients (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | Checks for an anomalous increase in DNS activity per client in the last 24 hours as compared to the last 14 days. Please note: To enhance performance, this query uses summarized data if available. |
| Connection to Unpopular Website Detected (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | This query lists DNS queries not found in the top 1 million queries in the past 14 days. Please note: To enhance performance, this query uses summarized data if available. |
| CVE-2020-1350 (SIGRED) exploitation pattern (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | This query detects the exploitation pattern of the CVE-2020-1350 (SIGRED) vulnerability. This query utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports t... |
| Top 25 DNS queries with most failures in last 24 hours (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | This query searches for DNS queries that resulted in errors. This query utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema. |
| Top 25 Domains with large number of Subdomains (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | A large number of subdomains for a domain may be an indicator of a suspicious domain. This query returns the top 25 domains by number of subdomains. |
| Increase in DNS Requests by client than the daily average count (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | Checking for a threefold increase or more in Full Name lookups per client IP for today vs. the daily average for the previous week. |
| Possible DNS Tunneling or Data Exfiltration Activity (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | Typical domain name lengths are short, whereas domain name queries used for data exfiltration or tunneling can often be very large in size. The hunting query looks for DNS queries that are more than 1... |
| Potential beaconing activity (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | This query identifies beaconing patterns from DNS logs based on recurrent frequency patterns. Such a potential outbound beaconing pattern to untrusted public networks should be investigated for any ma... |
| Top 25 Sources(Clients) with high number of errors in last 24hours (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | This query searches for the top 25 clients with the most errors. This query utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema. |
| Unexpected top level domains (ASIM DNS Solution) | Hunting Query | 📦 Solution | DNS Essentials | This query looks for top-level domains that are longer than four characters. This query utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS ... |
| DNSSolutionWorkbook | Workbook | 📦 Solution | DNS Essentials | |
| Summarize Data for DNS Essentials Solution | Playbook | 📦 Solution | DNS Essentials | This playbook summarizes data for DNS Essentials Solution and ingests into custom tables. |
| Domain ASIM Enrichment - DomainTools Iris Enrich | Playbook | 📦 Solution | DomainTools | Given a domain or set of domains associated with an alert return all Iris Enrich data for those domains and adds the enrichment data to the custom table. |
| DomainTools DNSDB Co-Located IP Addresses | Playbook | 📦 Solution | DomainTools | This playbook uses the Farsight DNSDB connector to automatically enrich IP Addresses found in the Microsoft Sentinel incidents. This lookup will identify all the IPs that are co-located (based on Doma... |
| DomainTools DNSDB Co-Located Hosts | Playbook | 📦 Solution | DomainTools | This playbook uses the Farsight DNSDB connector to automatically enrich Domain's found in the Microsoft Sentinel incidents. This use case describes the desire to easily identify Hosts that are co-loca... |
| DomainTools DNSDB Historical IP Addresses | Playbook | 📦 Solution | DomainTools | This playbook uses the Farsight DNSDB connector to automatically enrich IP Addresses found in the Microsoft Sentinel incidents. This use case describes the desire to identify all Addresses used as DNS... |
| DomainTools DNSDB Historical Hosts | Playbook | 📦 Solution | DomainTools | This playbook uses the Farsight DNSDB connector to automatically enrich Domain's found in the Microsoft Sentinel incidents. This use case describes the desire to identify all Hosts that resolved to a ... |
| IP Enrichment - DomainTools Parsed Whois | Playbook | 📦 Solution | DomainTools | This playbook uses the DomainTools Parsed Whois API. Given a ip address or set of ip addresses associated with an incident, return Whois information data for the extracted ip addresess as comments to ... |
| Domain Enrichment - DomainTools Iris Enrich | Playbook | 📦 Solution | DomainTools | Given a domain or set of domains associated with an incident return all Iris Enrich data for those domains as comments in the incident. |
| Domain Enrichment - DomainTools Iris Investigate | Playbook | 📦 Solution | DomainTools | Given a domain or set of domains associated with an incident return all Iris Investigate data for those domains as comments in the incident. |
| DomainToolsDNS | Parser | 📦 Solution | DomainTools | |
| Doppel | Workbook | 📦 Solution | Doppel | |
| DORACompliance | Workbook | 📦 Solution | DORA Compliance | |
| DPDPCompliance | Workbook | 📦 Solution | DPDP Compliance | |
| Dragos Notifications | Analytic Rule | 📦 Solution | Dragos | Fires Microsoft Sentinel alerts for Dragos Notifcations. |
| DragosNotificationsToSentinel | Parser | 📦 Solution | Dragos | |
| DragosPullNotificationsToSentinel | Parser | 📦 Solution | Dragos | |
| DragosPushNotificationsToSentinel | Parser | 📦 Solution | Dragos | |
| DragosSeverityToSentinelSeverity | Parser | 📦 Solution | Dragos | |
| Druva Quarantine Playbook for Enterprise Workload | Playbook | 📦 Solution | DruvaDataSecurityCloud | This playbook uses Druva-Ransomware-Response capabilities to stop the spread of ransomware and avoid reinfection or contamination spread in your enterprise workload |
| Druva Quarantine Playbook for inSync Workloads | Playbook | 📦 Solution | DruvaDataSecurityCloud | This playbook uses Druva-Ransomware-Response capabilities to stop the spread of ransomware and avoid reinfection or contamination spread to your inSync User based workloads. |
| Druva Quarantine Playbook for Shared Drive | Playbook | 📦 Solution | DruvaDataSecurityCloud | This playbook uses Druva-Ransomware-Response capabilities to stop the spread of ransomware and avoid reinfection or contamination spread to your shared drives. |
| Druva Quarantine Playbook for Sharepoint | Playbook | 📦 Solution | DruvaDataSecurityCloud | This playbook uses Druva-Ransomware-Response capabilities to stop the spread of ransomware and avoid reinfection or contamination spread in your Sharepoint |
| Druva Quarantine Using Resource id | Playbook | 📦 Solution | DruvaDataSecurityCloud | This playbook uses Druva-Ransomware-Response capabilities to stop the spread of ransomware and avoid reinfection or contamination spread to your environment. |
| Dynatrace Application Security - Attack detection | Analytic Rule | 📦 Solution | Dynatrace | Dynatrace has detected an ongoing attack in your environment. |
| Dynatrace Application Security - Code-Level runtime vulnerability detection | Analytic Rule | 📦 Solution | Dynatrace | Detect Code-level runtime vulnerabilities in your environment |
| Dynatrace Application Security - Non-critical runtime vulnerability detection | Analytic Rule | 📦 Solution | Dynatrace | Detect runtime vulnerabilities in your environment insights by snyk |
| Dynatrace Application Security - Third-Party runtime vulnerability detection | Analytic Rule | 📦 Solution | Dynatrace | Detect Third-Party runtime vulnerabilities in your environment insights by snyk |
| Dynatrace - Problem detection | Analytic Rule | 📦 Solution | Dynatrace | Detect application & infrastructure problems in your environment |
| Dynatrace | Workbook | 📦 Solution | Dynatrace | |
| Add Dynatrace Application Security Attack Source IP Address to Threat Intelligence | Playbook | 📦 Solution | Dynatrace | This playbook will add an attackers source ip to Threat Intelligence when a new incident is opened in Microsoft Sentinel. |
| Enrich Dynatrace Application Security Attack with related Microsoft Defender XDR insights | Playbook | 📦 Solution | Dynatrace | This playbook will enrich Dynatrace Application Security Attack with related Microsoft Defender XDR insights. |
| Enrich Dynatrace Application Security Attack with related Microsoft Sentinel Security Alerts | Playbook | 📦 Solution | Dynatrace | This playbook will enrich Dynatrace Application Security Attack with related Microsoft Sentinel Security Alerts. |
| Enrich Dynatrace Application Security Attack Incident | Playbook | 📦 Solution | Dynatrace | This playbook will enriche Dynatrace Application Security Attack Incidents with additional information when new incident is opened. |
| Ingest Microsoft Defender XDR insights into Dynatrace | Playbook | 📦 Solution | Dynatrace | This playbook will ingest Microsoft Defender XDR insights into Dynatrace. |
| Ingest Microsoft Sentinel Security Alerts into Dynatrace | Playbook | 📦 Solution | Dynatrace | This playbook will ingest Microsoft Sentinel Security Alerts into Dynatrace. |
| DynatraceAttacks | Parser | 📦 Solution | Dynatrace | |
| DynatraceAuditLogs | Parser | 📦 Solution | Dynatrace | |
| DynatraceProblems | Parser | 📦 Solution | Dynatrace | |
| DynatraceSecurityProblems | Parser | 📦 Solution | Dynatrace | |
| EatonForeseer - Unauthorized Logins | Analytic Rule | 📦 Solution | EatonForeseer | Detects Unauthorized Logins into Eaton Foreseer |
| EatonForeseerHealthAndAccess | Workbook | 📦 Solution | EatonForeseer | |
| Create Observable - EclecticIQ | Playbook | 📦 Solution | EclecticIQ | This playbook adds new observable in EclecticIQ based on the entities info present in Sentinel incident. If same type and value exists already, then it will update the observable and comment will be a... |
| Enrich Incident - EclecticIQ | Playbook | 📦 Solution | EclecticIQ | This playbook perform look up into EclecticIQ for the entities (Account, Host, IP, FileHash, URL) present result to Microsoft Sentinel incident |
| Egress Defend - Dangerous Attachment Detected | Analytic Rule | 📦 Solution | Egress Defend | Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox. |
| Egress Defend - Dangerous Link Click | Analytic Rule | 📦 Solution | Egress Defend | Defend has detected a user has clicked a dangerous link in their mailbox. |
| Dangerous emails with links clicked | Hunting Query | 📦 Solution | Egress Defend | This will check for emails that Defend has identified as dangerous and a user has clicked a link. |
| DefendMetrics | Workbook | 📦 Solution | Egress Defend | |
| DefendAuditData 🔍 | Parser | 📦 Solution | Egress Defend | |
| PreventWorkbook | Workbook | 📦 Solution | Egress Iris | |
| ElasticSearch-EnrichIncident | Playbook | 📦 Solution | Elastic Search | This playbook search in Elastic Search for based on the entities (Account, Host, IP, FileHash, URL) present result to Microsoft Sentinel incident |
| ElasticAgentEvent 🔍 | Parser | 📦 Solution | ElasticAgent | |
| Endace - Pivot-to-Vision | Hunting Query | 📦 Solution | Endace | This query displays a Pivot-to-Vision URL from the fields populated within the CommonSecurityLog. This KQL can be used as-is, or adapted to suite other threat-hunting and playbook functionality |
| Base64 encoded Windows process command-lines | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | Identifies instances of a base64-encoded PE file header seen in the process command line parameter. |
| Dumping LSASS Process Into a File | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a va... |
| Process executed from binary hidden in Base64 encoded file | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | Encoding malicious software is a technique used to obfuscate files from detection. The first CommandLine component is looking for Python decoding base64. The second CommandLine component is looking ... |
| Lateral Movement via DCOM | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | This query detects a fairly uncommon attack technique using the Windows Distributed Component Object Model (DCOM) to make a remote execution call to another computer system and gain lateral movement t... |
| Detecting Macro Invoking ShellBrowserWindow COM Objects | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | This query detects a macro invoking ShellBrowserWindow COM Objects evade naive parent/child Office detection rules. |
| Malware in the recycle bin | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | The query detects Windows binaries that can be used for executing malware and have been hidden in the recycle bin. The list of these binaries is sourced from https://lolbas-project.github.io/ Referenc... |
| Potential Remote Desktop Tunneling | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | This query detects remote desktop authentication attempts with a localhost source address, which can indicate a tunneled login. Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-t... |
| Registry Persistence via AppCert DLL Modification | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the... |
| Registry Persistence via AppInit DLLs Modification | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the... |
| Security Event log cleared | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | Checks for event id 1102 which indicates the security event log was cleared. It uses Event Source Name "Microsoft-Windows-Eventlog" to avoid generating false positives from other sources, like AD FS s... |
| Suspicious Powershell Commandlet Executed | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | This analytic rule detects when a suspicious PowerShell commandlet is executed on a host. Threat actors often use PowerShell to execute commands and scripts to move laterally, escalate privileges, and... |
| WDigest downgrade attack | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest... |
| Windows Binaries Executed from Non-Default Directory | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | The query detects Windows binaries, that can be executed from a non-default directory (e.g. C:\Windows\, C:\Windows\System32 etc.). Ref: https://lolbas-project.github.io/ |
| Windows Binaries Lolbins Renamed | Analytic Rule | 📦 Solution | Endpoint Threat Protection Essentials | This query detects the execution of renamed Windows binaries (Lolbins). This is a common technique used by adversaries to evade detection. Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cor... |
| Certutil (LOLBins and LOLScripts, Normalized Process Events) | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This detection uses Normalized Process Events to hunt Certutil activities. |
| Windows System Shutdown/Reboot (Normalized Process Events) | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529). |
| Backup Deletion | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query detects attempts to delete backups, which could be ransomware activity to prevent file restoration and disrupt business services. |
| Detect Certutil (LOLBins and LOLScripts) Usage | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | Sysmon telemetry detects Certutil activities, a tool for cryptographic operations and certificate management. While legitimate, it's also used by malware. |
| Download of New File Using Curl | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | Threat actors may use tools such as Curl to download additional files, communicate with C2 infrastructure, or exfiltrate data. This query looks for new files being downloaded using Curl. |
| Execution of File with One Character in the Name | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query detects execution of files with one character in the name (e.g, a.exe, 7.ps1, g.vbs etc.). Normally files that are executed have more characters in the name and this can indicate a malicio... |
| Persisting via IFEO Registry Key | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query detects frequent creation and deletion of IFEO registry keys in a short time, a technique used by adversaries for system persistence. |
| Potential Microsoft Security Services Tampering | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query identifies potential tampering related to Microsoft security related products and services. |
| Remote Login Performed with WMI | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | It detects authentication attempts performed with WMI. Adversaries may abuse WMI to execute malicious commands and payloads. Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-thro... |
| Remote Scheduled Task Creation or Update using ATSVC Named Pipe | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query detects a scheduled task, created/updated remotely, using the ATSVC name pipe. Threat actors are using scheduled tasks for establishing persistence and moving laterally through the networ... |
| Scheduled Task Creation or Update from User Writable Directory | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query triggers when a scheduled task is created or updated and it is going to run programs from writable user paths. |
| Rundll32 (LOLBins and LOLScripts) | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This detection uses Sysmon telemetry to hunt Signed Binary Proxy Execution: Rundll32 activities. |
| Suspicious Powershell Commandlet Execution | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query searches for suspicious PowerShell commandlet executions, often used by Threat Actors to move laterally, escalate privileges, or exfiltrate data. |
| Unicode Obfuscation in Command Line | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | The query looks for Command Lines that contain non ASCII characaters. Insertion of these characters could be used to evade detections. Command lines should be reviewed to determine whether inclusion ... |
| Rare Windows Firewall Rule updates using Netsh | Hunting Query | 📦 Solution | Endpoint Threat Protection Essentials | This query searches for rare firewall rule changes using netsh utility by comparing rule names and program names from the previous day. |
| Block Risky/Compromised User From Entrust | Playbook | 📦 Solution | Entrust identity as Service | This playbook Block the risky user and update the status in comments section of triggered incident so that SOC analysts get aware of the action taken by playbook |
| Fetch IP Details From Entrust | Playbook | 📦 Solution | Entrust identity as Service | This playbook provides the IP details in comments section of triggered incident so that SOC analysts can directly take corrective measure to stop the attack from unknown/compromised entity |
| Fetch User Details From Entrust | Playbook | 📦 Solution | Entrust identity as Service | This playbook provides the user essential details in comments section of triggered incident so that SOC analysts can directly take corrective measure to stop the attack from unknown/compromised entity |
| Fetch IP Details From Entrust - Entity | Playbook | 📦 Solution | Entrust identity as Service | This playbook provides the IP details of user authentication and management activity in comments section of incident so that SOC analysts can directly take corrective measure to stop the attack from u... |
| Fetch User Details From Entrust - Entity | Playbook | 📦 Solution | Entrust identity as Service | This playbook provides the user essential details in comments section of incident so that SOC analysts can directly take corrective measure to stop the attack from unknown/compromised entity |
| ESETProtectPlatform | Parser | 📦 Solution | ESET Protect Platform | |
| Web sites blocked by Eset | Analytic Rule | 📦 Solution | Eset Security Management Center | Create alert on web sites blocked by Eset. |
| Threats detected by Eset | Analytic Rule | 📦 Solution | Eset Security Management Center | Escalates threats detected by Eset. |
| esetSMCWorkbook | Workbook | 📦 Solution | Eset Security Management Center | |
| Threats detected by ESET | Analytic Rule | 📦 Solution | ESETPROTECT | Escalates threats detected by ESET. |
| Website blocked by ESET | Analytic Rule | 📦 Solution | ESETPROTECT | Create alert on websites blocked by ESET. |
| ESETPROTECT | Workbook | 📦 Solution | ESETPROTECT | |
| ESETPROTECT | Parser | 📦 Solution | ESETPROTECT | |
| ExabeamEvent | Parser | 📦 Solution | Exabeam Advanced Analytics | |
| Generate alerts based on ExtraHop detections recommended for triage | Analytic Rule | 📦 Solution | ExtraHop | This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage. |
| ExtraHopDetectionsOverview | Workbook | 📦 Solution | ExtraHop | |
| ExtraHopDetections | Parser | 📦 Solution | ExtraHop | |
| ExtraHopDetectionSummary | Workbook | 📦 Solution | ExtraHop Reveal(x) | |
| F5BIGIPSystemMetrics | Workbook | 📦 Solution | F5 Big-IP | |
| F5Networks | Workbook | 📦 Solution | F5 Big-IP | |
| ASR Bypassing Writing Executable Content | Analytic Rule | 📦 Solution | FalconFriday | The query checks for any file which has been created/written by an Office application and shortly after renamed to one of the deny-listed "executable extensions" which are text files. (e.g. ps1, .js, ... |
| Microsoft Entra ID Rare UserAgent App Sign-in | Analytic Rule | 📦 Solution | FalconFriday | This query establishes a baseline of the type of UserAgent (i.e. browser, office application, etc) that is typically used for a particular application by looking back for a number of days. It then se... |
| Microsoft Entra ID UserAgent OS Missmatch | Analytic Rule | 📦 Solution | FalconFriday | This query extracts the operating system from the UserAgent header and compares this to the DeviceDetail information present in Microsoft Entra ID. |
| Certified Pre-Owned - backup of CA private key - rule 1 | Analytic Rule | 📦 Solution | FalconFriday | This query identifies someone that performs a read operation of they CA key from the file. |
| Certified Pre-Owned - backup of CA private key - rule 2 | Analytic Rule | 📦 Solution | FalconFriday | This query identifies someone that performs a backup of they CA key. |
| Certified Pre-Owned - TGTs requested with certificate authentication | Analytic Rule | 📦 Solution | FalconFriday | This query identifies someone using machine certificates to request Kerberos Ticket Granting Tickets (TGTs). |
| Ingress Tool Transfer - Certutil | Analytic Rule | 📦 Solution | FalconFriday | This detection addresses most of the known ways to utilize this binary for malicious/unintended purposes. It attempts to accommodate for most detection evasion techniques, like commandline obfuscatio... |
| Component Object Model Hijacking - Vault7 trick | Analytic Rule | 📦 Solution | FalconFriday | This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. The bl... |
| Access Token Manipulation - Create Process with Token | Analytic Rule | 📦 Solution | FalconFriday | This query detects the use of the 'runas' command and checks whether the account used to elevate privileges isn't the user's own admin account. Additionally, it will match this event to the logon eve... |
| DCOM Lateral Movement | Analytic Rule | 📦 Solution | FalconFriday | This detection looks for cases of close-time proximity between incoming network traffic on RPC/TCP, followed by the creation of a DCOM object, followed by the creation of a child process of the DCOM o... |
| Disable or Modify Windows Defender | Analytic Rule | 📦 Solution | FalconFriday | This detection watches the commandline logs for known commands that are used to disable the Defender AV. This is based on research performed by @olafhartong on a large sample of malware for varying pu... |
| Hijack Execution Flow - DLL Side-Loading | Analytic Rule | 📦 Solution | FalconFriday | This detection tries to identify all DLLs loaded by "high integrity" processes and cross-checks the DLL paths against FileCreate/FileModify events of the same DLL by a medium integrity process. Of cou... |
| Detect .NET runtime being loaded in JScript for code execution | Analytic Rule | 📦 Solution | FalconFriday | This query detects .NET being loaded from wscript or cscript to run .NET code, such as cactustorch and sharpshooter. All based on the DotNetToJScript by James Foreshaw documented here https://github.c... |
| Excessive share permissions | Analytic Rule | 📦 Solution | FalconFriday | The query searches for event 5143, which is triggered when a share is created or changed and includes de share permissions. First it checks to see if this is a whitelisted share for the system (e.g. d... |
| Expired access credentials being used in Azure | Analytic Rule | 📦 Solution | FalconFriday | This query searches for logins with an expired access credential (for example an expired cookie). It then matches the IP address from which the expired credential access occurred with the IP addresses... |
| Match Legitimate Name or Location - 2 | Analytic Rule | 📦 Solution | FalconFriday | Attackers often match or approximate the name or location of legitimate files to avoid detection rules that are based trust of on certain operating system processes. This query detects mismatches in t... |
| Office ASR rule triggered from browser spawned office process. | Analytic Rule | 📦 Solution | FalconFriday | The attacker sends a spearphishing email to a user. The email contains a link which points to a website that eventually presents the user a download of an MS Office document. This document contains a ... |
| Suspicious Process Injection from Office application | Analytic Rule | 📦 Solution | FalconFriday | This query detects process injections using CreateRemoteThread, QueueUserAPC or SetThread context APIs, originating from an Office process (only Word/Excel/PowerPoint)that might contains macros. Perfo... |
| Oracle suspicious command execution | Analytic Rule | 📦 Solution | FalconFriday | The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database. |
| Password Spraying | Analytic Rule | 📦 Solution | FalconFriday | This query detects a password spraying attack, where a single machine has performed a large number of failed login attempts, with a large number of different accounts. For each account, the attacker ... |
| Beacon Traffic Based on Common User Agents Visiting Limited Number of Domains | Analytic Rule | 📦 Solution | FalconFriday | This query searches web proxy logs for a specific type of beaconing behavior by joining a number of sources together: - Traffic by actual web browsers - by looking at traffic generated by a UserAgent... |
| Remote Desktop Protocol - SharpRDP | Analytic Rule | 📦 Solution | FalconFriday | This detection monitors for the behavior that SharpRDP exhibits on the target system. The most relevant is leveraging taskmgr.exe to gain elevated execution, which means that taskmgr.exe is creating u... |
| Rename System Utilities | Analytic Rule | 📦 Solution | FalconFriday | Attackers often use LOLBINs that are renamed to avoid detection rules that are based on filenames. This rule detects renamed LOLBINs by first searching for all the known SHA1 hashes of the LOLBINs in ... |
| SMB/Windows Admin Shares | Analytic Rule | 📦 Solution | FalconFriday | This query is based on detecting incoming RPC/TCP on the SCM, followed by the start of a child process of services.exe. Remotely interacting with the SCM triggers the RPC/TCP traffic on services.exe, ... |
| Suspicious named pipes | Analytic Rule | 📦 Solution | FalconFriday | This query looks for Named Pipe events that either contain one of the known IOCs or make use of patterns that can be linked to CobaltStrike usage. |
| Suspicious parentprocess relationship - Office child processes. | Analytic Rule | 📦 Solution | FalconFriday | The attacker sends a spearphishing email to a user. The email contains a link, which points to a website that eventually presents the user a download of an MS Office document. This document contains a... |
| Trusted Developer Utilities Proxy Execution | Analytic Rule | 📦 Solution | FalconFriday | This detection looks at process executions - in some cases with specific command line attributes to filter a lot of common noise. |
| Detecting UAC bypass - elevated COM interface | Analytic Rule | 📦 Solution | FalconFriday | This query identifies processes spawned with high integrity from dllhost.exe with a command line that contains one of three specific CLSID GUIDs. |
| Detecting UAC bypass - modify Windows Store settings | Analytic Rule | 📦 Solution | FalconFriday | This query identifies modification a specific registry key and then launching wsreset.exe that resets the Windows Store settings. |
| Detecting UAC bypass - ChangePK and SLUI registry tampering | Analytic Rule | 📦 Solution | FalconFriday | This query identifies setting a registry key under HKCU, launching slui.exe and then ChangePK.exe. |
| DNSDB_Co_Located_Hosts 🔍 | Playbook | 📦 Solution | Farsight DNSDB | author: Henry Stern, Farsight Security, Inc. |
| DNSDB_Co_Located_IP_Address 🔍 | Playbook | 📦 Solution | Farsight DNSDB | author: Henry Stern, Farsight Security, Inc. |
| DNSDB_Historical_Address 🔍 | Playbook | 📦 Solution | Farsight DNSDB | author: Henry Stern, Farsight Security, Inc. |
| DNSDB_Historical_Hosts 🔍 | Playbook | 📦 Solution | Farsight DNSDB | author: Henry Stern, Farsight Security, Inc. |
| FireEyeNXEvent | Parser | 📦 Solution | FireEye Network Security | |
| Flare Cloud bucket result | Analytic Rule | 📦 Solution | Flare | Results found on an publicly available cloud bucket |
| Flare Leaked Credentials | Analytic Rule | 📦 Solution | Flare | Searches for Flare Leaked Credentials |
| Flare Google Dork result found | Analytic Rule | 📦 Solution | Flare | Results using a dork on google was found |
| Flare Host result | Analytic Rule | 📦 Solution | Flare | Results found relating to IP, domain or host |
| Flare Infected Device | Analytic Rule | 📦 Solution | Flare | Infected Device found on darkweb or Telegram |
| Flare Paste result | Analytic Rule | 📦 Solution | Flare | Result found on code Snippet (paste) sharing platform |
| Flare Source Code found | Analytic Rule | 📦 Solution | Flare | Result found on Code Sharing platform |
| Flare SSL Certificate result | Analytic Rule | 📦 Solution | Flare | SSL Certificate registration found |
| FlareSystemsFireworkOverview | Workbook | 📦 Solution | Flare | |
| credential-warning | Playbook | 📦 Solution | Flare | This playbook monitors all data received from Firework looking for leaked credentials (email:password combinations). When found, this playbook will send an email to the email address warning their pas... |
| ForcepointCASB | Workbook | 📦 Solution | Forcepoint CASB | |
| ForcepointCloudSecuirtyGateway | Workbook | 📦 Solution | Forcepoint CSG | |
| ForcepointDLP | Workbook | 📦 Solution | Forcepoint DLP | |
| ForcepointNGFW | Workbook | 📦 Solution | Forcepoint NGFW | |
| ForcepointNGFWAdvanced | Workbook | 📦 Solution | Forcepoint NGFW | |
| ForescoutEvent | Parser | 📦 Solution | Forescout (Legacy) | |
| eyeInspectOTSecurityWorkbook | Workbook | 📦 Solution | Forescout eyeInspect for OT Security | |
| Forescout-DNS_Sniff_Event_Monitor | Analytic Rule | 📦 Solution | ForescoutHostPropertyMonitor | This rule creates an incident when more than certain number of Dnsniff events are generated from a host |
| ForescoutHostPropertyMonitorWorkbook | Workbook | 📦 Solution | ForescoutHostPropertyMonitor | |
| Forescout-DNS_Sniff_Event_Playbook | Playbook | 📦 Solution | ForescoutHostPropertyMonitor | This playbook will update incident with action to perform on endpoint |
| ForgeRockParser | Parser | 📦 Solution | ForgeRock Common Audit for CEF | |
| Fortigate | Workbook | 📦 Solution | Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel | |
| Fortinet-FortiGate-IPEnrichment | Playbook | 📦 Solution | Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel | This playbook enriches the incident with address object and address group. |
| Fortinet-FortiGate-ResponseOnBlockIP | Playbook | 📦 Solution | Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel | This playbook allows the SOC users to automatically response to Microsoft Sentinel incidents which includes IPs, by adding/removing the IPs to the Microsoft Sentinel IP blocked group. |
| Fortinet-FortiGate-ResponseOnBlockURL | Playbook | 📦 Solution | Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel | This playbook allows the SOC users to automatically response to Microsoft Sentinel incidents which includes URL's, by adding the URLs to the Microsoft Sentinel URL blocked group. |
| FortinetFortiNdrCloudWorkbook | Workbook | 📦 Solution | Fortinet FortiNDR Cloud | |
| Fortinet_FortiNDR_Cloud | Parser | 📦 Solution | Fortinet FortiNDR Cloud | |
| Fortiweb - WAF Allowed threat | Analytic Rule | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | Detects WAF "Allowed" action on threat events. |
| Fortiweb - identify owasp10 vulnerabilities | Hunting Query | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | Query searches threats and helps to identify threats matching owaspTop10 vulnerabilities. |
| Fortiweb - Unexpected countries | Hunting Query | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | Query searches requests by country and helps to identify requests coming from unexpected countries. |
| Fortiweb-workbook | Workbook | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | |
| Block IP & URL on fortiweb cloud | Playbook | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | This Playbook Provides the automation on blocking the suspicious/malicious IP and URL on fortiweb cloud waf |
| Fetch Threat Intel from fortiwebcloud | Playbook | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | This playbook provides/updates the threat intel and essential details in comments section of triggered incident so that SOC analysts can directly take corrective measure to stop the attack |
| Fortiweb | Parser | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | |
| GDPRComplianceAndDataSecurity | Workbook | 📦 Solution | GDPR Compliance & Data Security | |
| Gigamon | Workbook | 📦 Solution | Gigamon Connector | |
| GitHub - A payment method was removed | Analytic Rule | 📦 Solution | GitHub | Detect activities when a payment method was removed. This query runs every day and its severity is Medium. |
| GitHub Activites from a New Country | Analytic Rule | 📦 Solution | GitHub | Detect activities from a location that was not recently or was never visited by the user or by any user in your organization. |
| GitHub - Oauth application - a client secret was removed | Analytic Rule | 📦 Solution | GitHub | Detect activities when a client secret was removed. This query runs every day and its severity is Medium. |
| GitHub - pull request was created | Analytic Rule | 📦 Solution | GitHub | Detect activities when a pull request was created. This query runs every day and its severity is Medium. |
| GitHub - pull request was merged | Analytic Rule | 📦 Solution | GitHub | Detect activities when a pull request was merged. This query runs every day and its severity is Medium. |
| GitHub - Repository was created | Analytic Rule | 📦 Solution | GitHub | Detect activities when a repository was created. This query runs every day and its severity is Medium. |
| GitHub - Repository was destroyed | Analytic Rule | 📦 Solution | GitHub | Detect activities when a repository was destroyed. This query runs every day and its severity is Medium. |
| GitHub Two Factor Auth Disable | Analytic Rule | 📦 Solution | GitHub | Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerpr... |
| GitHub - User visibility Was changed | Analytic Rule | 📦 Solution | GitHub | Detect activities when a user visibility Was changed. This query runs every day and its severity is Medium. |
| GitHub - User was added to the organization | Analytic Rule | 📦 Solution | GitHub | Detect activities when a user was added to the organization. This query runs every day and its severity is Medium. |
| GitHub - User was blocked | Analytic Rule | 📦 Solution | GitHub | Detect activities when a user was blocked on the repository. This query runs every day and its severity is Medium. |
| GitHub - User was invited to the repository | Analytic Rule | 📦 Solution | GitHub | Detect activities when a user was invited to the repository. This query runs every day and its severity is Medium. |
| NRT GitHub Two Factor Auth Disable | Analytic Rule | 📦 Solution | GitHub | Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerpr... |
| GitHub Security Vulnerability in Repository | Analytic Rule | 📦 Solution | GitHub | This alerts when there is a new security vulnerability in a GitHub repository. |
| GitHub First Time Invite Member and Add Member to Repo | Hunting Query | 📦 Solution | GitHub | This hunting query identifies a user that add/invite a member to the organization for the first time. This technique can be leveraged by attackers to add stealth account access to the organization. |
| GitHub Inactive or New Account Access or Usage | Hunting Query | 📦 Solution | GitHub | This hunting query identifies Accounts that are new or inactive and have accessed or used GitHub that may be a sign of compromise. |
| GitHub Mass Deletion of repos or projects | Hunting Query | 📦 Solution | GitHub | This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise. |
| GitHub OAuth App Restrictions Disabled | Hunting Query | 📦 Solution | GitHub | This hunting query identifies GitHub OAuth Apps that have restrictions disabled that may be a sign of compromise. Attacker will want to disable such security tools in order to go undetected. |
| GitHub Update Permissions | Hunting Query | 📦 Solution | GitHub | This hunting query identifies GitHub activites where permissions are updated that may be a sign of compromise. |
| GitHub Repo switched from private to public | Hunting Query | 📦 Solution | GitHub | This hunting query identifies GitHub activites where a repo was changed from private to public that may be a sign of compromise. |
| GitHub First Time Repo Delete | Hunting Query | 📦 Solution | GitHub | This hunting query identifies GitHub activites its the first time a user deleted a repo that may be a sign of compromise. |
| GitHub User Grants Access and Other User Grants Access | Hunting Query | 📦 Solution | GitHub | This hunting query identifies Accounts in GitHub that have granted access to another account which then grants access to yet another account that may be a sign of compromise. |
| GitHub | Workbook | 📦 Solution | GitHub | |
| GitHubAdvancedSecurity | Workbook | 📦 Solution | GitHub | |
| GitHubAuditData | Parser | 📦 Solution | GitHub | |
| GitHubCodeScanningData | Parser | 📦 Solution | GitHub | |
| GitHubDependabotData | Parser | 📦 Solution | GitHub | |
| GitHubScanAudit | Parser | 📦 Solution | GitHub | |
| GitHubSecretScanningData | Parser | 📦 Solution | GitHub | |
| Unusual Anomaly | Analytic Rule | 🔗 GitHub | GitHub Only | Anomaly Rules generate events in the Anomalies table. This scheduled rule tries to detect Anomalies that are not usual, they could be a type of Anomaly that has recently been activated, or an infreque... |
| Cisco Umbrella - Connection to non-corporate private network | Analytic Rule | 🔗 GitHub | GitHub Only | IP addresses of broadband links that usually indicates users attempting to access their home network, for example for a remote session to a home computer. |
| Cisco Umbrella - Connection to Unpopular Website Detected | Analytic Rule | 🔗 GitHub | GitHub Only | Detects first connection to an unpopular website (possible malicious payload delivery). |
| Cisco Umbrella - Crypto Miner User-Agent Detected | Analytic Rule | 🔗 GitHub | GitHub Only | Detects suspicious user agent strings used by crypto miners in proxy logs. |
| Cisco Umbrella - Empty User Agent Detected | Analytic Rule | 🔗 GitHub | GitHub Only | Rule helps to detect empty and unusual user agent indicating web browsing activity by an unusual process other than a web browser. |
| Cisco Umbrella - Hack Tool User-Agent Detected | Analytic Rule | 🔗 GitHub | GitHub Only | Detects suspicious user agent strings used by known hack tools |
| Cisco Umbrella - Windows PowerShell User-Agent Detected | Analytic Rule | 🔗 GitHub | GitHub Only | Rule helps to detect Powershell user-agent activity by an unusual process other than a web browser. |
| Cisco Umbrella - Rare User Agent Detected | Analytic Rule | 🔗 GitHub | GitHub Only | Rule helps to detect a rare user-agents indicating web browsing activity by an unusual process other than a web browser. |
| Cisco Umbrella - Request Allowed to harmful/malicious URI category | Analytic Rule | 🔗 GitHub | GitHub Only | It is reccomended that these Categories shoud be blocked by policies because they provide harmful/malicious content.. |
| Cisco Umbrella - Request to blocklisted file type | Analytic Rule | 🔗 GitHub | GitHub Only | Detects request to potentially harmful file types (.ps1, .bat, .vbs, etc.). |
| Cisco Umbrella - URI contains IP address | Analytic Rule | 🔗 GitHub | GitHub Only | Malware can use IP address to communicate with C2. |
| Suspicious VM Instance Creation Activity Detected | Analytic Rule | 🔗 GitHub | GitHub Only | This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud V... |
| Certutil (LOLBins and LOLScripts, Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | This detection uses Normalized Process Events to hunt Certutil activities |
| Cscript script daily summary breakdown (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | breakdown of scripts running in the environment |
| Dev-0056 Command Line Activity November 2021 (ASIM Version) | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query looks for process command line activity related to activity observed by Dev-0056.The command lines this query hunts for are used as part of the threat actor's post exploitation act... |
| Enumeration of users and groups (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Finds attempts to list users or groups using the built-in Windows 'net' tool |
| Exchange PowerShell Snapin Added (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | The Exchange Powershell Snapin was loaded on a host, this allows for a Exchange server management via PowerShell. Whilst this is a legitimate administrative tool it is abused by attackers to performs ... |
| Host Exporting Mailbox and Removing Export (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query looks for hosts exporting a mailbox from an on-prem Exchange server, followed by that same host removing the export within a short time window. This pattern has been observed by att... |
| Invoke-PowerShellTcpOneLine Usage (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Invoke-PowerShellTcpOneLine is a PowerShell script to create a simple and small reverse shell. It can be abused by attackers to exfiltrate data. This query looks for command line activity similar to I... |
| Nishang Reverse TCP Shell in Base64 (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Looks for Base64-encoded commands associated with the Nishang reverse TCP shell. Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1 |
| Summary of users created using uncommon/undocumented commandline switches (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Summarizes uses of uncommon & undocumented commandline switches to create persistence User accounts may be created to achieve persistence on a machine. Read more here: https://attack.mitre.org/wiki/Te... |
| Powercat Download (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Powercat is a PowerShell implementation of netcat. Whilst it can be used as a legitimate administrative tool it can be abused by attackers to exfiltrate data. This query looks for command line activit... |
| PowerShell downloads (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Finds PowerShell execution events that could involve a download |
| Entropy for Processes for a given Host (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Entropy calculation used to help identify Hosts where they have a high variety of processes(a high entropy process list on a given Host over time). This helps us identify rare processes on a given Hos... |
| SolarWinds Inventory (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Beyond your internal software management systems, it is possible you may not have visibility into your entire footprint of SolarWinds installations. This is intended to help use process exection info... |
| Suspicious enumeration using Adfind tool (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Attackers can use Adfind which is administrative tool to gather information about Domain controllers, ADFS Servers. They may also rename executables with other benign tools on the system. Below query ... |
| Uncommon processes - bottom 5% (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | Shows the rarest processes seen running for the first time. (Performs best over longer time ranges - eg 3+ days rather than 24 hours!) These new processes could be benign new programs installed on hos... |
| Windows System Shutdown/Reboot (Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529) |
| Rundll32 (LOLBins and LOLScripts, Normalized Process Events) | Hunting Query | 🔗 GitHub | GitHub Only | This detection uses Normalized Process Events to hunt Signed Binary Proxy Execution: Rundll32 activities |
| Account Added to Privileged PIM Group | Hunting Query | 🔗 GitHub | GitHub Only | Identifies accounts that have been added to a PIM managed privileged group |
| Account MFA Modifications | Hunting Query | 🔗 GitHub | GitHub Only | Identifies modifications to user's MFA settings. An attacker could use access to modify MFA settings to bypass MFA requirements or maintain persistence. |
| OAuth Application Required Resource Access Update | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies updates to the RequiredResourceAccess property of an OAuth application. This property specifies resources that an application requires access to and the set of OAuth perm... |
| Approved Access Packages Details | Hunting Query | 🔗 GitHub | GitHub Only | This query shows details about all approved Entra ID Governance Access Packages assignments. The results include the time the request was created and approved along with the justification text provide... |
| BitLocker Key Retrieval | Hunting Query | 🔗 GitHub | GitHub Only | Looks for users retrieving BitLocker keys. Enriches these logs with a summary of alerts associated with the user accessing the keys. Use this query to start looking for anomalous patterns of key retri... |
| Invited Guest User but not redeemed Invite for longer period. | Hunting Query | 🔗 GitHub | GitHub Only | This query will look for events where guest user was invited but has not accepted/redeemed invite for unusually longer period. Any invites not redeemed for longer period of time can be misused and p... |
| Users Authenticating to Other Microsoft Entra ID Tenants | Hunting Query | 🔗 GitHub | GitHub Only | Detects when a user has successfully authenticated to another Microsoft Entra ID tenant with an identity in your organization's tenant. Ref: https://docs.microsoft.com/azure/active-directory/fundame... |
| Possible SpringShell Exploitation Attempt (CVE-2022-22965) | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965). The Spring Framework is one of the most widely used lightweight ope... |
| Detect Enumeration Activity Using Unique Identifiers and Session Aggregation | Hunting Query | 🔗 GitHub | GitHub Only | "This Kusto (KQL) hunting query detects blob-enumeration or file-spraying behaviour in Azure Storage by: - Aggregating requests into time-bound sessions with row_window_session(). - Defining a "us... |
| Azure Storage File Create, Access, Delete | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query will identify where a file is uploaded to Azure File or Blob storage and is then accessed once before being deleted. This activity may be indicative of exfiltration activity. |
| Azure Storage File Create and Delete | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query will try to identify instances where a file us uploaded to file storage and then deleted within a given threshold. By default the query will find instances where a file is uploaded ... |
| Storage File Seen on Endpoint | Hunting Query | 🔗 GitHub | GitHub Only | Finds instances where a file uploaded to blob or file storage and it is seen on an endpoint by Microsoft Defender XDR. |
| Azure Storage Mass File Deletion | Hunting Query | 🔗 GitHub | GitHub Only | Detect mass file deletion events within Azure File and Blob storage. deleteWindow controls the period of time the deletions must occur in, whilst the deleteThreshold controls how many files must be de... |
| Azure Storage file upload from VPS Providers | Hunting Query | 🔗 GitHub | GitHub Only | Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges. This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent provid... |
| User Account Linked to Storage Account File Upload | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query will try to identify the user account used to perform a file upload to blob storage. This query can be used to match all file upload events, or filtering can be applied on filename ... |
| Policy configuration changes for CloudApp Events | Hunting Query | 🔗 GitHub | GitHub Only | "This query searches for any action type with high frequency that involves adding, modifying, or removing something in cloud app policies. It sees where the properties are modified such that the old v... |
| Abnormally Large JPEG Filed Downloaded from New Source | Hunting Query | 🔗 GitHub | GitHub Only | Threat actors can use JPEG files to hide malware, or other malicious code from inspection. This query looks for the downloading of abnormally large JPEG files from a source where large JPEG files have... |
| GitHub First Time Invite Member and Add Member to Repo | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies a user that add/invite a member to the organization for the first time. This technique can be leveraged by attackers to add stealth account access to the organization. |
| GitHub Inactive or New Account Access or Usage | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies Accounts that are new or inactive and have accessed or used GitHub that may be a sign of compromise. |
| GitHub Mass Deletion of repos or projects | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise. |
| GitHub OAuth App Restrictions Disabled | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies GitHub OAuth Apps that have restrictions disabled that may be a sign of compromise. Attacker will want to disable such security tools in order to go undetected. |
| GitHub Update Permissions | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies GitHub activites where permissions are updated that may be a sign of compromise. |
| GitHub Repo switched from private to public | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies GitHub activites where a repo was changed from private to public that may be a sign of compromise. |
| GitHub First Time Repo Delete | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies GitHub activites its the first time a user deleted a repo that may be a sign of compromise. |
| GitHub User Grants Access and Other User Grants Access | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query identifies Accounts in GitHub that have granted access to another account which then grants access to yet another account that may be a sign of compromise. |
| Cross-service Azure Data Explorer queries | Hunting Query | 🔗 GitHub | GitHub Only | Under specific circumstances, executing KQL queries can exfiltrate information like access tokens, regarding external data functions like adx(). This query tries to list executed KQL queries that used... |
| New users calling sensitive Watchlist | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query looks for users who have run queries calling a watchlist template relating to sensitive data that have not previously been seen calling these watchlists. |
| Privileged Accounts - Failed MFA | Hunting Query | 🔗 GitHub | GitHub Only | Identifies failed MFA attempts from Privileged accounts. Privileged accounts list can be based on IdentityInfo UEBA table or built-in watchlist. Ref : https://docs.microsoft.com/azure/active-director... |
| Anomolous Sign Ins Based on Time | Hunting Query | 🔗 GitHub | GitHub Only | Identifies anomolies in signin events based on the volume of signin events over time. Use this to identify suspicious authentication patterns such as spikes in activity or out of hours events. Ref : h... |
| Azure VM Run Command linked with MDE | Hunting Query | 🔗 GitHub | GitHub Only | Identifies any Azure VM Run Command operations and links these operations with MDE host logging. Linking these two data sources provides hunting opportunities. Logging from AzureActivity provides the ... |
| Critical user management operations followed by disabling of System Restore from admin account | Hunting Query | 🔗 GitHub | GitHub Only | This query could identify critical user management operations like user registration(Microsoft Entra ID Multi-Factor Authentication & self-service password reset (SSPR)) authentication by admin accoun... |
| Dormant Service Principal Update Creds and Logs In | Hunting Query | 🔗 GitHub | GitHub Only | This query look for Service Principal accounts that are no longer used where a user has added or updated credentials for them before logging in with the Service Principal. Threat actors may look to r... |
| Dormant User Update MFA and Logs In - UEBA | Hunting Query | 🔗 GitHub | GitHub Only | This query look for accounts that have not been successfully logged into recently who then add or update an MFA method before logging in. Threat actors may look to re-activate dormant accounts and use... |
| Dormant User Update MFA and Logs In | Hunting Query | 🔗 GitHub | GitHub Only | This querys look for users accounts that have not been successfully logged into recently, who then have a MFA method added or updated before logging in. Threat actors may look to re-activate dormant a... |
| Download of New File Using Curl | Hunting Query | 🔗 GitHub | GitHub Only | Threat actors may use tools such as Curl to download additional files, communicate with C2 infrastructure, or exfiltrate data. This query looks for new files being downloaded using Curl. Curl also has... |
| Exchange Servers and Associated Security Alerts | Hunting Query | 🔗 GitHub | GitHub Only | This query will dynamically identify Exchange servers using common web paths used by the application in the csUriStem. The query will then collect MDE alerts from the SecurityAlert table using the ide... |
| FireEye stolen red teaming tools communications | Hunting Query | 🔗 GitHub | GitHub Only | This composite hunting query will highlight any HTTP traffic in CommonSecurityLog web proxies (such as ZScaler) that match known patterns used by red teaming tools potentially stolen from FireEye. Mos... |
| Rare firewall rule changes using netsh | Hunting Query | 🔗 GitHub | GitHub Only | This query will show rare firewall rule changes using netsh utility by comparing rule names and program names from the previous day with those from the historical chosen time frame. - This technique w... |
| High Risk Sign In Around Authentication Method Added or Device Registration | Hunting Query | 🔗 GitHub | GitHub Only | This query shows authentication methods being added and devices registered around the time of a high risk sign in which could indicate an attempt to establish persistence on a compromised account. The... |
| New Location Sign in with Mail forwarding activity | Hunting Query | 🔗 GitHub | GitHub Only | This query helps detect new Microsoft Entra ID sign in from a new location correlating with Office Activity data highlighting cases where user mails are being forwarded and shows if it is being forwa... |
| Successful Sign-In From Non-Compliant Device with bulk download activity | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query will help detect successful sign-ins from devices that are marked non-compliant along with bulk download activity. Attackers may attempt to get a list of accounts, groups, registrat... |
| Possible command injection attempts against Azure Integration Runtimes | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query looks for potential command injection attempts via the vulnerable third-party driver against Azure IR with Managed VNet or SHIR processes as well as post-exploitation activity based... |
| Potential SSH Tunnel to AAD Connect Host | Hunting Query | 🔗 GitHub | GitHub Only | Azure AD Connect (AAD Connect) is a critical service that handles connections between on-premise Active Directory and Azure AD. Due to the critical nature of AAD Connect threat actors may attempt to c... |
| Privileged Account Password Changes | Hunting Query | 🔗 GitHub | GitHub Only | Identifies where Privileged Accounts have updated passwords or security information. This is joined with UEBA alerts to filter to only those accounts with a high investigation priority. Ref : https://... |
| Privileged Accounts Locked Out | Hunting Query | 🔗 GitHub | GitHub Only | Identifies privileged accounts that have been locked out. Verify these lockout are due to legitimate user activity and not due to threat actors attempting to access the accounts. Ref : https://docs.mi... |
| Recon Activity with Interactive Logon Correlation | Hunting Query | 🔗 GitHub | GitHub Only | This query looks at correlating different reconnaissance alerts with interactive logon logs to help analysts investigate initial possible compromise activity |
| SQL Alert Correlation with CommonSecurityLogs and AuditLogs | Hunting Query | 🔗 GitHub | GitHub Only | This query combines different SQL alerts with CommonSecurityLogs and AuditLogs helping analysts /investigate any possible SQL related attacks faster thus reducing Mean Time To Respond |
| Storage Account Key Enumeration | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies attackers trying to enumerate the Storage keys as well as updating roles using AzureActivity,SigninLogs and AuditLogs |
| Storage Alerts Correlation with CommonSecurityLogs & AuditLogs | Hunting Query | 🔗 GitHub | GitHub Only | This query combines different Storage alerts with CommonSecurityLogs and AuditLogs helping analysts investigate any possible storage related attacks faster thus reducing Mean Time To Respond |
| Storage Alert Correlation with CommonSecurityLogs and StorageLogs | Hunting Query | 🔗 GitHub | GitHub Only | This query combines different Storage alerts with CommonSecurityLogs and StorageLogs helping analysts triage and investigate any possible Storage related attacks faster thus reducing Mean Time To Re... |
| Integrate Purview with Cloud App Events | Hunting Query | 🔗 GitHub | GitHub Only | "This query searches for any files in Cloud App Events that have trigger a security alert." |
| Unfamiliar Signin Correlation with AzurePortal Signin Attempts and AuditLogs | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for unfamiliar Sign-in's thats not seen recently for the given user with azure portal login attempts and audit logs to help detect and reduce the analysis timeline for defenders |
| Alerts related to account | Hunting Query | 🔗 GitHub | GitHub Only | Any Alerts that fired related to a given account during the range of +6h and -3d |
| Alerts With This Process | Hunting Query | 🔗 GitHub | GitHub Only | Any Alerts that fired on any host with this same process in the range of +-1d |
| AD Account Lockout | Hunting Query | 🔗 GitHub | GitHub Only | Detects Active Directory account lockouts |
| AD FS Database Local SQL Statements | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query uses Application events from the "MSSQL$MICROSOFT##WID" provider to collect SQL statements run against an AD FS database (e.g Windows Internal Database (WID)). A threat actor might ... |
| Fake computer account authentication attempt | Hunting Query | 🔗 GitHub | GitHub Only | This query detects authentication attempt from a fake computer account(username ends with $). Computer accounts are normally not authenticating via interactive logon or remote desktop neither they ar... |
| Suspicious command line tokens in LolBins or LolScripts | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Microsoft-signed Binaries and Scripts that are not system initiated. This technique is commonly used in phishing attacks |
| Large Scale Malware Deployment via GPO Scheduled Task Modification | Hunting Query | 🔗 GitHub | GitHub Only | This query detects lateral movement using GPO scheduled task usually used to deploy ransomware at scale. It monitors whether a scheduled task is modified within the Sysvol folder in GPO. Ref: https:... |
| Potential Local Exploitation for Privilege Escalation | Hunting Query | 🔗 GitHub | GitHub Only | This query detects a process that runs under SYSTEM user's security context and was spawned by a process that was running under a lower security context indicating an exploitation for privilege escala... |
| Potential Process Doppelganging | Hunting Query | 🔗 GitHub | GitHub Only | This query detects Process Doppelganging, a technique that calls several APIs related to NTFS transactions which allow to substitute the PE content before the process is even created. Ref: https://att... |
| Remote Task Creation/Update using Schtasks Process | Hunting Query | 🔗 GitHub | GitHub Only | The query detects a scheduled task, created/updated remotely, using the Schtasks process. Threat actors are using scheduled tasks for establishing persistence and moving laterally through the network... |
| RID Hijacking | Hunting Query | 🔗 GitHub | GitHub Only | This query detects all authentication attempts of non administrator accounts that their RID is ending in *-500. Ref: https://stealthbits.com/blog/rid-hijacking-when-guests-become-admins/ |
| Users Opening and Reading the Local Device Identity Key | Hunting Query | 🔗 GitHub | GitHub Only | This detection uses Windows security events to look for users reading the local Device Identity Key (Machine Key). This information can be correlated with other events for additional context and get ... |
| Windows System Shutdown/Reboot(Sysmon) | Hunting Query | 🔗 GitHub | GitHub Only | This detection uses Sysmon telemetry to detect System Shutdown/Reboot (MITRE Technique: T1529) |
| Suspected Brute force attack Investigation | Hunting Query | 🔗 GitHub | GitHub Only | Summarize all the failures and success events for all users in the last 24 hours, only identify users with more than 100 failures in the set period |
| Administrators Authenticating to Another Microsoft Entra ID Tenant | Hunting Query | 🔗 GitHub | GitHub Only | Detects when a privileged user account successfully authenticates from to another Microsoft Entra ID Tenant. Authentication attempts should be investigated to ensure the activity was legitimate and ... |
| Low & slow password attempts with volatile IP addresses | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query will identify instances where a single user account has seen a high incidence of failed attempts from highly volatile IP addresses Changing IP address for every password attempt is... |
| Multiple Entra ID Admins Removed | Hunting Query | 🔗 GitHub | GitHub Only | Looks for multiple users that had their admin role removed by a single user within a certain period. The default threshold is 5 removals, this can be edited in the query. |
| Risky Sign-in with Device Registration | Hunting Query | 🔗 GitHub | GitHub Only | Looks for new device registrations following a risky user account sign-in. By default the query will use a 6 hour lookback period, this can be configured within the query. |
| Smart Lockouts | Hunting Query | 🔗 GitHub | GitHub Only | Identifies accounts that have been locked out by smart lockout policies. Review this results for patterns that might suggest that a password spray is triggering these smart lockout events. Ref : https... |
| Spike in failed sign-in events | Hunting Query | 🔗 GitHub | GitHub Only | Identifies spikes in failed sign-in events based on the volume of failed sign-in events over time. Use to identify patterns of suspicious behavior such as unusually high failed sign-in attempts from c... |
| Sign-ins from IPs that attempt sign-ins to disabled accounts | Hunting Query | 🔗 GitHub | GitHub Only | Identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account. This analytic will additionally identify the successful signed in accounts as... |
| User Accounts - Blocked Accounts | Hunting Query | 🔗 GitHub | GitHub Only | An account could be blocked/locked out due to multiple reasons. This hunting query summarize blocked/lockout accounts and checks if most recent signin events for them is after last blocked accounts Re... |
| User Accounts - Successful Sign in Spikes | Hunting Query | 🔗 GitHub | GitHub Only | Identifies measureable increase in successful sign-ins from user accounts. Spike is determined based on Time series anomaly which will look at historical baseline values. Ref : https://docs.microsoft... |
| Exchange Server ProxyLogon URIs | Hunting Query | 🔗 GitHub | GitHub Only | This query will detect paths suspicious associated with ProxyLogon exploitation |
| Exchange Server Suspicious URIs Visited | Hunting Query | 🔗 GitHub | GitHub Only | This query will detect paths suspicious associated with ProxyLogon exploitation, it will then calculate the percentage of suspicious URIs the user had visited in relation to the total number of URIs t... |
| Suspected ProxyToken Exploitation | Hunting Query | 🔗 GitHub | GitHub Only | Looks for activity that might indicate exploitation of the ProxyToken vulnerability - CVE-2021-33766 Ref: https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-micros... |
| ASR rules categorized detection graph | Hunting Query | 🔗 GitHub | GitHub Only | This query offers daily categorization of ASR rules, helping SOC analysts monitor specific categories like office-related activities or WMI among the 16 rules. It aids in tracking detection rates and... |
| Abuse.ch Recent Threat Feed (1) | Hunting Query | 🔗 GitHub | GitHub Only | This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using t... |
| Abuse.ch Recent Threat Feed | Hunting Query | 🔗 GitHub | GitHub Only | This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using t... |
| Abusing settingcontent-ms | Hunting Query | 🔗 GitHub | GitHub Only | Sample query that search for .settingcontent-ms that has been downloaded from the web. Through Microsoft Edge, Internet Explorer, Google Chrome, Mozilla Firefox, Microsoft Outlook. For questions @Mila... |
| APT Baby Shark | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_babyshark.yml. Questions via Twitter: @janvonkirchheim. |
| apt sofacy zebrocy | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy_zebrocy.yml. Questions via Twitter: @janvonkirchheim. |
| apt sofacy | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy.yml. Questions via Twitter: @janvonkirchheim. |
| apt ta17 293a ps | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_ta17_293a_ps.yml. Questions via Twitter: @janvonkirchheim. |
| apt tropictrooper | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_tropictrooper.yml. Questions via Twitter: @janvonkirchheim. |
| apt unidentified nov 18 (1) | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml. Questions via Twitter: @janvonkirchheim. |
| apt unidentified nov 18 | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml. Questions via Twitter: @janvonkirchheim. |
| APT29 thinktanks | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_apt29_thinktanks.yml. Questions via Twitter: @janvonkirchheim. |
| Bear Activity GTR 2019 | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_bear_activity_gtr19.yml. Questions via Twitter: @janvonkirchheim. |
| c2-lookup-from-nonbrowser[Nobelium] (1) | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| c2-lookup-from-nonbrowser[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| c2-lookup-response[Nobelium] (1) | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| c2-lookup-response[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| Cloud Hopper | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_cloudhopper.yml. Questions via Twitter: @janvonkirchheim. |
| cobalt-strike-invoked-w-wmi | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog. Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread ... |
| compromised NVIDIA certificates[Lapsus$] | Hunting Query | 🔗 GitHub | GitHub Only | Search for the files that are using a compromised certificate associated with the Lapsus$ group. You can remove the comments to: 1. get the list of devices where there is at least one file signed with... |
| compromised-certificate[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | Search for the files that are using a compromised certificate associated with the Nobelium campaign. You can remove the comments to: 1. get the list of devices where there is at least one file signed ... |
| confluence-weblogic-targeted | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Confluence and WebLogic abuse. 2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle We... |
| cypherpunk-exclusive-commands | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs. Cypherpunk is a human-operated ransomware campaign named after the unusual .cyphe... |
| cypherpunk-remote-exec-w-psexesvc | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs. Cypherpunk is a human-operated ransomware campaign named after the unusual .cyphe... |
| detect-cyzfc-activity (1) | Hunting Query | 🔗 GitHub | GitHub Only | These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs. As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sec... |
| detect-cyzfc-activity (2) | Hunting Query | 🔗 GitHub | GitHub Only | These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs. As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sec... |
| detect-cyzfc-activity (3) | Hunting Query | 🔗 GitHub | GitHub Only | These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs. As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sec... |
| detect-cyzfc-activity (4) | Hunting Query | 🔗 GitHub | GitHub Only | These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs. As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sec... |
| detect-cyzfc-activity | Hunting Query | 🔗 GitHub | GitHub Only | These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs. As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sec... |
| DofoilNameCoinServerTraffic | Hunting Query | 🔗 GitHub | GitHub Only | This is a query to retrieve last 30 days network connections to known Dofoil NameCoin servers. The full article is available here: https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-d... |
| Dopplepaymer In-Memory Malware Implant | Hunting Query | 🔗 GitHub | GitHub Only | Dopplepaymer In-Memory Malware Implant. This query identifies processes with command line launch strings. Which match the pattern used in Dopplepaymer ransomware attacks. |
| Dragon Fly | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_dragonfly.yml. Questions via Twitter: @janvonkirchheim. |
| Elise backdoor | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_elise.yml. Questions via Twitter: @janvonkirchheim. |
| Equation Group C2 Communication | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_equationgroup_c2.yml. Questions via Twitter: @janvonkirchheim. |
| fireeye-red-team-tools-CVEs [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | Search for the CVEs that should be prioritized and resolved to reduce the success of the FireEye Red Team tools compromised by the Nobelium activity group. See red_team_tool_countermeasures on the off... |
| fireeye-red-team-tools-HASHs [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query searches for the HASHs of the FireEye Red Team tools compromised by the Nobelium activity group. See all-hashes.csv on the official FireEye repo. References: https://github.com/fireeye/red_... |
| Hurricane Panda activity | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_hurricane_panda.yml. Questions via Twitter: @janvonkirchheim. |
| Judgement Panda exfil activity | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_judgement_panda_gtr19.yml. Questions via Twitter: @janvonkirchheim. |
| known-affected-software-orion[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| launching-base64-powershell[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| launching-cmd-echo[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| locate-dll-created-locally[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| locate-dll-loaded-in-memory[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| MacOceanLotusBackdoor | Hunting Query | 🔗 GitHub | GitHub Only | Backdoor processes associated with OceanLotus Mac Malware Backdoor. References:. Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/. OS platform... |
| MacOceanLotusDropper | Hunting Query | 🔗 GitHub | GitHub Only | Backdoor processes associated with OceanLotus Mac malware backdoor dropper. References:. Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/. OS ... |
| OceanLotus registry activity | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml. Questions via Twitter: @janvonkirchheim. |
| oceanlotus-apt32-files | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in a threat analytics report about the group known to other security researchers as APT32 or OceanLotus This tracked activity group uses a wide array of malicious d... |
| oceanlotus-apt32-network | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in a threat analytics report about the group known to other security researchers as APT32 or OceanLotus This tracked activity group uses a wide array of malicious d... |
| possible-affected-software-orion[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign. Microsoft detects the 2... |
| Ransomware hits healthcare - Alternate Data Streams use | Hunting Query | 🔗 GitHub | GitHub Only | Find use of Alternate Data Streams (ADS) for anti-forensic purposes. Alternate Data Streams execution. |
| Ransomware hits healthcare - Backup deletion | Hunting Query | 🔗 GitHub | GitHub Only | List alerts flagging attempts to delete backup files. |
| Ransomware hits healthcare - Cipher.exe tool deleting data | Hunting Query | 🔗 GitHub | GitHub Only | // Look for cipher.exe deleting data from multiple drives. This is often performed as an anti-forensic measure prior to encryption. |
| Ransomware hits healthcare - Clearing of system logs | Hunting Query | 🔗 GitHub | GitHub Only | // Look for attempts to use fsutil.exe to delete file system logs that can be used as forensic artifacts. |
| Ransomware hits healthcare - Possible compromised accounts | Hunting Query | 🔗 GitHub | GitHub Only | Identify accounts that have logged on to affected endpoints. Check for specific alerts. |
| Ransomware hits healthcare - Robbinhood activity | Hunting Query | 🔗 GitHub | GitHub Only | Find distinct evasion and execution activities. Associated with the Robbinhood ransomware campaign. |
| Ransomware hits healthcare - Turning off System Restore | Hunting Query | 🔗 GitHub | GitHub Only | Find attempts to stop System Restore and. Prevent the system from creating restore points. |
| Ransomware hits healthcare - Vulnerable Gigabyte drivers | Hunting Query | 🔗 GitHub | GitHub Only | Locate vulnerable Gigabyte drivers used by RobbinHood ransomware to turn off security tools. |
| RedMenshen-BPFDoor-backdoor | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published by PWC Security Research Team. BPFDoor is custom backdoor malware used by Red Menshen. The BPFDoor allows an adversary to backdoor a system and remotely execute cod... |
| robbinhood-driver | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. Robbinhood is ransomware that has been invo... |
| robbinhood-evasion | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. Robbinhood is ransomware that has been invo... |
| snip3-aviation-targeting-emails | Hunting Query | 🔗 GitHub | GitHub Only | Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques. The following query looks ... |
| snip3-detectsanboxie-function-call | Hunting Query | 🔗 GitHub | GitHub Only | Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques. The following query looks ... |
| snip3-encoded-powershell-structure | Hunting Query | 🔗 GitHub | GitHub Only | Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques. The following query looks ... |
| snip3-malicious-network-connectivity | Hunting Query | 🔗 GitHub | GitHub Only | Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques. The following query looks ... |
| snip3-revengerat-c2-exfiltration | Hunting Query | 🔗 GitHub | GitHub Only | Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques. The following query looks ... |
| Star Blizzard-Domain IOCs | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies matches based on domain IOCs related to Star Blizzard against Microsoft Defender for Endpoint device network connections |
| Threat actor Phosphorus masquerading as conference organizers (1) | Hunting Query | 🔗 GitHub | GitHub Only | Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC. Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphoru... |
| Threat actor Phosphorus masquerading as conference organizers (2) | Hunting Query | 🔗 GitHub | GitHub Only | Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC. Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphoru... |
| Threat actor Phosphorus masquerading as conference organizers | Hunting Query | 🔗 GitHub | GitHub Only | Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC. Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphoru... |
| WastedLocker Downloader | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies the launch pattern associated with wastedlocker ransomware. Reference writeup: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us |
| Entra ID group adds in the last 7 days | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for Entra ID group adds identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps. |
| Entra ID role adds in the last 7 days | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for Entra ID role adds identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps. |
| File download events in the last 7 days | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for file download events identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps. Reference - https://lear... |
| Mass Downloads in the last 7 days | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for mass downloads identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps. |
| Anomaly of MailItemAccess by Other Users Mailbox [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for users accessing multiple other users' mailboxes, or accessing multiple folders in another user's mailbox. This query is inspired by an Azure Sentinel detection. Reference - https:... |
| HostExportingMailboxAndRemovingExport[Solarigate] | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query looks for hosts exporting a mailbox from an on-prem Exchange server, followed by that same host removing the export within a short time window. This pattern has been observed by att... |
| MailItemsAccessedTimeSeries[Solarigate] | Hunting Query | 🔗 GitHub | GitHub Only | Identifies anomalous increases in Exchange mail items accessed operations. The query leverages KQL built-in anomaly detection algorithms to find large deviations from baseline patterns. Sudden increas... |
| c2-bluekeep | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep). CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability i... |
| C2-NamedPipe | Hunting Query | 🔗 GitHub | GitHub Only | Detects the creation of a named pipe used by known APT malware. Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c |
| check-for-shadowhammer-activity-download-domain | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, ShadowHammer supply chain attack Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update... |
| Connection to Rare DNS Hosts | Hunting Query | 🔗 GitHub | GitHub Only | This query will break down hostnames into their second and third level domain parts and analyze the volume of connections made to the destination to look for low count entries. Note that this query is... |
| Device network events w low count FQDN | Hunting Query | 🔗 GitHub | GitHub Only | Device Network Events Involving Low Count FQDNs. This query reduces network events to only those with the RemoteURL column populated,. Then parses the DNS name from the URL (if needed) and finds the l... |
| DNSPattern [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for the DGA pattern of the domain associated with the Nobelium campaign, in order to find other domains with the same activity pattern. This query is inspired by an Azure Sentinel det... |
| EncodedDomainURL [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | Looks for a logon domain in the Microsoft Entra ID logs, encoded with the same DGA encoding used in the Nobelium campaign. See Important steps for customers to protect themselves from recent nation-s... |
| python-use-by-ransomware-macos | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware. As of the time of this writing (October 2020), ransomware designed to target macOS is ... |
| recon-with-rundll | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated. Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Origina... |
| reverse-shell-ransomware-macos | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware. As of the time of this writing (October 2020), ransomware designed to target macOS is ... |
| Tor | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for Tor client, or for a common Tor plugin called Meek. We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downl... |
| Active Directory Sensitive Group Modifications | Hunting Query | 🔗 GitHub | GitHub Only | This query shows all modifications to highly sensitive active directory groups (also known as Tier 0). An example of these groups include Domain Admins, Schema Admins and Enterprise Admins. More info ... |
| cobalt-strike | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers obse... |
| doppelpaymer-procdump | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog. DoppelPaymer is ransomware that is spread manually by hu... |
| identify-accounts-logged-on-to-endpoints-affected-by-cobalt-strike | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. It finds all user accounts that have logged on to an endpoint affected by... |
| lazagne | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog. Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread ... |
| logon-attempts-after-malicious-email | Hunting Query | 🔗 GitHub | GitHub Only | This query finds the 10 latest logons performed by email recipients within 30 minutes after they received known malicious emails. You can use this query to check whether the accounts of the email reci... |
| lsass-credential-dumping | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of credential dumping based on process activity instead of targeting process names. Author: Jouni Mikkola More info: https://threathunt.blog/lsass-credential-dumping/ |
| Private Key Files | Hunting Query | 🔗 GitHub | GitHub Only | Private Key Files. This query identifies file operation with files having. One of the extensions commonly used to save a private. Key. The risk is that if an attacker were to obtain. The file, they c... |
| procdump-lsass-credentials | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| wadhrama-credential-dump | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama. The ransomware known as Wadhrama has been used in human-operated attacks that follow a particul... |
| wdigest-caching | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, WDigest credential harvesting. WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporat... |
| ADFSDomainTrustMods[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query will find when federation trust settings are changed for a domain or when the domain is changed from managed to federated authentication. Results will relate to when a new Active Directory ... |
| alt-data-streams | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers obse... |
| clear-system-logs | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers obse... |
| deleting-data-w-cipher-tool | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers obse... |
| Discovering potentially tampered devices [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | To evade security software and analyst tools, Nobelium malware enumerates the target system looking for certain running processes, loaded drivers, and registry keys, with the goal of disabling them. T... |
| doppelpaymer-stop-services | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog. DoppelPaymer is ransomware that is spread manually by hu... |
| hiding-java-class-file | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact. Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capa... |
| locate-files-possibly-signed-by-fraudulent-ecc-certificates | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, CVE-2020-0601 certificate validation vulnerability. The Windows CryptoAPI Spoofing Vulnerability, CVE-2020-0601, can be exploited to... |
| MailPermissionsAddedToApplication[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query will find applications that have been granted Mail.Read or Mail.ReadWrite permissions in which the corresponding user recently consented to. It can help identify applications that have been... |
| PotentialMicrosoftDefenderTampering[Solarigate] | Hunting Query | 🔗 GitHub | GitHub Only | Identifies potential service tampering related to Microsoft Defender services. Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/Multipl... |
| qakbot-campaign-process-injection | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has ... |
| qakbot-campaign-self-deletion | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has ... |
| regsvr32-rundll32-image-loads-abnormal-extension | Hunting Query | 🔗 GitHub | GitHub Only | This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll. Joins the data to public network events. References: https://threathunt.blog/running-live-mal... |
| regsvr32-rundll32-abnormal-image-loads | Hunting Query | 🔗 GitHub | GitHub Only | This query is using the locations where malicious DLL images are often loaded from by regsvr32.dll and rundll32.exe. Blog: https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32... |
| regsvr32-rundll32-with-anomalous-parent-process | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for rundll32.exe or regsvr32.exe being spawned by abnormal processes: wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe. Blog: https://threathunt.blog/running-live-malware-f... |
| shimcache-flushed | Hunting Query | 🔗 GitHub | GitHub Only | This query searches for attempts to flush Shimcache, which may indicate anti-forensic or defense evasion activity by an attacker. Author: Vaasudev_Kala Ref: https://blueteamops.medium.com/shimcache-fl... |
| suspicious-base64-encoded-registry-keys | Hunting Query | 🔗 GitHub | GitHub Only | Looks for suspicious base64 encoded registry keys being created. Author: Jouni Mikkola References: https://threathunt.blog/registry-hunts/ |
| suspicious-command-interpreters-added-to-registry | Hunting Query | 🔗 GitHub | GitHub Only | Looks for suspicious addition of command interpreters to windows registry. Author: Jouni Mikkola References: https://threathunt.blog/registry-hunts/ |
| suspicious-keywords-in-registry | Hunting Query | 🔗 GitHub | GitHub Only | Looks for suspicious keyword additions to windows registry. Author: Jouni Mikkola References: https://threathunt.blog/registry-hunts/ |
| UpdateStsRefreshToken[Solorigate] | Hunting Query | 🔗 GitHub | GitHub Only | This will show Active Directory Security Token Service (STS) refresh token modifications by Service Principals and Applications other than DirectorySync. Refresh tokens are used to validate identifica... |
| detect-jscript-file-creation | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Emulation-evading JavaScripts. Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order ... |
| Doc attachment with link to download | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for a Word document attachment, from which a link was clicked, and after which there was a browser download. This query is not noisy, but most of its results are clean. It can also hs... |
| Dropbox downloads linked from other site | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for user content downloads from dropbox that originate from a link/redirect from a 3rd party site. File sharing sites such as Dropbox are often used for hosting malware on a reputable... |
| Email link + download + SmartScreen warning | Hunting Query | 🔗 GitHub | GitHub Only | Look for links opened from outlook.exe, followed by a browser download and then a SmartScreen app warning that was ignored by the user. Read more about these events and this hunting approach in this p... |
| Gootkit-malware | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published on Twitter, by @MsftSecIntel. Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious ... |
| Open email link | Hunting Query | 🔗 GitHub | GitHub Only | Query for links opened from mail apps - if a detection occurred right afterwards. As there are many links opened from mails, to have a successful hunt we should have some filter or join with some othe... |
| Pivot from detections to related downloads | Hunting Query | 🔗 GitHub | GitHub Only | Pivot from downloads detected by Windows Defender Antivirus to other files downloaded from the same sites. To learn more about the download URL info that is available and see other sample queries,. Ch... |
| powercat-download | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| Qakbot Craigslist Domains | Hunting Query | 🔗 GitHub | GitHub Only | Qakbot operators have been abusing the Craigslist messaging system to send malicious emails. These emails contain non-clickable links to malicious domains impersonating Craigslist, which the user is i... |
| Anomalous Device Models | Hunting Query | 🔗 GitHub | GitHub Only | This query finds anomalous models discovered |
| Can Be Onboarded Devices | Hunting Query | 🔗 GitHub | GitHub Only | This query surfaces devices that were discovered by Microsoft Defender for Endpoint and can be onboarded |
| Commonality of Operating Systems | Hunting Query | 🔗 GitHub | GitHub Only | This query provides the commonality of operating systems seen in the inventory |
| Count and Percentage of DeviceType out of total inventory | Hunting Query | 🔗 GitHub | GitHub Only | This query presents statistics on count and percentage of DeviceType out of total inventory |
| Devices By Specific DeviceType and DeviceSubtype | Hunting Query | 🔗 GitHub | GitHub Only | This query finds devices by DeviceType and/or DeviceSubtype |
| Devices In Subnet - IPAddressV4 | Hunting Query | 🔗 GitHub | GitHub Only | This query surfaces devices that are in a specific IPAddressV4 subnet |
| Devices In Subnet - IPAddressV6 | Hunting Query | 🔗 GitHub | GitHub Only | This query surfaces devices that are in a specific IPAddressV6 subnet |
| Find Software By Name and Version | Hunting Query | 🔗 GitHub | GitHub Only | This query finds a software by name and/or version |
| Most Common Services | Hunting Query | 🔗 GitHub | GitHub Only | This query provides the most common services discovered |
| NotOnboarded Devices by DeviceName Prefix | Hunting Query | 🔗 GitHub | GitHub Only | This query searches for not onboarded devices with a specific prefix |
| NotOnboarded Devices by DeviceName Suffix | Hunting Query | 🔗 GitHub | GitHub Only | This query searches for not onboarded devices with a specific Suffix |
| Seen Connected Networks | Hunting Query | 🔗 GitHub | GitHub Only | This query uncovers seen connected networks |
| Seen IPv4 Network Subnets | Hunting Query | 🔗 GitHub | GitHub Only | This query uncovers seen IPAddressV4 network subnets |
| Seen IPv6 Network Subnets | Hunting Query | 🔗 GitHub | GitHub Only | This query uncovers seen IPAddressV6 network subnets |
| Browser Extension Enumeration via DeviceFileEvents | Hunting Query | 🔗 GitHub | GitHub Only | Identifies browser extension CRX files observed across endpoints. Helps in enumerating commonly installed extensions and hunting for potentially malicious ones. --- Optional Enrichment: To enrich th... |
| ConnectedNetworkDeviceDiscovery | Hunting Query | 🔗 GitHub | GitHub Only | Find devices connected to a monitored network. Please Note line 5 needs to have a monitored network name put in place or commented out to pull everything. |
| detect-nbtscan-activity | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Operation Soft Cell. Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers through... |
| Detect-Not-Active-AD-User-Accounts | Hunting Query | 🔗 GitHub | GitHub Only | // Detect Active Directory service accounts that are not active because their last logon was more than 14 days ago // Replace XXX on line 4 with the naming convention start of your Active Directory se... |
| detect-suspicious-commands-initiated-by-web-server-processes | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Operation Soft Cell. Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers through... |
| DetectTorRelayConnectivity | Hunting Query | 🔗 GitHub | GitHub Only | This advanced hunting query detects processes communicating with known Tor relay IP addresses. The public URL in the query is updated daily at 12PM and 12AM UTC. CSV source is the Tor Project API, obt... |
| DetectTorrentUse | Hunting Query | 🔗 GitHub | GitHub Only | Custom detection to find use of torrenting software or browsing related to torrents. |
| Discover hosts doing possible network scans | Hunting Query | 🔗 GitHub | GitHub Only | Looking for high volume queries against a given RemoteIP, per DeviceName, RemotePort and Process. Please change the Timestamp window according your preference/objective, as also the subnet ranges that... |
| doppelpaymer | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog. DoppelPaymer is ransomware that is spread manually by hu... |
| Enumeration of users & groups for lateral movement | Hunting Query | 🔗 GitHub | GitHub Only | The query finds attempts to list users or groups using Net commands. |
| MultipleLdaps | Hunting Query | 🔗 GitHub | GitHub Only | Detect multiple Active Directory LDAP queries made in bin time Replace 10 on line 1 with your desired thershold Replace 1m on line 2 with your desired bin time |
| MultipleSensitiveLdaps | Hunting Query | 🔗 GitHub | GitHub Only | // Detect multiple sensitive Active Directory LDAP queries made in bin time // Sensitive queries defined as Roasting or sensitive objects queries // Replace 10 on line 6 with your desired thershold //... |
| PasswordSearch | Hunting Query | 🔗 GitHub | GitHub Only | Detect Active Directory LDAP queries that search for users with comment or description that contains the string "pass" that might suggest for the user password This LDAP query cover MetaSploit - enum_... |
| qakbot-campaign-esentutl | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has ... |
| qakbot-campaign-outlook | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has ... |
| Roasting | Hunting Query | 🔗 GitHub | GitHub Only | Detect Active Directory LDAP queries that search for Kerberoasting (SPNs) or accounts with Kerberos preauthentication not required from Azure ATP, and try to get the process initiated the LDAP query f... |
| SensitiveLdaps | Hunting Query | 🔗 GitHub | GitHub Only | Detect Active Directory LDAP queries that search for sensitive objects in the organization This LDAP query cover BloodHound tool |
| SMB shares discovery | Hunting Query | 🔗 GitHub | GitHub Only | Query for processes that accessed more than 10 IP addresses over port 445 (SMB) - possibly scanning for network shares. To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/T... |
| SuspiciousEnumerationUsingAdfind[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | Attackers can use Adfind which is administrative tool to gather information about domain controllers or ADFS servers. They may also rename executables with other benign tools on the system. The below ... |
| URL Detection | Hunting Query | 🔗 GitHub | GitHub Only | This query finds network communication to specific URL. Please note that in line #7 it filters RemoteUrl using has operator, which looks for a "whole term" and runs faster. Example: RemoteUrl has "mic... |
| VulnComputers | Hunting Query | 🔗 GitHub | GitHub Only | Detect Active Directory LDAP queries that try to find operating systems that are vulnerable to specific vulnerabilities This LDAP query cover MetaSploit - enum_ad_computers tool |
| anomalous-payload-delivered-from-iso-file | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for lnk file executions from other locations than C: -drive, which can relate to mounted ISO-files. Reference - https://threathunt.blog/detecting-a-payload-delivered-with-iso-files-us... |
| Base64 Detector and Decoder | Hunting Query | 🔗 GitHub | GitHub Only | This query will identify strings in process command lines which match Base64 encoding format, extract the string to a column called Base64, and decode it in a column called DecodedString. |
| Base64encodePEFile | Hunting Query | 🔗 GitHub | GitHub Only | Finding base64 encoded PE files header seen in the command line parameters. Tags: #fileLess #powershell. |
| Bitsadmin Activity | Hunting Query | 🔗 GitHub | GitHub Only | Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. This service is commonly used for legitimate purposes, but can also be used as part ... |
| check-for-shadowhammer-activity-implant | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, ShadowHammer supply chain attack Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update... |
| Detect Encoded Powershell | Hunting Query | 🔗 GitHub | GitHub Only | This query will detect encoded powershell based on the parameters passed during process creation. This query will also work if the PowerShell executable is renamed or tampered with since detection is ... |
| Detect PowerShell v2 Downgrade | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for processes that load an older version of the system.management.automation libraries. While not inherently malicious, downgrading to PowerShell version 2 can enable an attacker to b... |
| detect-anomalous-process-trees | Hunting Query | 🔗 GitHub | GitHub Only | This query generates process trees of given processes and performs anomaly detection on the process trees. It generates process trees up to 7th level. The query can be used as a template to perform an... |
| detect-bluekeep-related-mining | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep). CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability i... |
| detect-doublepulsar-execution | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Motivated miners. Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now use... |
| detect-exploitation-of-cve-2018-8653 | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, CVE-2018-8653 scripting engine vulnerability. CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine f... |
| detect-impacket-atexec | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of impacket atexec module. Should work with others using similar technique. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-3/ |
| detect-impacket-dcomexec | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of impacket dcomexec module. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-2/ |
| detect-impacket-psexec-module | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of impacket psexec module usage. May hit other psexec-like techniques too. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-psexec/ |
| detect-impacket-wmiexec | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-2/ |
| detect-malicious-rar-extraction | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, CVE-2018-15982 exploit attacks. CVE-2018-15982 is an exploit of Adobe Flash Player, that allows for remote execution of arbitrary co... |
| detect-malicious-use-of-msiexec-mimikatz | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Msiexec abuse. Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows inst... |
| detect-malicious-use-of-msiexec | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Msiexec abuse. Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows inst... |
| detect-malicious-use-of-msiexec-powershell | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Msiexec abuse. Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows inst... |
| detect-office-applications-spawning-msdt-CVE-2022-30190 | Hunting Query | 🔗 GitHub | GitHub Only | This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190). The following query detects ... |
| detect-office-products-spawning-wmic | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve. Windows Management Instrumentation, or WMI, is a legitimate Microsoft framework used to obtain ma... |
| Detect potential kerberoast activities | Hunting Query | 🔗 GitHub | GitHub Only | This query aim to detect if someone requests service tickets (where count => maxcount) The query requires trimming to set a baseline level for MaxCount Mitre Technique: Kerberoasting (T1558.003) @Ma... |
| detect-suspicious-mshta-usage | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve. Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and mod... |
| detect-web-server-exploit-doublepulsar | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Motivated miners. Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now use... |
| ExecuteBase64DecodedPayload | Hunting Query | 🔗 GitHub | GitHub Only | Process executed from binary hidden in Base64 encoded file. Encoding malicious software is a. Technique to obfuscate files from detection. The first and second ProcessCommandLine component is looking... |
| File Copy and Execution | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies files that are copied to a device over SMB, then executed within a specified threshold. Default is 5 seconds, but is configurable by tweaking the value for ToleranceInSeconds. |
| jse-launched-by-word | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Emulation-evading JavaScripts. Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order ... |
| launch-questd-w-osascript | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware. As of the time of this writing (October 2020), ransomware designed to target macOS is ... |
| locate-shlayer-payload-decryption-activity | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push. Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the us... |
| locate-shlayer-payload-decrytion-activity | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push. Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the us... |
| locate-surfbuyer-downloader-decoding-activity | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, OSX/SurfBuyer adware campaign. It will return results if a shell script has furtively attempted to decode and save a file to a /tmp ... |
| Malware_In_recyclebin | Hunting Query | 🔗 GitHub | GitHub Only | Finding attackers hiding malware in the recycle bin. Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/. Tags: #execution #SuspiciousPath. |
| Masquerading system executable | Hunting Query | 🔗 GitHub | GitHub Only | Finds legitimate system32 or syswow64 executables being run under a different name and in a different location. The rule will require tuning for your environment. MITRE: Masquerading https://attack.mi... |
| office-apps-launching-wscipt | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated. Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Origina... |
| Possible Ransomware Related Destruction Activity | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies common processes run by ransomware malware to destroy volume shadow copies or clean free space on a drive to prevent a file from being recovered post-encryption. To reduce false... |
| PowerShell downloads | Hunting Query | 🔗 GitHub | GitHub Only | Finds PowerShell execution events that could involve a download. |
| powershell-activity-after-email-from-malicious-sender | Hunting Query | 🔗 GitHub | GitHub Only | Malicious emails often contain documents and other specially crafted attachments that run PowerShell commands to deliver additional payloads. If you are aware of emails coming from a known malicious s... |
| powershell-version-2.0-execution | Hunting Query | 🔗 GitHub | GitHub Only | Find the execution of PowerShell Version 2.0, eather to discover legacy scripts using version 2 or to find attackers trying to hide from script logging and AMSI. |
| PowershellCommand - uncommon commands on machine | Hunting Query | 🔗 GitHub | GitHub Only | Find which uncommon Powershell Cmdlets were executed on that machine in a certain time period. This covers all Powershell commands executed in the Powershell engine by any process. |
| PowershellCommand footprint | Hunting Query | 🔗 GitHub | GitHub Only | Find all machines running a given Powersehll cmdlet. This covers all Powershell commands executed in the Powershell engine by any process. |
| python-based-attacks-on-macos | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Python abuse on macOS The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints... |
| qakbot-campaign-suspicious-javascript | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has ... |
| reverse-shell-nishang-base64 | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| reverse-shell-nishang | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| RunMRU with non-ASCII characters | Hunting Query | 🔗 GitHub | GitHub Only | Identifies non-ASCII data written to the RunMRU registry key by explorer. |
| sql-server-abuse | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, SQL Server abuse. SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimat... |
| umworkerprocess-unusual-subprocess-activity | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| Webserver Executing Suspicious Applications | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript), common initial profiling commands (net \ net1 ... |
| 7-zip-prep-for-exfiltration | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| Anomaly of MailItemAccess by GraphAPI [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for anomalies in mail item access events made by Graph API. It uses standard deviation to determine if the number of events is anomalous. The query returns all clientIDs where the amo... |
| Code Repo Exfiltration | Hunting Query | 🔗 GitHub | GitHub Only | Looks for accounts that uploaded multiple code repositories to external web domain. |
| Data copied to other location than C drive | Hunting Query | 🔗 GitHub | GitHub Only | Check all created files. That does not have extension ps1, bat or cmd to avoid IT Pro scripts. That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed,... |
| detect-archive-exfiltration-to-competitor | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used to detect instances of a malicious insider creating a file archive and then emailing that archive to an external "competitor" organization. |
| detect-exfiltration-after-termination | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used to explore any instances where a terminated individual (i.e. one who has an impending termination date but has not left the company) downloads a large number of files from a non... |
| detect-steganography-exfiltration | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used to detect instances of malicious users who attempt to create steganographic images and then immediately browse to a webmail URL. This query would require additional investigati... |
| exchange-powershell-snapin-loaded | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| Files copied to USB drives | Hunting Query | 🔗 GitHub | GitHub Only | This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Adv... |
| MailItemsAccessed Throttling [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | The MailItemsAccessed action is part of the new Advanced Audit functionality of Microsoft Defender XDR. It's part of Exchange mailbox auditing and is enabled by default for users that have an Office 3... |
| Map external devices (1) | Hunting Query | 🔗 GitHub | GitHub Only | Action "PnpDeviceConnected" reports the connection of any plug and play device. Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416. Query... |
| Map external devices | Hunting Query | 🔗 GitHub | GitHub Only | Action "PnpDeviceConnected" reports the connection of any plug and play device. Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416. Query... |
| OAuth Apps accessing user mail via GraphAPI [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query helps you review all OAuth applications accessing user mail via Graph. It could return a significant number of results depending on how many applications are deployed in the environment. |
| OAuth Apps reading mail both via GraphAPI and directly [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | As described in previous guidance, Nobelium may re-purpose legitimate existing OAuth Applications in the environment to their own ends. However, malicious activity patterns may be discernable from le... |
| OAuth Apps reading mail via GraphAPI anomaly [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to review OAuth applications whose behaviour has changed as compared to a prior baseline period. The following query returns OAuth Applications accessing user mail via Graph that did no... |
| Password Protected Archive Creation | Hunting Query | 🔗 GitHub | GitHub Only | One common technique leveraged by attackers is using archiving applications to package up files for exfiltration. In many cases, these archives are usually protected with a password to make analysis m... |
| Possible File Copy to USB Drive | Hunting Query | 🔗 GitHub | GitHub Only | This query searches for file copies which occur within a period of time (by default 15 min) to volumes other than the C drive or UNC shares. By default, this query will search all devices. A single de... |
| Unusual volume of file sharing with external user. | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for users sharing access to files with external users. This applies to SharePoint and OneDrive users. Audit event and Cloud application identifier references. Reference - https://l... |
| AcroRd-Exploits | Hunting Query | 🔗 GitHub | GitHub Only | The following query look for suspicious behaviors observed by the samples analyzed in the report. |
| CVE-2021-36934 usage detection | Hunting Query | 🔗 GitHub | GitHub Only | Assuming that you have a machine that is properly BitLocker'ed, then the machine will need to be running to extract the SAM and SYSTEM files. This first query looks for any access to the HKLM that hap... |
| CVE-2022-22965 Network Activity | Hunting Query | 🔗 GitHub | GitHub Only | The following query surface network activity associated with exploitation of CVE-2022-22965. |
| Suspicious Tomcat Confluence Process Launch | Hunting Query | 🔗 GitHub | GitHub Only | The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134 Read more here:. https://confluence.atlassian.com/doc/confluence-security-adv... |
| Electron-CVE-2018-1000006 | Hunting Query | 🔗 GitHub | GitHub Only | The query checks process command lines arguments and parent/child combinations to find machines where there have been. Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-... |
| Flash-CVE-2018-4848 | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT. CVE: CVE-2018-4878. Read more here:. Https://www.krcert.or.kr/data/secNo... |
| Linux-DynoRoot-CVE-2018-1111 | Hunting Query | 🔗 GitHub | GitHub Only | The query checks process command lines arguments and parent/child combinations to find machines where there have been. Attempts to exploit a DHCP remote code command injection CVE-2018-1111. DynoRoot ... |
| MosaicLoader | Hunting Query | 🔗 GitHub | GitHub Only | This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection |
| Windows Spooler Service Suspicious File Creation | Hunting Query | 🔗 GitHub | GitHub Only | The query digs in Windows print spooler drivers folder for any file creations, MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Suspicious DLL is load from Spooler Service backup folder. This... |
| printnightmare-cve-2021-1675 usage detection (1) | Hunting Query | 🔗 GitHub | GitHub Only | First query digs in print spooler drivers folder for any file creations, MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files or ones that don't have any relations to printers that ... |
| printnightmare-cve-2021-1675 usage detection | Hunting Query | 🔗 GitHub | GitHub Only | First query digs in print spooler drivers folder for any file creations, MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files or ones that don't have any relations to printers that ... |
| SolarWinds -CVE-2021-35211 | Hunting Query | 🔗 GitHub | GitHub Only | //Check for network connections with SolarWInds IP's based on DeviceNetworkEvents## Query |
| VMWare-LPE-2022-22960 | Hunting Query | 🔗 GitHub | GitHub Only | The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root. This vulnerability of VMware Workspace ONE Access, Identity Manager ... |
| winrar-cve-2018-20250-ace-files | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that ... |
| winrar-cve-2018-20250-file-creation | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that ... |
| EmojiHunt | Hunting Query | 🔗 GitHub | GitHub Only | Did you know you can use Emojis in Windows?. Read more here: https://davidzych.com/abusing-emoji-in-windows. Check-out who in your organization has renamed his or her computer to a Pizza or to a smili... |
| Make FolderPath Vogon Poetry | Hunting Query | 🔗 GitHub | GitHub Only | This is a completely stupid and pointless query that makes Vogon poetry out of a random FolderPath from the table you pass it. You can change DeviceProcessEvents for any table as long as it has a col... |
| Alert Events from Internal IP Address | Hunting Query | 🔗 GitHub | GitHub Only | Determines DeviceId from internal IP address and outputs all alerts in events table associated to the DeviceId. Example use case is Firewall determines Internal IP with suspicious network activity. Qu... |
| AppLocker Policy Design Assistant | Hunting Query | 🔗 GitHub | GitHub Only | One of the challenges in making an AppLocker policy is knowing where applications launch from. This query normalizes process launch paths through aliasing, then counts the number of processes launche... |
| Baseline Comparison | Hunting Query | 🔗 GitHub | GitHub Only | Baseline Comparison. Author: miflower. The purpose of this query is to perform a comparison between "known good" machines and suspected bad machines. The original concept for this query was born due t... |
| Crashing Applications | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies crashing processes based on parameters passed to werfault.exe and attempts to find the associated process launch from DeviceProcessEvents. |
| Detect Azure RemoteIP | Hunting Query | 🔗 GitHub | GitHub Only | This query is a function that consumes the publicly available Azure IP address list and checks a list of remote IP addresses against it to see if they are Azure IP addresses or not. To use this, repla... |
| Device Count by DNS Suffix | Hunting Query | 🔗 GitHub | GitHub Only | This query will count the number of devices in Defender ATP based on their DNS suffix. For a full list of devices with the DNS suffix, comment out or remove the last line. |
| Device uptime calculation | Hunting Query | 🔗 GitHub | GitHub Only | This query calculates device uptime based on periodic DeviceInfo which is recorded every 15 minutes regardless of device's network connectivity and uploaded once device gets online. If its interval is... |
| Endpoint Agent Health Status Report | Hunting Query | 🔗 GitHub | GitHub Only | This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept. Any tests which are... |
| Events surrounding alert (1) | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event... |
| Events surrounding alert (2) | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event... |
| Events surrounding alert (3) | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event... |
| Events surrounding alert | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for events that are near in time to a detected event. It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event... |
| Failed Logon Attempt | Hunting Query | 🔗 GitHub | GitHub Only | Sample query to detect If there are more then 3 failed logon authentications on high value assets. Update DeviceName to reflect your high value assets. For questions @MiladMSFT on Twitter or milad.asl... |
| File footprint (1) | Hunting Query | 🔗 GitHub | GitHub Only | Query #1 - Find the machines on which this file was seen. TODO - set file hash to be a SHA1 hash of your choice... |
| File footprint | Hunting Query | 🔗 GitHub | GitHub Only | Query #1 - Find the machines on which this file was seen. TODO - set file hash to be a SHA1 hash of your choice... |
| Firewall Policy Design Assistant | Hunting Query | 🔗 GitHub | GitHub Only | This query helps you design client firewall rules based on data stored within DeviceNetworkEvents. Folder paths are alias'ed to help represent the files making or receiving network connections without... |
| insider-threat-detection-queries (1) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (10) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (11) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (12) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (13) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (14) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (15) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (16) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (17) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (18) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (19) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (2) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (3) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (4) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (5) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (6) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (7) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (8) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries (9) | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| insider-threat-detection-queries | Hunting Query | 🔗 GitHub | GitHub Only | Intent: - Use MTP capability to look for insider threat potential risk indicators - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of... |
| Linux Agent Age Report | Hunting Query | 🔗 GitHub | GitHub Only | This query uses the public MDE GitHub repo as a source to estimate the time that an agent build remains supported based on the time it was uploaded. Please note that the timestamps used in this query ... |
| Machine info from IP address (1) | Hunting Query | 🔗 GitHub | GitHub Only | The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users. To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What... |
| Machine info from IP address (2) | Hunting Query | 🔗 GitHub | GitHub Only | The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users. To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What... |
| Machine info from IP address (3) | Hunting Query | 🔗 GitHub | GitHub Only | The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users. To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What... |
| Machine info from IP address | Hunting Query | 🔗 GitHub | GitHub Only | The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users. To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What... |
| MD AV Signature and Platform Version | Hunting Query | 🔗 GitHub | GitHub Only | This query will identify the Microsoft Defender Antivirus Engine version and Microsoft Defender Antivirus Security Intelligence version (and timestamp), Product update version (aka Platform Update ver... |
| MITRE - Suspicious Events | Hunting Query | 🔗 GitHub | GitHub Only | Description:. The query looks for several different MITRE techniques, grouped by risk level. A weighting is applied to each risk level and a total score calculated per machine. Techniques can be added... |
| Network footprint (1) | Hunting Query | 🔗 GitHub | GitHub Only | Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL. Ensure to update RemoteIP and RemoteURL variable. For questions @MiladMSFT on Twitter or mila... |
| Network footprint (2) | Hunting Query | 🔗 GitHub | GitHub Only | Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL. Ensure to update RemoteIP and RemoteURL variable. For questions @MiladMSFT on Twitter or mila... |
| Network footprint (3) | Hunting Query | 🔗 GitHub | GitHub Only | Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL. Ensure to update RemoteIP and RemoteURL variable. For questions @MiladMSFT on Twitter or mila... |
| Network footprint | Hunting Query | 🔗 GitHub | GitHub Only | Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL. Ensure to update RemoteIP and RemoteURL variable. For questions @MiladMSFT on Twitter or mila... |
| Network info of machine | Hunting Query | 🔗 GitHub | GitHub Only | Get information about the netwotk adapters of the given computer in the given time. This could include the configured IP addresses, DHCP servers, DNS servers, and more. |
| Phish and Malware received by user vs total amount of email | Hunting Query | 🔗 GitHub | GitHub Only | How much phish and malware emails vs good emails received the user in the given timeframe. |
| Services | Hunting Query | 🔗 GitHub | GitHub Only | Gets the service name from the registry key. |
| System Guard Security Level Baseline | Hunting Query | 🔗 GitHub | GitHub Only | Establishes a baseline SystemGuardSecurityLevel and show the devices that are below that baseline. See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestatio... |
| System Guard Security Level Drop | Hunting Query | 🔗 GitHub | GitHub Only | Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE. Step 1: Get a list of all security levels in the system where the level is not null. |
| wifikeys | Hunting Query | 🔗 GitHub | GitHub Only | Detect if someone run netsh and try to expose WPA keys in clear text @mattiasborg82. Blog.sec-labs.com. |
| backup-deletion | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers obse... |
| ransom-note-creation-macos | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware. As of the time of this writing (October 2020), ransomware designed to target macOS is ... |
| turn-off-system-restore | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers obse... |
| Unusual volume of file deletion by user. | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here. This applies to SharePoint and OneDrive users. Audit even... |
| wadhrama-data-destruction | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama. The ransomware known as Wadhrama has been used in human-operated attacks that follow a particul... |
| Check for Maalware Baazar (abuse.ch) hashes in your mail flow | Hunting Query | 🔗 GitHub | GitHub Only | Check if file hashes published in the recent abuse.ch feed are found in your mail flow scanned by Office 365 ATP. |
| detect-bluekeep-exploitation-attempts | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep). CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability i... |
| detect-mailsniper | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, MailSniper Exchange attack tool. MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exc... |
| files-from-malicious-sender | Hunting Query | 🔗 GitHub | GitHub Only | This query checks devices for the presence of files that have been sent by a known malicious sender. To use this query, replace the email address with the address of the known malicious sender. |
| SuspiciousUrlClicked | Hunting Query | 🔗 GitHub | GitHub Only | Identify emails that were send from an address external to your company and where email was send to more then 50 distinct corporate users. Update corporatedomain.com to your corporate domain to have i... |
| jar-attachments | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact. Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capa... |
| Non_intended_user_logon | Hunting Query | 🔗 GitHub | GitHub Only | Under some circumstances it is only allowed that users from country X logon to devices from country X. This query finds logon from users from other countries than X. The query requires a property to i... |
| PhishingEmailUrlRedirector | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published on Twitter, by @MsftSecIntel. The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distin... |
| SuspiciousUrlClicked | Hunting Query | 🔗 GitHub | GitHub Only | This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP. This event refl... |
| User navigation to redirected URL | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies when a user clicks a link that opens a browser to navigate to a URL which uses redirection. It then filters out any redirections to URLs in the same DNS namespace as the originat... |
| Account brute force (1) | Hunting Query | 🔗 GitHub | GitHub Only | Query #1: Look for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded. |
| Account brute force | Hunting Query | 🔗 GitHub | GitHub Only | Query #1: Look for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded. |
| detect-suspicious-rdp-connections | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep). CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability i... |
| Device Logons from Unknown IPs | Hunting Query | 🔗 GitHub | GitHub Only | Device Logons from Unknown IP Addresses. This query identifies device logons from IP addresses not associated with any machine in Defender ATP. |
| doppelpaymer-psexec | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog. DoppelPaymer is ransomware that is spread manually by hu... |
| ImpersonatedUserFootprint | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft Defender for Identity raises alert on suspicious Kerberos ticket, pointing to a potential overpass-the-hash attack. Once attackers gain credentials for a user with higher privileges, they wi... |
| Network Logons with Local Accounts | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for a large number of network-based authentications using local credentials coming from a single source IP address. High counts of logons involving a large number of distinct machines... |
| Non-local logons with -500 account | Hunting Query | 🔗 GitHub | GitHub Only | Non-local logons with the built-in administrator (-500) account. |
| remote-file-creation-with-psexec | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog. Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread ... |
| ServiceAccountsPerformingRemotePS | Hunting Query | 🔗 GitHub | GitHub Only | Service Accounts Performing Remote PowerShell. Author: miflower. The purpose behind this detection is for finding service accounts that are performing remote powershell sessions. There are two phases ... |
| Defender for Endpoint Telemetry | Hunting Query | 🔗 GitHub | GitHub Only | View Defender for Endpoint telemetry URLs and their connection status, view trendline over 30 days. Use to investigate possible telemetry and/or connectivity issues. Jesse.esquivel@microsoft.com. |
| Accessibility Features | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for persistence or priviledge escalation done using Windows Accessibility features. It covers some of the techniques that could be used to utilize these features for malicious purpose... |
| AddedCredentialFromContryXAndSigninFromCountryY | Hunting Query | 🔗 GitHub | GitHub Only | Added credential from country X and Signed-In from country Y in a pecific time window: This query tries to find all applications that credentials were added to them from country X while the applicatio... |
| Create account (1) | Hunting Query | 🔗 GitHub | GitHub Only | User accounts may be created to achieve persistence on a machine. Read more here: https://attack.mitre.org/wiki/Technique/T1136. Tags: #CreateAccount. Query #1: Query for users being created using "ne... |
| Create account | Hunting Query | 🔗 GitHub | GitHub Only | User accounts may be created to achieve persistence on a machine. Read more here: https://attack.mitre.org/wiki/Technique/T1136. Tags: #CreateAccount. Query #1: Query for users being created using "ne... |
| CredentialsAddAfterAdminConsentedToApp[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | Credentials were added to an application by UserA, after the application was granted admin consent rights by UserB The Nobelium activity group has been observed adding credentials (x509 keys or passwo... |
| detect-impacket-wmipersist | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of impacket wmipersist usage and should work for other wmi based persistence methods. Requires analysis. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-pa... |
| detect-prifou-pua | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, ironSource PUA & unwanted apps impact millions. IronSource provides software bundling tools for many popular legitimate apps, such a... |
| localAdminAccountLogon | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for local admin account used to logon into the computer. This can help to detect malicious insiders that were able to add a local account to the local admin group offline. |
| LocalAdminGroupChanges | Hunting Query | 🔗 GitHub | GitHub Only | Author: alex verboon @alexverboon. Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes. |
| Multiple Entra ID Admin Removals | Hunting Query | 🔗 GitHub | GitHub Only | Looks for multiple users that had their admin role removed by a single user within a certain period. |
| NewAppOrServicePrincipalCredential[Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | This query will find when a new credential is added to an application or service principal. The Nobelium activity group was able to gain sufficient access to add credentials to existing applications w... |
| qakbot-campaign-registry-edit | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has ... |
| Rare-process-as-a-service | Hunting Query | 🔗 GitHub | GitHub Only | This query is looking for rarely seen processes which are launched as a service. Author: Jouni Mikkola More info: https://threathunt.blog/rare-process-launch-as-a-service/ |
| detect-impacket-wmiexec | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-2/ |
| rare_sch_task_with_activity | Hunting Query | 🔗 GitHub | GitHub Only | Looks for rare process launch as a scheduled task and activity done by the processes. Author: Jouni Mikkola More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/ |
| Risky Sign-in with Device Registration | Hunting Query | 🔗 GitHub | GitHub Only | Looks for a new device registration in Entra ID preceded by medium or high-risk sign-in session for the same user within maximum 6h timeframe. |
| Risky Sign-in with new MFA method | Hunting Query | 🔗 GitHub | GitHub Only | Looks for a new MFA method added to an account that was preceded by medium or high risk sign-in session for the same user within maximum 6h timeframe |
| scheduled task creation | Hunting Query | 🔗 GitHub | GitHub Only | Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_schtask_creation.yml. Questions via Twitter: @janvonkirchheim. |
| detect-impacket-wmiexec | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too. Author: Jouni Mikkola More info: https://threathunt.blog/impacket-part-2/ |
| wadhrama-ransomware | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama. The ransomware known as Wadhrama has been used in human-operated attacks that follow a particul... |
| Add uncommon credential type to application [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | The query looks for users or service principals that attached an uncommon credential type to application. As part of the Nobelium campaign, the attacker added credentials to already existing applicati... |
| cve-2019-0808-c2 | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808 CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox... |
| cve-2019-0808-nufsys-file creation | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808 CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox... |
| cve-2019-0808-set-scheduled-task | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808 CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox... |
| dell-driver-vulnerability-2021 | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Multiple EOP flaws in Dell driver (CVE-2021-21551). CVE-2021-21551 is a vulnerability found in dbutil_2_3.sys, a driver distributed ... |
| Windows Anitivirus and EDR Elevation of Privilege Vulnerability | Hunting Query | 🔗 GitHub | GitHub Only | The query for malicious file creations via TOCTOU Vulnerability in Leading Endpoint Detection and Response (EDR) and Antivirus (AV) Solutions. - Microsoft Defender (CVE-2022-37971) - Defender for Endp... |
| detect-cve-2019-0863-AngryPolarBearBug2-exploit | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, May 2019 0-day disclosures. In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and pub... |
| detect-cve-2019-0973-installerbypass-exploit | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, May 2019 0-day disclosures. In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and pub... |
| detect-cve-2019-1053-sandboxescape-exploit | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, May 2019 0-day disclosures. In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and pub... |
| detect-cve-2019-1069-bearlpe-exploit | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, May 2019 0-day disclosures. In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and pub... |
| detect-cve-2019-1129-byebear-exploit | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, May 2019 0-day disclosures. In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and pub... |
| locate-ALPC-local-privilege-elevation-exploit | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, ALPC local privilege elevation. Windows ALPC Elevation of Privilege Vulnerability, CVE-2018-8440, could be exploited to run arbitrar... |
| Risky Sign-in with ElevateAccess | Hunting Query | 🔗 GitHub | GitHub Only | Looks for users who had a risky sign in (based on Entra ID Identity Protection risk score) and then performed and ElevateAccess action. ElevateAccess operations can be used by Global Admins to obtain ... |
| SAM-Name-Changes-CVE-2021-42278 | Hunting Query | 🔗 GitHub | GitHub Only | The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity |
| ServicePrincipalAddedToRole [Nobelium] | Hunting Query | 🔗 GitHub | GitHub Only | One of the indicators of compromise for the Nobelium (formerly Solorigate) campaign was that unexpected service principals have been added to privileged roles. This query looks for service principals ... |
| Antivirus detections (1) | Hunting Query | 🔗 GitHub | GitHub Only | Query for Microsoft Defender Antivirus detections. Query #1: Query for Antivirus detection events. |
| Antivirus detections | Hunting Query | 🔗 GitHub | GitHub Only | Query for Microsoft Defender Antivirus detections. Query #1: Query for Antivirus detection events. |
| AV Detections with Source | Hunting Query | 🔗 GitHub | GitHub Only | This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.). Get the list of AV detections. |
| AV Detections with USB Disk Drive | Hunting Query | 🔗 GitHub | GitHub Only | This query make a best-guess detection regarding which removable media device caused an AV detection. The query is best run over 30 days to get the full USB history. Get a list of USB AV detections. T... |
| ExploitGuardAsrDescriptions | Hunting Query | 🔗 GitHub | GitHub Only | Expanding on DeviceEvents output with Attack Surface Reduction (ASR) rule descriptions. The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked. ... |
| ExploitGuardASRStats (1) | Hunting Query | 🔗 GitHub | GitHub Only | Get stats on ASR audit events - count events and machines per rule. |
| ExploitGuardASRStats (2) | Hunting Query | 🔗 GitHub | GitHub Only | Get stats on ASR audit events - count events and machines per rule. |
| ExploitGuardASRStats | Hunting Query | 🔗 GitHub | GitHub Only | Get stats on ASR audit events - count events and machines per rule. |
| ExploitGuardBlockOfficeChildProcess (1) | Hunting Query | 🔗 GitHub | GitHub Only | These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes. (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a). Read more about it here: https... |
| ExploitGuardBlockOfficeChildProcess (2) | Hunting Query | 🔗 GitHub | GitHub Only | These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes. (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a). Read more about it here: https... |
| ExploitGuardBlockOfficeChildProcess (3) | Hunting Query | 🔗 GitHub | GitHub Only | These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes. (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a). Read more about it here: https... |
| ExploitGuardBlockOfficeChildProcess | Hunting Query | 🔗 GitHub | GitHub Only | These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes. (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a). Read more about it here: https... |
| ExploitGuardControlledFolderAccess (1) | Hunting Query | 🔗 GitHub | GitHub Only | Total Controlled Folder Access events. |
| ExploitGuardControlledFolderAccess (2) | Hunting Query | 🔗 GitHub | GitHub Only | Total Controlled Folder Access events. |
| ExploitGuardControlledFolderAccess | Hunting Query | 🔗 GitHub | GitHub Only | Total Controlled Folder Access events. |
| ExploitGuardNetworkProtectionEvents | Hunting Query | 🔗 GitHub | GitHub Only | Simple query to show the unique network connections that were audited or blocked by ExploitGuard. For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.... |
| ExploitGuardStats (1) | Hunting Query | 🔗 GitHub | GitHub Only | Get stats on ExploitGuard blocks - count events and machines per rule. |
| ExploitGuardStats | Hunting Query | 🔗 GitHub | GitHub Only | Get stats on ExploitGuard blocks - count events and machines per rule. |
| PUA ThreatName per Computer | Hunting Query | 🔗 GitHub | GitHub Only | Today MDE Alerts do not show PUA/WDAV ThreatName. This is a demonstration of how to get, for example, PUA Threat Names. |
| SmartScreen app block ignored by user | Hunting Query | 🔗 GitHub | GitHub Only | Query for SmartScreen application blocks on files with "Malicious" reputation, where the user has decided to run the malware nontheless. Read more about SmartScreen here: https://docs.microsoft.com/wi... |
| SmartScreen URL block ignored by user | Hunting Query | 🔗 GitHub | GitHub Only | Query for SmartScreen URL blocks, where the user has decided to run the malware nontheless. An additional optional filter is applied to query only for cases where Microsoft Edge has downloaded a file ... |
| Windows filtering events (Firewall) | Hunting Query | 🔗 GitHub | GitHub Only | Get all filtering events done by the Windows filtering platform. This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls. When no Firewall rules ... |
| ARS Ransomware Event triggered | Hunting Query | 🔗 GitHub | GitHub Only | This rule detects when the ASR rule AsrRansomwareBlocked or AsrRansomwareAudited is triggered. No alert is generated by default. This could be the start of a ransomware attack. Additional information... |
| Backup deletion | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies use of wmic.exe to delete shadow copy snapshots prior to encryption. |
| Check for multiple signs of ransomware activity | Hunting Query | 🔗 GitHub | GitHub Only | Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated que... |
| Clearing of forensic evidence from event logs using wevtutil | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. |
| DarkSide | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to look for running DarkSide ransomware behavior in the environment |
| Deletion of data on multiple drives using cipher exe | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption. |
| Discovery for highly-privileged accounts | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate commands related to discovering highly privileged users in an environment, sometimes a precursor to ransomware |
| Distribution from remote location | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for alerts related to file drop and remote execution where the file name matches PsExec and similar tools used for distribution |
| Fake Replies | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to find spoofed reply emails that contain certain keywords in the subject. The emails are also checked for a link to a document in Google Docs. These attacks have been observed leading ... |
| File Backup Deletion Alerts | Hunting Query | 🔗 GitHub | GitHub Only | This query checks alerts related to file backup deletion and enriches with additional alert evidence information |
| Gootkit File Delivery | Hunting Query | 🔗 GitHub | GitHub Only | This query surfaces alerts related to Gootkit and enriches with command and control information, which has been observed delivering ransomware. |
| HTA Startup Persistence | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate persistence in Startup with HTA files. |
| IcedId attachments | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails. IcedId can lead to ranso... |
| IcedId Delivery | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate successful delivery of associated malicious downloads that can lead to ransomware |
| IcedId email delivery | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate emails and malicious downloads related to the IcedId activity that can lead to ransomware |
| LaZagne Credential Theft | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate processes executing credential theft activity, often LaZagne in ransomware compromises. |
| Potential ransomware activity related to Cobalt Strike | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to look for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns |
| Qakbot discovery activies | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. |
| Sticky Keys | Hunting Query | 🔗 GitHub | GitHub Only | A technique used in numerous ransomware attacks is a Sticky Keys hijack for privilege escalation/persistence. Surface realted alerts with this query. |
| Stopping multiple processes using taskkill | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. Run query |
| Stopping processes using net stop | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for attempts to stop at least 10 separate processes using the net stop command. Run query |
| Suspicious Bitlocker Encryption | Hunting Query | 🔗 GitHub | GitHub Only | Looks for potential instances of bitlocker modifying registry settings to allow encryption, where it's executed via a .bat file. |
| Suspicious Google Doc Links | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to find emails with message IDs that resemble IDs used in known attack emails and contain a link a document in Google Docs. These behaviors have been observed leading to ransomware atta... |
| Suspicious Image Load related to IcedId | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to locate suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to ransomware. |
| Turning off services using sc exe | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for attempts to turn off at least 10 existing services using sc.exe. |
| Turning off System Restore | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies attempts to stop System Restore and prevent the system from creating restore points, which can be used to recover data encrypted by ransomware |
| Remote Management and Montioring tool - Action1 - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Montioring tool - Action1 - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Montioring tool - Action1 - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Montioring tool - Addigy - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AeroAdmin - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AeroAdmin - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AeroAdmin - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Ammyy - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Ammyy - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Ammyy - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AnyDesk - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AnyDesk - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AnyDesk - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AnyViewer - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AnyViewer - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AnyViewer - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Atera - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Atera - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Atera - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AweSun - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AweSun - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - AweSun - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - BarracudaRMM - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - BarracudaRMM - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - BarracudaRMM - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - BeyondTrust - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - BeyondTrust - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - BeyondTrust - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ChromeRDP - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ChromeRDP - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ConnectWise - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ConnectWise - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ConnectWise - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DameWare - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DameWare - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DameWare - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DattoRMM - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DattoRMM - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DesktopNow - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DesktopNow - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DesktopNow - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DistantDesktop - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DistantDesktop - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DistantDesktop - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - DWService - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - FleetDeck - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - FleetDeck - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - FleetDeck - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - GetScreen - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - GetScreen - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - GetScreen - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - IperiusRemote - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - IperiusRemote - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - IperiusRemote - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ISLOnline - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ISLOnline - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ISLOnline - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Kaseya - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Kaseya - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Level - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Level - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Level - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - LiteManager - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - LiteManager - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - LiteManager - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - LogMeIn - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - LogMeIn - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - LogMeIn - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - MeshCentral - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - MeshCentral - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - MeshCentral - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - mRemoteNG - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - mRemoteNG - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - MSP360_CloudBerry - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - MSP360_CloudBerry - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - MSP360_CloudBerry - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NAble - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NAble - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NAble - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Naverisk - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Naverisk - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Naverisk - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NetSupport - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NetSupport - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NetSupport - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NinjaRMM - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NinjaRMM - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - NinjaRMM - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - OptiTune - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - OptiTune - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - OptiTune - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Panorama9 - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Panorama9 - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Panorama9 - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - parsec.app - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - parsec.app - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - parsec.app - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - PcVisit - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - PcVisit - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - PcVisit - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - PDQ - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - PDQ - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - PDQ - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Pulseway - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Pulseway - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Pulseway - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RealVNC - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RealVNC - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RealVNC - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemoteDesktopPlus - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemoteDesktopPlus - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemotePC - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemotePC - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemotePC - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemoteUtilities - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemoteUtilities - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RemoteUtilities - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RPort - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RPort - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RustDesk - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - RustDesk - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ScreenMeet - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ScreenMeet - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ScreenMeet - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ServerEye - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ServerEye - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ServerEye - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ShowMyPC - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ShowMyPC - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ShowMyPC - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SimpleHelp - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SimpleHelp - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SimpleHelp - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Splashtop - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Splashtop - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - Splashtop - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SupRemo - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SupRemo - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SupRemo - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SyncroMSP - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SyncroMSP - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - SyncroMSP - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TacticalRMM - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TacticalRMM - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TacticalRMM - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TeamViewer - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TeamViewer - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TeamViewer - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TigerVNC - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TigerVNC - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TightVNC - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TightVNC - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - TightVNC - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - UltraViewer - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - UltraViewer - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - UltraViewer - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - XMReality - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - XMReality - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - XMReality - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ZohoAssist - Create Process | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ZohoAssist - File Signature | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - ZohoAssist - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Remote Management and Monitoring tool - All Tools - Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/Remo... |
| Connectivity Failures by Device | Hunting Query | 🔗 GitHub | GitHub Only | This query checks for network connection failures to Microsoft Defender for Endpoint URLs. The output includes any device with 1+ connectivity failures, a list of the domains they failed to connect to... |
| Connectivity Failures by Domain | Hunting Query | 🔗 GitHub | GitHub Only | This query is designed to help troubleshoot connectivity issues to Microsoft Defender for Endpoint URLs. It provides a summary of the number of failures which occurred, the number of distinct machines... |
| Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities | Hunting Query | 🔗 GitHub | GitHub Only | This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a |
| devices_with_vuln_and_users_received_payload (1) | Hunting Query | 🔗 GitHub | GitHub Only | // Author: jan geisbauer // @janvonkirchheim // ------------------------ // 1. A list of all devices that have this vulnerability // 2. A list of all users that uses those devices // 3. If these users... |
| devices_with_vuln_and_users_received_payload | Hunting Query | 🔗 GitHub | GitHub Only | // Author: jan geisbauer // @janvonkirchheim // ------------------------ // 1. A list of all devices that have this vulnerability // 2. A list of all users that uses those devices // 3. If these users... |
| Microsoft Defender AV Engine up to date info | Hunting Query | 🔗 GitHub | GitHub Only | Provides the Engine version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Engine version. |
| Microsoft Defender AV Platform up to date information | Hunting Query | 🔗 GitHub | GitHub Only | Provides the Platform version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Platform version. |
| Microsoft Defender AV Security Intelligence up to date information | Hunting Query | 🔗 GitHub | GitHub Only | Provides the Security Intelligence version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the security intelligence versio... |
| Microsoft Defender AV details | Hunting Query | 🔗 GitHub | GitHub Only | This query will identify the Microsoft Defender Antivirus Security Intelligence version, Security Intelligence up to date value, Engine version, Engine up to date value, Product version (aka Platform... |
| Microsoft Defender AV mode device count | Hunting Query | 🔗 GitHub | GitHub Only | Provides the Anti virus mode and device count falling under that AV mode. |
| Add malicious user to Admins and RDP users group via PowerShell | Hunting Query | 🔗 GitHub | GitHub Only | Look for adding a user to Administrators in remote desktop users via PowerShell. |
| Create new user with known DEV-0270 username and password | Hunting Query | 🔗 GitHub | GitHub Only | Search for the creation of a new user using a known DEV-0270 username/password schema. |
| Disabling Services via Registry | Hunting Query | 🔗 GitHub | GitHub Only | Search for processes modifying the registry to disable security features. |
| DLLHost.exe file creation via PowerShell | Hunting Query | 🔗 GitHub | GitHub Only | Identify masqueraded DLLHost.exe file created by PowerShell. |
| DLLHost.exe WMIC domain discovery | Hunting Query | 🔗 GitHub | GitHub Only | Identify dllhost.exe using WMIC to discover additional hosts and associated domain. |
| Email data exfiltration via PowerShell | Hunting Query | 🔗 GitHub | GitHub Only | Identify email exfiltration conducted by PowerShell. |
| Modifying the registry to add a ransom message notification | Hunting Query | 🔗 GitHub | GitHub Only | Identify registry modifications that is indicative of a ransom note tied to DEV-0270. |
| PowerShell adding exclusion path for Microsoft Defender of ProgramData | Hunting Query | 🔗 GitHub | GitHub Only | Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor. |
| Spoolsv Spawning Rundll32 | Hunting Query | 🔗 GitHub | GitHub Only | Look for the spoolsv.exe launching rundll32.exe with an empty command line |
| Suspicious DLLs in spool folder | Hunting Query | 🔗 GitHub | GitHub Only | Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old. |
| Suspicious files in spool folder | Hunting Query | 🔗 GitHub | GitHub Only | Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. Fal... |
| Suspicious Spoolsv Child Process | Hunting Query | 🔗 GitHub | GitHub Only | Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675 |
| ATP policy status check | Hunting Query | 🔗 GitHub | GitHub Only | This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365. |
| JNLP-File-Attachment | Hunting Query | 🔗 GitHub | GitHub Only | JNLP file extensions are an uncommon file type often used to deliver malware. |
| Safe Attachments detections | Hunting Query | 🔗 GitHub | GitHub Only | This query provides insights on the detections done by Safe Attachment detections |
| Authentication failures by time and authentication type | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth |
| CompAuth Failure Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spoof - Composite Authentication fails summarizing the data daily. |
| DKIM Failure Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spoof - DKIM fails summarizing the data daily. |
| DMARC Failure Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spoof - DMARC fails summarizing the data daily. |
| SPF Failure Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spoof - SPF fails summarizing the data daily. |
| Spoof attempts with auth failure | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in checking for spoofing attempts on the domain with Authentication failures |
| Top Spoof external domain detections by Sender domain (P1/P2) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). |
| Top Spoof DMARC detections by Sender domain (P1/P2) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). |
| Top Spoof intra-org detections by Sender domain (P1/P2) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). |
| Empty Sender Phish Delivered to Inbox | Hunting Query | 🔗 GitHub | GitHub Only | This query detects delivered phishing emails where the Sender is empty based on recently observed campaigns. |
| Message from an Accepted Domain with DMARC TempError | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result. |
| Message with URL listed on OpenPhish delivered into Inbox | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox |
| Potential OAuth phishing email delivered into Inbox | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious OAuth app URL has been delivered into an Inbox. |
| Potentially malicious svg file delivered to Inbox | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox. |
| Audit Email Preview-Download action | Hunting Query | 🔗 GitHub | GitHub Only | This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365 |
| Bad email percentage of Inbound emails | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily. |
| Calculate overall MDO efficacy | Hunting Query | 🔗 GitHub | GitHub Only | This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught. |
| Email sender IP address Geo location information | Hunting Query | 🔗 GitHub | GitHub Only | This query helps getting GeoIP information of emails SenderIPv4 addresses. |
| Hunt for Admin email access | Hunting Query | 🔗 GitHub | GitHub Only | This query helps report on email access by administrators |
| Hunt for TABL changes | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365 |
| Local time to UTC time conversion | Hunting Query | 🔗 GitHub | GitHub Only | Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in securit... |
| Mail item accessed | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing emails accessed by end users using cloud app events data |
| Malicious email senders | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for emails from a sender with at least one email in quarantine |
| MDO daily detection summary report | Hunting Query | 🔗 GitHub | GitHub Only | This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365 |
| New TABL Items | Hunting Query | 🔗 GitHub | GitHub Only | This query helps identifying when new items being added to the Tenant/Allow Block List (TABL) in Defender for Office 365. |
| Top 10 Domains sending Malicious Emails (Malware+Phish+Spam) | Hunting Query | 🔗 GitHub | GitHub Only | Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftde... |
| Top 10 External Senders (Malware) | Hunting Query | 🔗 GitHub | GitHub Only | Identifies the top 10 external sender addresses delivering inbound emails classified as malware. If you want to exclude your own organization's domains (including subdomains), add a filter after the m... |
| Top 10 External Senders (Phish) | Hunting Query | 🔗 GitHub | GitHub Only | Identifies the top 10 external sender addresses delivering inbound emails classified as phishing. If you want to exclude your own organization's domains (including subdomains), add a filter after the ... |
| Top 10 External Senders (Spam) | Hunting Query | 🔗 GitHub | GitHub Only | Identifies the top 10 external sender addresses delivering inbound emails classified as spam. If you want to exclude your own organization's domains (including subdomains), add a filter after the spam... |
| Top 10 External Senders (Spam) | Hunting Query | 🔗 GitHub | GitHub Only | Identifies the top 10 external sender addresses delivering inbound emails classified as spam. To exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g... |
| Top 10 Targeted Users (Malware+Phish+Spam) | Hunting Query | 🔗 GitHub | GitHub Only | Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam. Based on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.... |
| Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam) | Hunting Query | 🔗 GitHub | GitHub Only | Visualises the top 10 users with click attempts on URLs in emails detected as malware, phishing, or spam, helping analysts identify risky user behaviour and potential targets. Based on Defender for Of... |
| MDO Threat Protection Detections trend over time | Hunting Query | 🔗 GitHub | GitHub Only | Graph of MDO detections trended over time |
| Total number of detections by MDO | Hunting Query | 🔗 GitHub | GitHub Only | Provides a summary of total number of detections |
| Automated email notifications and suspicious sign-in activity | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for Automated email notifications and suspicious sign-in activity |
| BEC - File sharing tactics - Dropbox | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for BEC - File sharing tactics - Dropbox |
| BEC - File sharing tactics - OneDrive or SharePoint | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint |
| Email bombing attacks | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing recipients who are potentially victim of email bombing attacks |
| Emails containing links to IP addresses | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for Emails containing links to IP addresses |
| Good emails from senders with bad patterns | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for good emails from senders with bad patterns |
| Hunt for email bombing attacks | Hunting Query | 🔗 GitHub | GitHub Only | This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365. |
| Hunt for email conversation take over attempts | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for email conversation take over attempts |
| Hunt for malicious attachments using external IOC source | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source |
| Hunt for malicious URLs using external IOC source | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for emails with malicious URLs based on external IOC source |
| Inbox rule changes which forward-redirect email | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for Inbox rule changes which forward-redirect email |
| MDO_CountOfRecipientsEmailaddressbySubject | Hunting Query | 🔗 GitHub | GitHub Only | Count of recipient's email addresses by subject |
| MDO_Countofrecipientsemailaddressesbysubject | Hunting Query | 🔗 GitHub | GitHub Only | Count of recipient's email addresses by subject |
| MDO_CountOfSendersEmailaddressbySubject | Hunting Query | 🔗 GitHub | GitHub Only | Count of sender's email addresses by subject |
| MDO_SummaryOfSenders | Hunting Query | 🔗 GitHub | GitHub Only | Count of all Senders and where they were delivered |
| MDO_URLClickedinEmail | Hunting Query | 🔗 GitHub | GitHub Only | URLs clicked in Email |
| Top outbound recipient domains sending inbound emails with threats | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for top outbound recipient domains which are sending inbound emails with threats |
| Detections by detection methods | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing malicious email detections by detection methods |
| Mail reply to new domain | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new |
| Mailflow by directionality | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing inbound / outbound / intra-org emails by domain per day |
| Malicious emails detected per day | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing Malware, Phishing, Spam emails caught per day |
| Sender recipient contact establishment | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in checking the sender-recipient contact establishment status |
| Spam Detections (High) by delivery location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails with Spam detections (High confidence) summarizing the data by Delivery Location. |
| Spam Detections (Normal) by delivery location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location. |
| Top 100 malicious email senders | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing top 100 malicious senders |
| Top 100 senders | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing top 100 senders in your organization in last 30 days |
| Zero day threats | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing zero day threats via URL and file detonations |
| Email containing malware accessed on a unmanaged device | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we are looking for emails containing malware accessed on a unmanaged device |
| Email containing malware sent by an internal sender | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we are looking for emails containing malware attachment sent by an internal sender |
| Email malware detection report | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing email malware detection cases |
| File Malware Detection Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily. |
| File Malware by Top Malware Families (Anti Virus) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoin... |
| File Malware by Top Malware Families (Safe Attachments) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Offic... |
| Malware Detections Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Malware detections over time summarizing the data daily. |
| Malware Detections by delivery location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location. |
| Malware Detections by Detection technology Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls. |
| Malware Detections by Detection technology | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls. |
| Malware detections by Workload Locations | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored |
| Malware detections by Workload Type | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored |
| Email Top Domains sending Malware | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain) |
| Top Malware Families | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected. |
| Top Users receiving Malware | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress) |
| Zero-day Malware Detections Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware. |
| Changes to Blocked Teams Domains (NRT) | Hunting Query | 🔗 GitHub | GitHub Only | This query detects changes to blocked Teams domains and can be used as an NRT detection. |
| Changes to Blocked Teams Domains | Hunting Query | 🔗 GitHub | GitHub Only | This query detects changes to blocked Teams domains. |
| Teams communication from suspicious external users | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for communication from suspicious external users. |
| Teams communication to suspicious external users | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for communication with suspicious external users. |
| Expanding recipients into separate rows | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for recipients of Teams messages. |
| External malicious Teams messages sent from internal senders | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for external malicious Teams messages sent from internal senders |
| Hunt for malicious messages using External Threat Intelligence | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source |
| Inbound Teams messages by sender domains | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing volume of inbound external Teams message by sender domains |
| Malicious Teams messages by URL detection methods | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing malicious Teams message detections by URL detection methods |
| Malicious Teams messages received from external senders | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for malicious Teams messages received from external senders. |
| Microsoft Teams chat initiated by a suspicious external user | Hunting Query | 🔗 GitHub | GitHub Only | Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages. |
| Number of unique accounts performing Teams message Admin submissions | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives |
| Number of unique accounts performing Teams message User submissions | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises number of unqiue accounts performing Teams message user submissions as false negatives or false positives |
| Possible partner impersonation in external Team messages | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message |
| Possible Teams phishing activity | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for possible Teams phishing activity. |
| Potentially malicious URL click in Teams | Hunting Query | 🔗 GitHub | GitHub Only | This query provides insights on a potentially malicious URL click in Teams |
| Rare Domains in External Teams Messages | Hunting Query | 🔗 GitHub | GitHub Only | Detects rare domains (seen in fewer than 3 Teams messages) appearing in external Microsoft Teams threads within the last 24 hours. |
| Suspicious Teams Display Name | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for Teams messages from an external user with a suspicious display name. |
| Teams Admin submission of Malware and Phish daily trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware |
| Teams Admin submission of No Threats daily trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of admin false positive Teams message submissions |
| Teams Admin-User Submissions Grading Verdicts | Hunting Query | 🔗 GitHub | GitHub Only | This query visualizes Teams messages submitted by users or admins then graded in the submission process. |
| Teams blocked URL clicks daily trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages. |
| Teams Malware ZAP | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams messages with Malware threats that have been ZAPed. |
| Teams Message with URL listed on OpenPhish | Hunting Query | 🔗 GitHub | GitHub Only | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered. |
| Teams message ZAPed with the same URL in Email | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams messages that have been ZAPed with the same URL in Email. |
| Teams messages from a specific sender by ThreadType | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams messages from a specific sender by ThreadType. |
| Teams messages with suspicious URL domains | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams messages with suspicious URL domains. |
| Teams Phish ZAP | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams messages with Phish threats that have been ZAPed. |
| Teams post delivery events daily trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualizes the daily amount of post delivery events on Teams messages. |
| Teams Spam ZAP | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams messages with Spam threats that have been ZAPed. |
| Teams URL clicks actions summarized by URLs clicked on | Hunting Query | 🔗 GitHub | GitHub Only | This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them. |
| Teams URL clicks through actions on Phish or Malware URLs summarized by URLs | Hunting Query | 🔗 GitHub | GitHub Only | This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls. |
| Teams User submissions daily trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of user false negative and false postive Teams message submissions |
| Teams users clicking on suspicious URL domains | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for Teams users clicking on suspicious URL domains. |
| Teams Threat Intelligence Indicator Hit for Domain or URL | Hunting Query | 🔗 GitHub | GitHub Only | This rule detects and alerts on known threats in Teams messages when a contained domain or URL matches a Microsoft Defender Threat Intelligence indicator (of type 'Domain' or 'URL') |
| Top 10 Attacked user by Phish messages | Hunting Query | 🔗 GitHub | GitHub Only | Top 10 attacked users by Phish messages from external senders using Teams |
| Top 10 external senders sending Teams messages | Hunting Query | 🔗 GitHub | GitHub Only | This query visulises all up Top 10 external senders sending Teams messages |
| Top 10 External senders sending Teams phishing messsages | Hunting Query | 🔗 GitHub | GitHub Only | This query looking for top 10 External senders sending Team phishing messsages. |
| Top 10 sender domains - Admin Teams message submissions FN | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages |
| Top 10 sender domains - Teams user submissions FN or FP | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages |
| Top 10 senders - Teams users submissions FN or FP | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages |
| Top 10 senders of Admin Teams message submissions FN | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages |
| Top 10 senders of Admin Teams message submissions FP | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises Teams messages submitted by admins as false positives, summarizing the data by top 10 indidvidual senders of those messages |
| Top 10 Users clicking on malicious URLs in Teams | Hunting Query | 🔗 GitHub | GitHub Only | This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams. |
| Top accounts performing Teams admin submissions FN or FP | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the top admins performing false negative or false positive admin submissions of Teams messages |
| Top accounts performing Teams user submissions FN or FP | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the top users performing false negative or false positive user submissions of Teams messages |
| Top domains outbound sending Malicious Teams messages inbound | Hunting Query | 🔗 GitHub | GitHub Only | This query looking for potential partner compromise via comparing outbound Teams message traffic per target domain and looking for malicious Teams messages from the same domains as inbound. |
| Top External malicious Senders | Hunting Query | 🔗 GitHub | GitHub Only | Top external senders sending malicious inbound Teams messages Spam, Phish, Malware |
| Top External Sender domains - Malware | Hunting Query | 🔗 GitHub | GitHub Only | Top External Sender domains sending Teams message with Malware threats |
| Top External Sender domains - Phish | Hunting Query | 🔗 GitHub | GitHub Only | Top External Sender domains sending Teams message with Phish threats |
| Top External Sender domains - Spam | Hunting Query | 🔗 GitHub | GitHub Only | Top External Sender domains sending Teams message with Spam threats |
| Top malicious URLs clicked by users in Teams | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunt for top malicious URLs clicked by users in Teams |
| Total number of MDO Teams protection detections daily | Hunting Query | 🔗 GitHub | GitHub Only | This query visulises Total number of MDO Teams protection detections daily |
| URL click on URLs in ZAP-d Teams messages | Hunting Query | 🔗 GitHub | GitHub Only | This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP. |
| Spam and Phish allowed to inbox by Admin Overrides | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in reviewing malicious emails allowed due to admin overrides |
| Spam and Phish allowed to inbox by User Overrides | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in reviewing malicious emails allowed due to user overrides |
| Top policies performing admin overrides | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in reviewing top policies for admin overrides (Allow/Block) |
| Top policies performing user overrides | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in reviewing top policies for user overrides (Allow/Block) |
| Total Emails with Admin Overrides (Allow) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override |
| Total Emails with Admin Overrides (Block) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily |
| Total Emails with User Overrides (Allow) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found |
| Total Emails with User Overrides (Block) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily |
| Appspot Phishing Abuse | Hunting Query | 🔗 GitHub | GitHub Only | This query helps surface phishing campaigns associated with Appspot abuse. |
| Phish Detections Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish detections over time summarizing the data daily. |
| Phish Detections (High) by delivery location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location. |
| Phish Detections (Normal) by delivery location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location. |
| Phish Detections by delivery location trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location. |
| Phish Detections by Detection technology Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls |
| Phish Detections by Detection technology | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls |
| Possible device code phishing attempts | Hunting Query | 🔗 GitHub | GitHub Only | This query helps hunting for possible device code Phishing attempts |
| Punycode lookalikes | Hunting Query | 🔗 GitHub | GitHub Only | Punycode lookalike domains in Emails and Teams messages |
| Email Top Domains sending Phish | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain). |
| Top Users receiving Phish | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress) |
| Zero-day Phish Detections Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish |
| Campaign with randomly named attachments | Hunting Query | 🔗 GitHub | GitHub Only | In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients |
| Campaign with suspicious keywords | Hunting Query | 🔗 GitHub | GitHub Only | In this detection, we track emails with suspicious keywords in subjects. |
| Custom detection-Emails with QR from non-prevalent senders | Hunting Query | 🔗 GitHub | GitHub Only | In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code |
| Emails delivered having URLs from QR codes | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we hunt for inbound emails delivered having URLs from QR codes |
| Emails with QR codes and suspicious keywords in subject | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject |
| Emails with QR codes from non-prevalent sender | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders |
| Hunting for sender patterns | Hunting Query | 🔗 GitHub | GitHub Only | In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents |
| Hunting for user signals-clusters | Hunting Query | 🔗 GitHub | GitHub Only | In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign. |
| Inbound emails with QR code URLs | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we summarize volume of inbound emails with QR code URLs in last 30 days |
| Personalized campaigns based on the first few keywords | Hunting Query | 🔗 GitHub | GitHub Only | In this detection, we track emails with personalized subjects. |
| Personalized campaigns based on the last few keywords | Hunting Query | 🔗 GitHub | GitHub Only | In this detection, we track emails with personalized subjects. |
| Risky sign-in attempt from a non-managed device | Hunting Query | 🔗 GitHub | GitHub Only | In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device. |
| Suspicious sign-in attempts from QR code phishing campaigns | Hunting Query | 🔗 GitHub | GitHub Only | This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices. |
| Group quarantine release | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released. |
| High Confidence Phish Released | Hunting Query | 🔗 GitHub | GitHub Only | This query shows information about high confidence phish email that has been released from the Quarantine. |
| Quarantine Phish Reason trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method |
| Quarantine Phish Reason | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total amount of phish emails that are quarantined, summarized by the detection method |
| Quarantine Release Email Details | Hunting Query | 🔗 GitHub | GitHub Only | This query shows information about email that has been released from the Quarantine in Defender for Office 365. |
| Quarantine release trend | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing quarantine release trend in Defender for Office 365 |
| Quarantine releases by Detection Types | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails released from quarantine and summarizing the result by the original filter verdict |
| Quarantine Spam Reason trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method |
| Quarantine Spam Reason | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total amount of spam emails that are quarantined, summarized by the detection method |
| AIR investigation actions insight | Hunting Query | 🔗 GitHub | GitHub Only | This query provides insights into AIR investigation actions in Microsoft Defender for Office 365. |
| Listing Email Remediation Actions via Explorer | Hunting Query | 🔗 GitHub | GitHub Only | Listing Email Remediation Actions performed via Explorer in Defender for Office 365 |
| Top 10 domains sending Bulk email | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails which has any Bulk complaint level. |
| Spam detection by delivery location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location. |
| Spam detection by IP and its location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6). |
| Bulk Emails by Sender Bulk Complaint level | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails which has any Bulk complaint level. |
| Spam detection technologies | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls. |
| Email Top 10 Domains sending Spam | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails with Spam detections. |
| Email Top 10 Targeted Users (Spam) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises top 10 users targeted with Spam. |
| Email Top 15 Domains sending Spam with Additional Details | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). |
| Email Top 15 Targeted Users (Spam) with Additional Details | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises top 15 users targeted with Spam with summarized spam detections. |
| Spam detection trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spam detections over time summarizing the data daily |
| Spam Detections by Detection technology | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls. |
| Display Name - Spoof and Impersonation | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name |
| Impersonation Detections by Detection Technology Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time |
| Impersonation Detections by Detection Technology | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology |
| Impersonation Detections Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish (BEC) - Impersonation detections over time. |
| referral-phish-emails | Hunting Query | 🔗 GitHub | GitHub Only | Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data |
| Spoof and impersonation detections by sender IP | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing count of spoof and impersonation detections done per sender IP |
| Spoof and impersonation phish detections | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing count of phish detections done by spoof detection methods |
| Spoof Detections by Detection Technology Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time |
| Spoof Detections by Detection Technology | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology |
| Spoof Detections Trend | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily. |
| Top Domains Outbound with Emails with Threats Inbound (Partner BEC) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) |
| User not covered under display name impersonation | Hunting Query | 🔗 GitHub | GitHub Only | This query helps to find threats using display name impersonation for users not already protected with User Impersonation |
| Admin Submission Trend (FN) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of admin false negative submission by submission type. |
| Admin Submission Trend (FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of admin false positive submission by submission type. |
| Admin Submissions by DetectionMethod (Phish FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the original detection technology of emails submitted as phish false positive by admins |
| Admin Submissions by DetectionMethod (Spam FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the original detection technology of emails submitted as spam false positive by admins |
| Admin Submissions by Detection Type | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type |
| Admin Submissions by Grading verdict (FN-FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading. |
| Admin Submissions by Submission State (FN) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total amount of admin false negative submissions by the state of the submission. |
| Admin Submissions by Submission State (FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total amount of admin false positive submissions by the state of the submission. |
| Admin Submissions by Submission Type (FN) | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing admin reported email submissions |
| Admin Submissions by Submission Type (FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total amount of admin false positive submission by submission type. |
| Status of submissions | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing status of submissions |
| Top accounts performing admin submissions (FN) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the top admins performing false negative submissions |
| Top accounts performing admin submissions (FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the top admins performing false positive submissions |
| Top accounts performing user submissions | Hunting Query | 🔗 GitHub | GitHub Only | This query graphs top accounts performing user submissions |
| Top 10 Detection Overrides - Admin Email Submissions (FN) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override |
| Top 10 sender domains - Admin email submissions (FN) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails |
| Top 10 sender domains - Admin email submissions (FP) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails |
| Total Submissions by Submission State | Hunting Query | 🔗 GitHub | GitHub Only | Total Submissions by Submission State |
| Total Submissions by Submission Type | Hunting Query | 🔗 GitHub | GitHub Only | Total Submissions by Submission Type |
| User reported submissions | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing user reported email submissions |
| User Email Submissions accuracy vs Admin review verdict | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises user submissions type compared to admin review verdict |
| User Email Submissions (FN) - Top Detection Overrides by Admins | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override |
| User Email Submissions (FN) - Top Detection Overrides by Users | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override. |
| User Email Submissions (FN) - Top Inbound P2 Senders domains | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises top sender domains of inbound emails submitted as false negatives by users. |
| User Email Submissions (FN) - Top Inbound P2 Senders | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises top sender email addresses of inbound emails submitted as false negatives by users. |
| User Email Submissions (FN) - Top Intra-Org P2 Senders | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises top sender email addresses of intra-org emails submitted as false negatives by users. |
| User Email Submissions (FN) - Top Intra-Org Subjects | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises top 10 subjects of intra-org emails submitted as false negatives by users. |
| User Email Submissions by Admin review status (Mark and Notify) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises user submissions where admin also performed 'mark and notify' action on the submission |
| User Email Submissions (FN-FP) by Grading verdict | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading. |
| User Email Submissions (FN) by Submission Type | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total ammount of user false negative submission by submission type, including the phish simulations reported emails |
| User email submissions (FN) from Junk Folder | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the total ammount of user false negative submissions from the junk folder |
| User Email Submission Trend (FN) | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users. |
| Attacked more than x times average | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing count of users attacked more than x times average. |
| Malicious mails by sender IPs | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing sender IPs sending malicious email of type Malware or Phish |
| Top 10% of most attacked users | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing the list of top 10% of most attacked users |
| Top 10 URL domains attacking organization | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing list of top 10 URL domains attacking the organization |
| Top external malicious senders | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days |
| Top targeted users | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days |
| Malicious Clicks allowed (click-through) | Hunting Query | 🔗 GitHub | GitHub Only | Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content. Based on Defender for Offi... |
| Malicious Emails with QR code Urls | Hunting Query | 🔗 GitHub | GitHub Only | Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns. Based on Defender for Office 365 workbook: https://techcommuni... |
| PhishingEmailUrlRedirector (1) | Hunting Query | 🔗 GitHub | GitHub Only | The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data. |
| SafeLinks URL detections | Hunting Query | 🔗 GitHub | GitHub Only | This query provides insights on the detections done by SafeLinks protection in Defender for Office 365 |
| Top 10 Users clicking on Malicious URLs (Malware) | Hunting Query | 🔗 GitHub | GitHub Only | Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook: ... |
| Top 10 Users clicking on Malicious URLs (Phish) | Hunting Query | 🔗 GitHub | GitHub Only | Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook:... |
| Top 10 Users clicking on Malicious URLs (Spam) | Hunting Query | 🔗 GitHub | GitHub Only | Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook: htt... |
| URL Click attempts by threat type | Hunting Query | 🔗 GitHub | GitHub Only | Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/bl... |
| URL Clicks by Action | Hunting Query | 🔗 GitHub | GitHub Only | Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog... |
| URLs by location | Hunting Query | 🔗 GitHub | GitHub Only | Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk. Based on Defender for Office 36... |
| End user malicious clicks | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing list of top users click on Phis URLs |
| URL click count by click action | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing URL click count by ClickAction |
| URL click on ZAP email | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge |
| URL clicks actions by URL | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we are looking URL click actions by URL in the last 7 days |
| URLClick details based on malicious URL click alert | Hunting Query | 🔗 GitHub | GitHub Only | In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected |
| User clicked through events | Hunting Query | 🔗 GitHub | GitHub Only | This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page. |
| User clicks on malicious inbound emails | Hunting Query | 🔗 GitHub | GitHub Only | This query provides insights on users who clicked on a suspicious URL |
| User clicks on phishing URLs in emails | Hunting Query | 🔗 GitHub | GitHub Only | This query helps in determining clickthroughs when email delivered because of detection overrides. |
| Post Delivery Events by Admin | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type |
| Post Delivery Events by Location | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action |
| Post Delivery Events by ZAP type | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action |
| Post Delivery Events over time | Hunting Query | 🔗 GitHub | GitHub Only | This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge. |
| Bazacall Emails | Hunting Query | 🔗 GitHub | GitHub Only | Bazacall malware uses emails that contain a phone number for the user to call in order to cancel a fake subscription. These emails contain no links or attachments, and use automatic payment lures to t... |
| Cobalt Strike Lateral Movement | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed Bazacall using Cobalt Strike in order to move laterally to other machines on the network. |
| Dropping payload via certutil | Hunting Query | 🔗 GitHub | GitHub Only | BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Ex... |
| Excel file download domain pattern | Hunting Query | 🔗 GitHub | GitHub Only | BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Ex... |
| Excel Macro Execution | Hunting Query | 🔗 GitHub | GitHub Only | Bazacall uses malicious macro-enabled Excel documents to execute their payload. |
| Malicious Excel Delivery | Hunting Query | 🔗 GitHub | GitHub Only | Bazacall uses malicious Excel files to execute payloads on affected devices. |
| NTDS theft | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe. |
| Renamed Rclone Exfil | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed Bazacall using a renamed version of Rclone for data exfiltration. |
| RunDLL Suspicious Network Connection | Hunting Query | 🔗 GitHub | GitHub Only | During the chain of events from Bazacall to Bazaloader, RunDLL makes several network connections, including to command and control (C2) infrastructure. The command line for these connections contains ... |
| Stolen Images Execution | Hunting Query | 🔗 GitHub | GitHub Only | The "Stolen Images" Bazarloader campaign uses fake copyright infingement contact form emails and malicious files pretending to contain "stolen images" to trick users into downloading the malware. |
| Zip-Doc - Creation of JPG Payload File | Hunting Query | 🔗 GitHub | GitHub Only | In the campaign where Bazarloader is delivered via emails containing pw protected zip attachments, regsvr32.exe is used to launch a malicious payload that is disguised as a JPG file. |
| Zip-Doc - Word Launching MSHTA | Hunting Query | 🔗 GitHub | GitHub Only | The pw protected zip attachment -> Word doc delivery method of Bazarloader utilizes Word to create an .hta file and launch it via MSHTA to connect to a malicious domain and pull down the Bazarloader p... |
| Identify EUROPIUM IOCs | Hunting Query | 🔗 GitHub | GitHub Only | The following query can locate activity possibly associated with the EUROPIUM threat actor |
| Identify Microsoft Defender Antivirus detection related to EUROPIUM | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for Microsoft Defender Antivirus detections related to EUROPIUM actor |
| Identify unusual identity additions related to EUROPIUM | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for identity add through exchange PowerShell |
| deimos-component-execution | Hunting Query | 🔗 GitHub | GitHub Only | Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization... |
| evasive-powershell-executions | Hunting Query | 🔗 GitHub | GitHub Only | Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization... |
| evasive-powershell-strings | Hunting Query | 🔗 GitHub | GitHub Only | This query searches for a string pattern detected in evasive PowerShell usage. Jupyter or SolarMarker will iterate on this pattern multiple times to read data and call additional processes. This query... |
| successive-tk-domain-calls | Hunting Query | 🔗 GitHub | GitHub Only | Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization... |
| KNOTWEED-AV Detections | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for Microsoft Defender Antivirus detections with the family names used by KNOTWEED |
| KNOTWEED-COM Registry Key Modified to Point to Color Profile Folder | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\ |
| KNOTWEED-Domain IOCs | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies matches based on domain IOCs related to KNOTWEED against Microsoft Defender for Endpoint device network connections |
| KNOTWEED-Downloading new file using Curl | Hunting Query | 🔗 GitHub | GitHub Only | This query looks for new files being downloaded using Curl. |
| KNOTWEED-File Hash IOCs | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies matches based on KNOTWEED file hash IOCs across Microsoft Defender for Endpoint tables |
| KNOTWEED-PE File Dropped in Color Profile Folder | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\ |
| LemonDuck-competition-killer | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| LemonDuck-component-download-structure | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| LemonDuck-component-names | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| LemonDuck-control-structure | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| LemonDuck-defender-exclusions | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| LemonDuck-email-subjects | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| LemonDuck-id-generation | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| LemonDuck-registration-function | Hunting Query | 🔗 GitHub | GitHub Only | LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi... |
| Alerts related to Log4j vulnerability | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed attackers exploiting vulnerabilities associated with Log4J. |
| Devices with Log4j vulnerability alerts and additional other alert related context | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J. |
| Suspicious JScript staging comment | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing identifiable strings in PowerShell commands. |
| Suspicious PowerShell curl flags | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing uncommon PowerShell flags to communicate to command-and-control infrastructure. |
| Suspicious process event creation from VMWare Horizon TomcatService | Hunting Query | 🔗 GitHub | GitHub Only | Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing the ws_TomcatService.exe process to launch malicious processes. |
| Disable Controlled Folders | Hunting Query | 🔗 GitHub | GitHub Only | Prior to deploying Macaw ransomware in an organization, the adversary will disable all controlled folders, which will enable them to be encrypted once the ransomware payload is deployed. |
| Imminent Ransomware | Hunting Query | 🔗 GitHub | GitHub Only | Directly prior to deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools. |
| Inhibit recovery by disabling tools and functionality | Hunting Query | 🔗 GitHub | GitHub Only | Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts. |
| Mass account password change | Hunting Query | 🔗 GitHub | GitHub Only | Prior to deploying Macaw ransomware in an organization, adversaries will change the password for hundreds or thousands of accounts in order to lock users out of the network and impeded recovery effort... |
| PSExec Attrib commands | Hunting Query | 🔗 GitHub | GitHub Only | Prior to deploying Macaw ransomware in an organization, adversaries wil use Attrib to display file attribute information on multiple drives and all subfolders. |
| Use of MSBuild as LOLBin | Hunting Query | 🔗 GitHub | GitHub Only | Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2. |
| Excel launching anomalous processes | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to find Excel launching anomalous processes congruent with Qakbot payloads which contain additional markers from recent Qakbot executions. The presence of such anomalous processes indic... |
| General attempts to access local email store | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to find attempts to access files in the local path containing Outlook emails. |
| Qakbot Craigslist Domains | Hunting Query | 🔗 GitHub | GitHub Only | Qakbot operators have been abusing the Craigslist messaging system to send malicious emails. These emails contain non-clickable links to malicious domains impersonating Craigslist, which the user is i... |
| Qakbot email theft (1) | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to find email stealing activities ran by Qakbot that will use "ping.exe -t 127.0.0.1" to obfuscate subsequent actions. Email theft that occurs might be exfiltrated to operators and indi... |
| Qakbot email theft | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to find email stealing activities ran by Qakbot that will use "ping.exe -t 127.0.0.1" to obfuscate subsequent actions. Email theft that occurs might be exfiltrated to operators and indi... |
| Qakbot reconnaissance activities | Hunting Query | 🔗 GitHub | GitHub Only | Use this query to find reconnaissance and beaconing activities after code injection occurs. Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltr... |
| StrRAT-AV-Discovery | Hunting Query | 🔗 GitHub | GitHub Only | StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the... |
| StrRAT-Email-Delivery | Hunting Query | 🔗 GitHub | GitHub Only | StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the... |
| StrRAT-Malware-Persistence | Hunting Query | 🔗 GitHub | GitHub Only | StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the... |
| app-armor-stopped | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc... |
| java-executing-cmd-to-run-powershell | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc... |
| kinsing-miner-download | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc... |
| oracle-webLogic-executing-powershell | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc... |
| rce-on-vulnerable-server | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc... |
| tomcat-8-executing-powershell | Hunting Query | 🔗 GitHub | GitHub Only | This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc... |
| Malicious bat file | Hunting Query | 🔗 GitHub | GitHub Only | ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter. |
| Payload Delivery | Hunting Query | 🔗 GitHub | GitHub Only | ZLoader was delivered in a campaign in summer 2021 via malvertising. This campaign was tweeted about by @MsftSecIntel on twitter. |
| Suspicious Registry Keys | Hunting Query | 🔗 GitHub | GitHub Only | ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter. In... |
| A365 AI Agents - Hard-coded credentials in Tools or Actions | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that contain hard-coded credentials in their tools or actions. Storing credentials in clear text within agent logic creates a security risk because these secrets ... |
| A365 AI Agents - HTTP Requests to Non-HTTPS Endpoints | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that send HTTP requests to endpoints using non-HTTPS schemes. Communication over unencrypted HTTP exposes sensitive data in transit and increases the risk of inte... |
| A365 AI Agents - HTTP Requests to Non-standard Ports | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that send HTTP requests to endpoints using non-standard ports (other than 443). Communication over uncommon ports can indicate suspicious activity, unauthorized n... |
| A365 AI Agents - MCP Tool Configured | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that have Model Context Protocol (MCP) tools configured. MCP tools extend agent capabilities but introduce additional security considerations because they can exec... |
| A365 AI Agents - Missing Tools in Instructions | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that have tools configured but they are not mentioned in instructions. This query identifies A365 AI agents that have tools configured but are not mentioned in in... |
| A365 AI Agents - Published Agents without Instructions | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that are published but lack configured instructions. Missing instructions increase the risk of prompt injection attacks, where malicious input can influence the a... |
| A365 AI Agents - Publicly Shared | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that are shared publicly. Such configurations significantly increase the risk of unauthorized access by unintended users, which could lead to data exposure or misu... |
| A365 AI Agents - Published Agents with Short Instructions | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents that are published but have short or insufficient instructions. Short instructions increase the risk of prompt injection attacks, where malicious input can influe... |
| A365 AI Agents - Orphaned Agents with Disabled Owners | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies A365 AI agents whose owners are either disabled or removed from the organization, and are not blocked. Orphaned agents without an active owner pose governance and security risks... |
| Copilot Studio AI Agents - Sending email to AI controlled input values | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents using generative orchestration to send emails via the Outlook connector where all action input values are populated dynamically by the orchestrator. Th... |
| Copilot Studio AI Agents - Sending email to external mailboxes | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents configured to send emails to external mailboxes (outside the organization`s domains). Such configurations can lead to sensitive or internal data being e... |
| Copilot Studio AI Agents - Published Generative Orchestration without Instructions | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that are published with generative orchestration enabled but lack configured instructions. Missing instructions increase the risk of prompt injection at... |
| Copilot Studio AI Agents - Hard-coded credentials in Topics or Actions | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that contain hard-coded credentials in Topics or Actions. Storing credentials in clear text within agent logic creates a security risk because these sec... |
| Copilot Studio AI Agents - HTTP Requests to Connector Endpoints | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that use HTTP actions to endpoints where Power Platform connectors are available (e.g., graph.microsoft.com, management.azure.com). Using direct HTTP ca... |
| Copilot Studio AI Agents - HTTP Requests to Non-HTTPS Endpoints | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that send HTTP requests to endpoints using non-HTTPS schemes. Communication over unencrypted HTTP exposes sensitive data in transit and increases the ri... |
| Copilot Studio AI Agents - HTTP Requests to Non-standard Ports | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that send HTTP requests to endpoints using non-standard ports (other than 443). Communication over uncommon ports can indicate suspicious activity, unau... |
| AI Agents - MCP Tool Configured | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that have Model Context Protocol (MCP) tools configured. MCP tools extend agent capabilities but introduce additional security considerations because the... |
| Copilot Studio AI Agents - MCP Tool with Maker Credentials | Hunting Query | 🔗 GitHub | GitHub Only | Identifies Copilot Studio AI agents with Model Context Protocol (MCP) tools configured using maker credentials. This configuration can create security risks because the tool runs with the maker`s pers... |
| Copilot Studio AI Agents - Organization or Multi-tenant Shared | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that are shared broadly-either with the entire organization or configured for multi-tenant access. Such configurations significantly increase the risk of... |
| Copilot Studio AI Agents - Unused Actions | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents with classic orchestration that include Actions not referenced in any Topic. While unused Actions may not pose an immediate security risk, they can intr... |
| Copilot Studio AI Agents - Dormant Author Authentication Connection | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that are published and contain actions configured with Author Authentication (maker`s personal credentials) but have not been used or invoked in the last... |
| Copilot Studio AI Agents - No Authentication Required | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents without authentication mechanisms. Authentication is an agent-level configuration. Such misconfiguration poses significant security risks because when t... |
| AI Agents - Orphaned Agents with Disabled Owners | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies AI agents whose owners are either disabled or removed from the organization. Orphaned agents without an active owner pose governance and security risks because no one is account... |
| Copilot Studio AI Agents - Published Agents with Author Authentication | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that are published and use the maker`s personal credentials in their authentication or integration flows. This configuration introduces security risks b... |
| Copilot Studio AI Agents - Published Dormant (30d) | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies Copilot Studio AI agents that are published but have not been used by any user in the organization for the last 30 days. Dormant agents can create unnecessary exposure and may s... |
| AI Agents - Unpublished Unmodified (30d) | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies AI agents that remain unpublished and have not been modified for at least 30 days. While these agents may not pose an immediate security threat, they can create operational inef... |
| detect-uac-elevation | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies UAC elevated processes by analyzing launches of consent.exe (the process that performs UAC elevation). The first parameter of consent.exe is the process ID being elevated, theref... |
| Web Content Filtering Events | Hunting Query | 🔗 GitHub | GitHub Only | This query identifies web content filtering events in Advanced Hunting. |
| Detect DNS obfuscation using @ symbol | Hunting Query | 🔗 GitHub | GitHub Only | One of the tricks used in phishing is obfuscating the domain name in a URL by using the @ symbol. This technique goes all the way back to the original RFC for URLs, RFC 1738. When you specify an @ in... |
| Shadow Copy Deletions | Hunting Query | 🔗 GitHub | GitHub Only | This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by TA. This query detects know commands that have been used by the ransomware actors. Some information ... |
| Blocked Clicks Trend | Hunting Query | 🔗 GitHub | GitHub Only | Visualises the trend of malicious URL clicks that were blocked by Safe Links over the past 30 days, helping analysts monitor the effectiveness of click protection policies. Based on Defender for Offic... |
| Malicious URL Clicks by workload | Hunting Query | 🔗 GitHub | GitHub Only | Visualises click attempts on malicious URLs, grouped by workload (such as Exchange, Teams, SharePoint, Copilot etc.), to help analysts understand which workloads are most targeted. Based on Defender f... |
| 1Password | Workbook | 🔗 GitHub | GitHub Only | |
| 42CrunchAPIProtectionWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| AADManagedIdentitySignInLogs | Workbook | 🔗 GitHub | GitHub Only | |
| AADNonInteractiveUserSignInLogs | Workbook | 🔗 GitHub | GitHub Only | |
| AADServicePrincipalSignInLogs | Workbook | 🔗 GitHub | GitHub Only | |
| AcscEssential8 | Workbook | 🔗 GitHub | GitHub Only | |
| AdvancedKQL | Workbook | 🔗 GitHub | GitHub Only | |
| AdvancedWorkbookConcepts | Workbook | 🔗 GitHub | GitHub Only | |
| ADXvsLA | Workbook | 🔗 GitHub | GitHub Only | |
| AIA-Darktrace | Workbook | 🔗 GitHub | GitHub Only | |
| AIVectraDetectWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| AksSecurity | Workbook | 🔗 GitHub | GitHub Only | |
| AliCloudWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| AlsidIoA | Workbook | 🔗 GitHub | GitHub Only | |
| AlsidIoE | Workbook | 🔗 GitHub | GitHub Only | |
| AMAmigrationTracker | Workbook | 🔗 GitHub | GitHub Only | |
| AmazonWebServicesNetworkActivities | Workbook | 🔗 GitHub | GitHub Only | |
| AmazonWebServicesUserActivities | Workbook | 🔗 GitHub | GitHub Only | |
| AnalyticsEfficiency | Workbook | 🔗 GitHub | GitHub Only | |
| AnalyticsHealthAudit | Workbook | 🔗 GitHub | GitHub Only | |
| AnomaliesVisualization | Workbook | 🔗 GitHub | GitHub Only | |
| AnomalyData | Workbook | 🔗 GitHub | GitHub Only | |
| ArchivingBasicLogsRetention | Workbook | 🔗 GitHub | GitHub Only | |
| ASC-ComplianceandProtection | Workbook | 🔗 GitHub | GitHub Only | |
| AttackSurfaceReduction | Workbook | 🔗 GitHub | GitHub Only | |
| Auth0Workbook | Workbook | 🔗 GitHub | GitHub Only | |
| AutomationHealth | Workbook | 🔗 GitHub | GitHub Only | |
| AWSS3 | Workbook | 🔗 GitHub | GitHub Only | |
| AzDDoSStandardWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| AzureActiveDirectoryAuditLogs | Workbook | 🔗 GitHub | GitHub Only | |
| AzureActiveDirectorySignins | Workbook | 🔗 GitHub | GitHub Only | |
| AzureActivity | Workbook | 🔗 GitHub | GitHub Only | |
| AzureAuditActivityAndSignin | Workbook | 🔗 GitHub | GitHub Only | |
| AzureFirewall | Workbook | 🔗 GitHub | GitHub Only | |
| AzureFirewallWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| AzureInformationProtection | Workbook | 🔗 GitHub | GitHub Only | |
| AzureKeyVaultWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| AzureLogCoverage | Workbook | 🔗 GitHub | GitHub Only | |
| AzureNetworkWatcher | Workbook | 🔗 GitHub | GitHub Only | |
| AzureOpenAIMonitoring | Workbook | 🔗 GitHub | GitHub Only | |
| AzureSentinelCost | Workbook | 🔗 GitHub | GitHub Only | |
| AzureSentinelSecurityAlerts | Workbook | 🔗 GitHub | GitHub Only | |
| AzureServiceHealthWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| AzureThreatResearchMatrixWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| Barracuda | Workbook | 🔗 GitHub | GitHub Only | |
| BETTER_MTD_Workbook | Workbook | 🔗 GitHub | GitHub Only | |
| CheckPoint | Workbook | 🔗 GitHub | GitHub Only | |
| Cisco | Workbook | 🔗 GitHub | GitHub Only | |
| CiscoFirepower | Workbook | 🔗 GitHub | GitHub Only | |
| CiscoMeraki | Workbook | 🔗 GitHub | GitHub Only | |
| Citrix | Workbook | 🔗 GitHub | GitHub Only | |
| CitrixWAF | Workbook | 🔗 GitHub | GitHub Only | |
| CodelessConnectorBuilder | Workbook | 🔗 GitHub | GitHub Only | |
| CognniIncidentsWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| ConditionalAccessTrendsandChanges | Workbook | 🔗 GitHub | GitHub Only | |
| CopilotforSecurityMonitoring | Workbook | 🔗 GitHub | GitHub Only | |
| CriblWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| CyberArkEPV | Workbook | 🔗 GitHub | GitHub Only | |
| CyberpionOverviewWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| DataCollectionHealthMonitoring | Workbook | 🔗 GitHub | GitHub Only | |
| Data_Latency_Workbook | Workbook | 🔗 GitHub | GitHub Only | |
| DCR-Toolkit | Workbook | 🔗 GitHub | GitHub Only | |
| DelineaWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| Dns | Workbook | 🔗 GitHub | GitHub Only | |
| DoDZeroTrustWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| DSTIMWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| DuoSecurity | Workbook | 🔗 GitHub | GitHub Only | |
| esetSMCWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| EventAnalyzer | Workbook | 🔗 GitHub | GitHub Only | |
| ExchangeCompromiseHunting | Workbook | 🔗 GitHub | GitHub Only | |
| ExchangeOnline | Workbook | 🔗 GitHub | GitHub Only | |
| ExtraHopDetectionSummary | Workbook | 🔗 GitHub | GitHub Only | |
| F5BIGIPSystemMetrics | Workbook | 🔗 GitHub | GitHub Only | |
| F5Networks | Workbook | 🔗 GitHub | GitHub Only | |
| ForcepointCASB | Workbook | 🔗 GitHub | GitHub Only | |
| ForcepointCloudSecuirtyGatewayworkbook | Workbook | 🔗 GitHub | GitHub Only | |
| ForcepointDLP | Workbook | 🔗 GitHub | GitHub Only | |
| ForcepointNGFW | Workbook | 🔗 GitHub | GitHub Only | |
| ForcepointNGFWAdvanced | Workbook | 🔗 GitHub | GitHub Only | |
| Fortigate | Workbook | 🔗 GitHub | GitHub Only | |
| GitHubSecurityWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| IdentityAndAccess | Workbook | 🔗 GitHub | GitHub Only | |
| IllusiveADS | Workbook | 🔗 GitHub | GitHub Only | |
| IllusiveASM | Workbook | 🔗 GitHub | GitHub Only | |
| IncidentOverview | Workbook | 🔗 GitHub | GitHub Only | |
| IncidentTasksWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| InfobloxNIOS | Workbook | 🔗 GitHub | GitHub Only | |
| InsecureProtocols | Workbook | 🔗 GitHub | GitHub Only | |
| IntrotoKQL | Workbook | 🔗 GitHub | GitHub Only | |
| IntsightsIOCWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| InvestigationInsights | Workbook | 🔗 GitHub | GitHub Only | |
| IoTAssetDiscovery | Workbook | 🔗 GitHub | GitHub Only | |
| IOT_Alerts | Workbook | 🔗 GitHub | GitHub Only | |
| KeeperSecurityDashboard | Workbook | 🔗 GitHub | GitHub Only | |
| LinuxMachines | Workbook | 🔗 GitHub | GitHub Only | |
| Log4jPostCompromiseHunting | Workbook | 🔗 GitHub | GitHub Only | |
| LogAnalyticsQueryAnalysis | Workbook | 🔗 GitHub | GitHub Only | |
| LogSourcesAndAnalyticRulesCoverage | Workbook | 🔗 GitHub | GitHub Only | |
| M365SecurityPosture | Workbook | 🔗 GitHub | GitHub Only | |
| ManualSentinelIncident | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftCloudAppSecurity | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftCopilotActivityMonitoring | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftDefenderForEndPoint | Workbook | 🔗 GitHub | GitHub Only | |
| microsoftdefenderforidentity | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftDefenderForOffice365 | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftGraphActivityLogs | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftPurviewInformationProtection | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftSentinelCostEUR | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftSentinelCostGBP | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftSentinelDeploymentandMigrationTracker | Workbook | 🔗 GitHub | GitHub Only | |
| MicrosoftTeams | Workbook | 🔗 GitHub | GitHub Only | |
| MITREAttack | Workbook | 🔗 GitHub | GitHub Only | |
| NetskopeEvents | Workbook | 🔗 GitHub | GitHub Only | |
| NetskopeWebTx_Workbook | Workbook | 🔗 GitHub | GitHub Only | |
| NordPass | Workbook | 🔗 GitHub | GitHub Only | |
| NormalizedNetworkEvents | Workbook | 🔗 GitHub | GitHub Only | |
| Office365 | Workbook | 🔗 GitHub | GitHub Only | |
| OnapsisAlarmsOverview | Workbook | 🔗 GitHub | GitHub Only | |
| OneIdentity | Workbook | 🔗 GitHub | GitHub Only | |
| OptimizationWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| OrcaAlerts | Workbook | 🔗 GitHub | GitHub Only | |
| PaloAltoNetworkThreat | Workbook | 🔗 GitHub | GitHub Only | |
| PaloAltoOverview | Workbook | 🔗 GitHub | GitHub Only | |
| Perimeter81OverviewWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| pfsense | Workbook | 🔗 GitHub | GitHub Only | |
| PhishingAnalysis | Workbook | 🔗 GitHub | GitHub Only | |
| PlaybookHealth | Workbook | 🔗 GitHub | GitHub Only | |
| PrancerSentinelAnalytics | Workbook | 🔗 GitHub | GitHub Only | |
| ProofpointPOD | Workbook | 🔗 GitHub | GitHub Only | |
| ProofpointTAP | Workbook | 🔗 GitHub | GitHub Only | |
| ProofPointThreatDashboard | Workbook | 🔗 GitHub | GitHub Only | |
| PulseConnectSecure | Workbook | 🔗 GitHub | GitHub Only | |
| QualysVM | Workbook | 🔗 GitHub | GitHub Only | |
| QualysVMv2 | Workbook | 🔗 GitHub | GitHub Only | |
| SamsungKnoxAssetIntelligence | Workbook | 🔗 GitHub | GitHub Only | |
| SecurityOperationsEfficiency | Workbook | 🔗 GitHub | GitHub Only | |
| SecurityStatus | Workbook | 🔗 GitHub | GitHub Only | |
| SensitiveOperationsinAzureActivityLogReview | Workbook | 🔗 GitHub | GitHub Only | |
| SentinelCosts | Workbook | 🔗 GitHub | GitHub Only | |
| SentinelHealth | Workbook | 🔗 GitHub | GitHub Only | |
| SentinelWorkspaceReconTools | Workbook | 🔗 GitHub | GitHub Only | |
| Sentinel_Central | Workbook | 🔗 GitHub | GitHub Only | |
| SharePointAndOneDrive | Workbook | 🔗 GitHub | GitHub Only | |
| SOCProcessFramework | Workbook | 🔗 GitHub | GitHub Only | |
| SolarWindsPostCompromiseHunting | Workbook | 🔗 GitHub | GitHub Only | |
| SonicWallFirewall | Workbook | 🔗 GitHub | GitHub Only | |
| SophosXGFirewall | Workbook | 🔗 GitHub | GitHub Only | |
| SquadraTechnologiesSecRMM | Workbook | 🔗 GitHub | GitHub Only | |
| SummaryRulesWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| SymantecProxySG | Workbook | 🔗 GitHub | GitHub Only | |
| SymantecVIP | Workbook | 🔗 GitHub | GitHub Only | |
| Syslog-Bifurcation | Workbook | 🔗 GitHub | GitHub Only | |
| syslogoverview | Workbook | 🔗 GitHub | GitHub Only | |
| SysmonThreatHunting | Workbook | 🔗 GitHub | GitHub Only | |
| TalonInsights | Workbook | 🔗 GitHub | GitHub Only | |
| ThreatIntelligence | Workbook | 🔗 GitHub | GitHub Only | |
| TrendMicroDeepSecurityAttackActivity | Workbook | 🔗 GitHub | GitHub Only | |
| TrendMicroDeepSecurityOverview | Workbook | 🔗 GitHub | GitHub Only | |
| TrendMicroXDROverview | Workbook | 🔗 GitHub | GitHub Only | |
| UnifiSG | Workbook | 🔗 GitHub | GitHub Only | |
| UnifiSGNetflow | Workbook | 🔗 GitHub | GitHub Only | |
| usecasemapper | Workbook | 🔗 GitHub | GitHub Only | |
| UserEntityBehaviorAnalytics | Workbook | 🔗 GitHub | GitHub Only | |
| UserMap | Workbook | 🔗 GitHub | GitHub Only | |
| User_Analytics_Workbook | Workbook | 🔗 GitHub | GitHub Only | |
| VeeamDataPlatformMonitoring | Workbook | 🔗 GitHub | GitHub Only | |
| VeeamSecurityActivites | Workbook | 🔗 GitHub | GitHub Only | |
| VeeamSecurityActivities | Workbook | 🔗 GitHub | GitHub Only | |
| VirtualMachinesInsights | Workbook | 🔗 GitHub | GitHub Only | |
| VisualizationDemo | Workbook | 🔗 GitHub | GitHub Only | |
| WatchGuardFireboxWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| WebApplicationFirewallFirewallEvents | Workbook | 🔗 GitHub | GitHub Only | |
| WebApplicationFirewallGatewayAccessEvents | Workbook | 🔗 GitHub | GitHub Only | |
| WebApplicationFirewallOverview | Workbook | 🔗 GitHub | GitHub Only | |
| WebApplicationFirewallWAFTypeEvents | Workbook | 🔗 GitHub | GitHub Only | |
| WindowsAuditChecker | Workbook | 🔗 GitHub | GitHub Only | |
| WindowsFirewall | Workbook | 🔗 GitHub | GitHub Only | |
| WindowsFirewallViaAMA | Workbook | 🔗 GitHub | GitHub Only | |
| WithSecureTopComputersByInfections | Workbook | 🔗 GitHub | GitHub Only | |
| WorkspaceAuditing | Workbook | 🔗 GitHub | GitHub Only | |
| WorkspaceUsage | Workbook | 🔗 GitHub | GitHub Only | |
| ZeroTrustStrategyWorkbook | Workbook | 🔗 GitHub | GitHub Only | |
| ZimperiumWorkbooks | Workbook | 🔗 GitHub | GitHub Only | |
| ZscalerFirewall | Workbook | 🔗 GitHub | GitHub Only | |
| ZscalerOffice365Apps | Workbook | 🔗 GitHub | GitHub Only | |
| ZscalerThreats | Workbook | 🔗 GitHub | GitHub Only | |
| ZscalerWebOverview | Workbook | 🔗 GitHub | GitHub Only | |
| AD4IoT-AutoCloseIncidents | Playbook | 🔗 GitHub | GitHub Only | Author: Amit Sheps |
| AD4IoT-MailByProductionLine | Playbook | 🔗 GitHub | GitHub Only | Author: Amit Sheps |
| AD4IoT-NewAssetServiceNowTicket | Playbook | 🔗 GitHub | GitHub Only | Author: Amit Sheps |
| TritonPlayook | Playbook | 🔗 GitHub | GitHub Only | Author: Amit Sheps and Lior Tamir |
| ADX-health-playbook | Playbook | 🔗 GitHub | GitHub Only | Author: María de Sousa-Valadas <br /> Version: 1.0 |
| AI-Commandline-Analysis | Playbook | 🔗 GitHub | GitHub Only | Author: Curtis Middlehurst |
| Comment-OriginAlertURL | Playbook | 🔗 GitHub | GitHub Only | author: Jordan Ross |
| Comment_RemediationSteps | Playbook | 🔗 GitHub | GitHub Only | authors: Jordan Ross and Nicholas DiCola |
| Comment_RemediationSteps | Playbook | 🔗 GitHub | GitHub Only | authors: Jordan Ross and Nicholas DiCola |
| Create-AzureSnapshot | Playbook | 🔗 GitHub | GitHub Only | This playbook will create a snapshot from an Azure VM. |
| CrowdSecurity-Suspicious-Login-Detection | Playbook | 🔗 GitHub | GitHub Only | This PlayBook / Logic App automatically create an alert when a successful login is performed from a suspicious or malicious IP. |
| Export-Report-CSV | Playbook | 🔗 GitHub | GitHub Only | ---- Author: Matt Egen |
| Fortinet_IncidentEnrichment | Playbook | 🔗 GitHub | GitHub Only | This playbook enriches the incident with address object and address group. |
| Fortinet_ResponseOnIP | Playbook | 🔗 GitHub | GitHub Only | This playbook allows the SOC users to automatically response to Azure Sentinel incidents which includes IPs, by adding/removing the IPs to the Sentinel IP blocked group. Learn more about Threat Intell... |
| Fortinet_ResponseOnURL | Playbook | 🔗 GitHub | GitHub Only | This playbook allows the SOC users to automatically response to Azure Sentinel incidents which includes URL's, by adding the URLs to the Sentinel URL blocked group. Learn more about Threat Intelligenc... |
| Get-AlertEntitiesEnrichment | Playbook | 🔗 GitHub | GitHub Only | author: Sebastien Molendijk - Microsoft |
| UserEnrichment.template | Playbook | 🔗 GitHub | GitHub Only | author: Sebastien Molendijk - Microsoft |
| Get-AlienVault_OTX_V2 | Playbook | 🔗 GitHub | GitHub Only | author: Andrew Blumhardt |
| Get-CompromisedPasswords | Playbook | 🔗 GitHub | GitHub Only | Intent: As an IT admin, I want to be know which users have publicly posted compromised passwords and I want to ensure these passwords and variations of those passwords are not used in my environment. |
| Get-GeoFromIPandTagIncident-EmailAlertBasedonGeo | Playbook | 🔗 GitHub | GitHub Only | Author: Rudi Jubran |
| Get-MachineData-EDR-SOAR-ActionsOnMachine | Playbook | 🔗 GitHub | GitHub Only | author: Kloudynet Technologies |
| Get-MDATPVulnerabilities | Playbook | 🔗 GitHub | GitHub Only | author: Wayne Lee |
| Get-MDEFileActivityWithin30Mins | Playbook | 🔗 GitHub | GitHub Only | author: Dennis Pike |
| Get-MDEProcessActivityWithin30Mins | Playbook | 🔗 GitHub | GitHub Only | author: Dennis Pike |
| C19ImportToSentinel | Playbook | 🔗 GitHub | GitHub Only | Microsoft released threat indicators related to Covid19 as described at https://www.microsoft.com/security/blog/2020/05/14/open-sourcing-covid-threat-intelligence/ |
| C19IndicatorProcessor | Playbook | 🔗 GitHub | GitHub Only | Microsoft released threat indicators related to Covid19 as described at https://www.microsoft.com/security/blog/2020/05/14/open-sourcing-covid-threat-intelligence/ |
| Get-Recipients-EmailMessageID-containing-URL | Playbook | 🔗 GitHub | GitHub Only | author: Dennis Pike |
| Get-VTURLPositivesComment | Playbook | 🔗 GitHub | GitHub Only | author: Dennis Pike |
| Incident-Status-Sync-To-WDATP | Playbook | 🔗 GitHub | GitHub Only | Author: Mahmoud Elsayed |
| Get-SecureScore-Information | Playbook | 🔗 GitHub | GitHub Only | Author: Matt Lowe, Benjamin Kovacevic |
| InfrequentCountryTriage | Playbook | 🔗 GitHub | GitHub Only | author: Sebastien Molendijk - Microsoft |
| Get-NamedLocations | Playbook | 🔗 GitHub | GitHub Only | author: Thijs Lecomte |
| ConnectorHealthApp | Playbook | 🔗 GitHub | GitHub Only | This enhanced solution builds on the existing “Connector Health Workbook” described in this video: [https://www.youtube.com/watch?v=T6Vyo7gZYds] .The Logic App leverages underlying queries to provide ... |
| Sync-Comments-to-M365Defender | Playbook | 🔗 GitHub | GitHub Only | author: Prateek Taneja, Benjamin Kovacevic |
| Update-NamedLocations-TOR | Playbook | 🔗 GitHub | GitHub Only | Intent: As an IT admin, I want to be able to block logins from all TOR Exit Node IP Addresses using Conditional Access. |
| Update-Watchlist-With-NamedLocations | Playbook | 🔗 GitHub | GitHub Only | author: Maria de Sousa-Valadas </br> version: 1.1 |
| Move-LogAnalytics-to-Storage | Playbook | 🔗 GitHub | GitHub Only | ~~Description:~~ ~~This Playbook runs on a daily schedule and moves 89 day old logs per data type to Blob storage in hourly incremements. The result of this Playbook is a structured file explorer with... |
| Azure-Public-IPs | Watchlist | 🔗 GitHub | GitHub Only | |
| DeploymentandMigration | Watchlist | 🔗 GitHub | GitHub Only | |
| ListofTCPUDPPorts | Watchlist | 🔗 GitHub | GitHub Only | |
| NOBELIUM-TI | Watchlist | 🔗 GitHub | GitHub Only | |
| Update-RiskyUserWatchlist | Watchlist | 🔗 GitHub | GitHub Only | |
| UpdateCloudIPs | Watchlist | 🔗 GitHub | GitHub Only | |
| GitLab - Brute-force Attempts | Analytic Rule | 📦 Solution | GitLab | This query relies on GitLab Application Logs to get failed logins to highlight brute-force attempts from different IP addresses in a short space of time. |
| GitLab - External User Added to GitLab | Analytic Rule | 📦 Solution | GitLab | This queries GitLab Application logs to list external user accounts (i.e.: account not in allow-listed domains) which have been added to GitLab users. |
| GitLab - User Impersonation | Analytic Rule | 📦 Solution | GitLab | This queries GitLab Audit Logs for user impersonation. A malicious operator or a compromised admin account could leverage the impersonation feature of GitLab to change code or repository settings bypa... |
| GitLab - Local Auth - No MFA | Analytic Rule | 📦 Solution | GitLab | This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This... |
| GitLab - TI - Connection from Malicious IP | Analytic Rule | 📦 Solution | GitLab | This query correlates Threat Intelligence data from Microsoft Sentinel with GitLab NGINX Access Logs (available in GitLab CE as well) to identify access from potentially TI-flagged IPs. |
| GitLab - Personal Access Tokens creation over time | Analytic Rule | 📦 Solution | GitLab | This queries GitLab Audit Logs for access tokens. Attacker can exfiltrate data from you GitLab repository after gaining access to it by generating or hijacking access tokens. This hunting queries all... |
| GitLab - Repository visibility to Public | Analytic Rule | 📦 Solution | GitLab | This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the ... |
| GitLab - Abnormal number of repositories deleted | Analytic Rule | 📦 Solution | GitLab | This hunting queries identify an unusual increase of repo deletion activities adversaries may want to disrupt availability or compromise integrity by deleting business data. |
| GitLab - SSO - Sign-Ins Burst | Analytic Rule | 📦 Solution | GitLab | This query relies on Microsoft Entra ID sign-in activity when Microsoft Entra ID is used for SSO with GitLab to highlights GitLab accounts associated with multiple authentications from different geogr... |
| GitLabAccess | Parser | 📦 Solution | GitLab | |
| GitLabApp | Parser | 📦 Solution | GitLab | |
| GitLabAudit | Parser | 📦 Solution | GitLab | |
| GSA - TI Domain Entity | Analytic Rule | 📦 Solution | Global Secure Access | This query identifies Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic. |
| GSA - TI IP Entity | Analytic Rule | 📦 Solution | Global Secure Access | This query identifies IP indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic. |
| GSA - TI URL Entity | Analytic Rule | 📦 Solution | Global Secure Access | This query identifies URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic. |
| GSA - Detect Connections Outside Operational Hours | Analytic Rule | 📦 Solution | Global Secure Access | This query identifies connections that occur outside of the defined operational hours. It helps in monitoring and flagging any unusual activity that may occur during non-business hours, indicating pot... |
| GSA - Detect Abnormal Deny Rate for Source to Destination IP | Analytic Rule | 📦 Solution | Global Secure Access | Identifies abnormal deny rate for specific source IP to destination IP based on the normal average and standard deviation learned during a configured period. This can indicate potential exfiltration, ... |
| GSA - Detect Protocol Changes for Destination Ports | Analytic Rule | 📦 Solution | Global Secure Access | Identifies changes in the protocol used for specific destination ports, comparing the current runtime with a learned baseline. This can indicate potential protocol misuse or configuration changes. Con... |
| GSA - Detect Source IP Scanning Multiple Open Ports | Analytic Rule | 📦 Solution | Global Secure Access | Identifies a source IP scanning multiple open ports on Global Secure Access Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that... |
| GSAM365EnrichedEvents | Workbook | 📦 Solution | Global Secure Access | |
| GSAMCPInsights | Workbook | 📦 Solution | Global Secure Access | |
| GSANetworkTraffic | Workbook | 📦 Solution | Global Secure Access | |
| ApigeeX | Parser | 📦 Solution | Google Apigee | |
| ApigeeXV2 | Parser | 📦 Solution | Google Apigee | |
| Unified_ApigeeX | Parser | 📦 Solution | Google Apigee | |
| GCP Audit Logs - Detect Bulk VM Snapshot Deletion | Analytic Rule | 📦 Solution | Google Cloud Platform Audit Logs | Detects bulk deletion of Google Cloud VM snapshots within a short time period, which may indicate data destruction or defense evasion activities. VM snapshots are critical for backup and disaster reco... |
| GCP Audit Logs - Data Access Logging Exemption Added for Principal | Analytic Rule | 📦 Solution | Google Cloud Platform Audit Logs | Detects when a principal (user or service account) is exempted from GCP data access audit logging. This is a critical security event as it reduces visibility into privileged operations and may indicat... |
| GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone | Analytic Rule | 📦 Solution | Google Cloud Platform Audit Logs | Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning atta... |
| GCP Audit Logs - Open Firewall Rule Created or Modified | Analytic Rule | 📦 Solution | Google Cloud Platform Audit Logs | Detects when a Google Cloud Platform firewall rule is created or modified to allow traffic from any source (0.0.0.0/0 or 0.0.0.0). Open firewall rules expose resources to the internet and can signific... |
| GCP Audit Logs - Detect Organization Policy Deletion or Updation | Analytic Rule | 📦 Solution | Google Cloud Platform Audit Logs | Detects when a Google Cloud Platform organization policy is deleted or updated. Organization policies provide centralized control over your organization's cloud resources and help ensure security and... |
| GCP Audit Logs - Storage Bucket Made Public | Analytic Rule | 📦 Solution | Google Cloud Platform Audit Logs | Detects when a Google Cloud Storage bucket is made publicly accessible by granting permissions to allUsers or allAuthenticatedUsers. Making buckets public can expose sensitive data to unauthorized acc... |
| GCP Audit Logs - VPC Flow Logs Disabled | Analytic Rule | 📦 Solution | Google Cloud Platform Audit Logs | Detects when Google Cloud Platform VPC Flow Logs configurations are disabled or deleted. VPC Flow Logs capture information about IP traffic going to and from network interfaces in VPC networks, provid... |
| GCP Audit Logs - List Activities Disabling Data Access Logging for GCP Services | Hunting Query | 📦 Solution | Google Cloud Platform Audit Logs | List all activities where data access logging (ADMIN_READ, DATA_READ, or DATA_WRITE) is disabled for GCP services through IAM policy modifications. |
| GCP Audit Logs - List All GCP Firewall Operations by Principal | Hunting Query | 📦 Solution | Google Cloud Platform Audit Logs | Lists all Google Cloud Platform firewall rule operations performed by principals (users and service accounts). |
| GCP Audit Logs - List GCP Organization Policy Modifications by Principal | Hunting Query | 📦 Solution | Google Cloud Platform Audit Logs | Lists all Google Cloud Platform organization policy deletion and update operations performed by principals (users and service accounts). |
| GCP Audit Logs - List All GCP VPN Tunnels Created | Hunting Query | 📦 Solution | Google Cloud Platform Audit Logs | Lists all Google Cloud VPN tunnel creation operations to identify network connectivity changes and tunnel configurations. |
| GCP Audit Logs - List All GCP VPN Tunnels Deleted | Hunting Query | 📦 Solution | Google Cloud Platform Audit Logs | Lists all Google Cloud VPN tunnel deletion operations to identify network connectivity changes and potential security impacts. |
| Google Cloud Platform BigQuery - Create Wtchlist with BigQuery Table Data | Playbook | 📦 Solution | Google Cloud Platform BigQuery | This playbook can be run from incident context manually or from automation rule to create a watchlist from GCP BigQuery table data. |
| Google Cloud Platform BigQuery - Enrich Incident with BigQuery Table Data | Playbook | 📦 Solution | Google Cloud Platform BigQuery | This playbook can be run from incident context manually or from automation rule to query the GCP BigQuery table and enrich the incident with query results. Query result is filtered based on provided e... |
| Google Cloud Platform BigQuery - Query BigQuery Table | Playbook | 📦 Solution | Google Cloud Platform BigQuery | This playbook can be run from incident context manually or from automation rule to query the GCP BigQuery table and enrich the incident with results. |
| GCP_MONITOR | Parser | 📦 Solution | Google Cloud Platform Cloud Monitoring | |
| GCP Security Command Center - Detect Open/Unrestricted API Keys | Analytic Rule | 📦 Solution | Google Cloud Platform Security Command Center | Detects Google Cloud projects that have API keys with unrestricted API access using Security Command Center API_KEY_APIS_UNRESTRICTED findings. These findings indicate API keys that are not restricted... |
| GCP Security Command Center - Detect projects with API Keys present | Analytic Rule | 📦 Solution | Google Cloud Platform Security Command Center | Detects Google Cloud projects that have API Keys present using Security Command Center API_KEY_EXISTS findings. Projects with API Keys may expose credentials that enable unauthorized access if keys ar... |
| GCP Security Command Center - Detect DNSSEC disabled for DNS zones | Analytic Rule | 📦 Solution | Google Cloud Platform Security Command Center | Detects Google Cloud DNS zones where DNSSEC is disabled using Security Command Center findings (DNSSEC_DISABLED). Disabling DNSSEC increases risk of DNS hijacking and man-in-the-middle attacks. This a... |
| GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports | Analytic Rule | 📦 Solution | Google Cloud Platform Security Command Center | This query detects GCP Firewall rules that allow unrestricted (0.0.0.0/0) ingress to high-risk ports using Google Cloud Security Command Center OPEN_FIREWALL findings. Publicly exposed management, dat... |
| GCP Security Command Center - Detect Resources with Logging Disabled | Analytic Rule | 📦 Solution | Google Cloud Platform Security Command Center | Detects Google Cloud resources where logging is disabled for services like (Cloud Storage buckets, Firewall rules, Cloud DNS networks) based on Google Cloud Security Command Center findings. |
| Identify GCP Service Account with Overly Permissive Roles | Hunting Query | 📦 Solution | Google Cloud Platform Security Command Center | This query identifies Google Cloud Platform (GCP) service accounts with admin privileges using findings from the Security Command Center. |
| Identify Compute VMs with Secure Boot Disabled | Hunting Query | 📦 Solution | Google Cloud Platform Security Command Center | Identifies Google Compute Engine VM instances reported by Security Command Center with Secure Boot disabled (COMPUTE_SECURE_BOOT_DISABLED findings). |
| Identify GCP Instances with Full API Access | Hunting Query | 📦 Solution | Google Cloud Platform Security Command Center | Identifies Google Cloud Platform Compute Engine instances that are configured with the "Allow full access to all Cloud APIs" scope using Security Command Center FULL_API_ACCESS findings. |
| Identify Public GCP Storage Buckets | Hunting Query | 📦 Solution | Google Cloud Platform Security Command Center | Identifies Google Cloud Storage buckets that are publicly accessible using Security Command Center findings (PUBLIC_BUCKET_ACL). |
| Identify GCP User-Managed Service Account Keys | Hunting Query | 📦 Solution | Google Cloud Platform Security Command Center | Identifies user-managed service account keys reported by Security Command Center findings (USER_MANAGED_SERVICE_ACCOUNT_KEY). |
| Google Threat Intelligence - Threat Hunting Domain | Analytic Rule | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence domain correlation. |
| Google Threat Intelligence - Threat Hunting Hash | Analytic Rule | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence hash correlation. |
| Google Threat Intelligence - Threat Hunting IP | Analytic Rule | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence IP correlation. |
| Google Threat Intelligence - Threat Hunting Url | Analytic Rule | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence Url correlation. |
| Google Threat Intelligence - Threat Hunting Domain | Hunting Query | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence domain correlation. |
| Google Threat Intelligence - Threat Hunting Hash | Hunting Query | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence hash correlation. |
| Google Threat Intelligence - Threat Hunting IP | Hunting Query | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence IP correlation. |
| Google Threat Intelligence - Threat Hunting Url | Hunting Query | 📦 Solution | Google Threat Intelligence | Google Threat Intelligence Url correlation. |
| Google Threat Intelligence - IoC Stream | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will ingest Google Threat Intelligence from your IoC Streams into Threat Intelligence Sentinel. |
| Google Threat Intelligence - Threat List | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will ingest Google Threat Intelligence into Threat Intelligence Sentinel. |
| Google Threat Intelligence - IOC Enrichment | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will enrich IP, Hash, URL & Domain entities found in alerts. |
| Google Threat Intelligence - IOC Enrichment | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will enrich IP, Hash, URL & Domain entities found in incidents. |
| Google Threat Intelligence - Domain Enrichment | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will enrich Domain entities. |
| Google Threat Intelligence - FileHash Enrichment | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will enrich FileHash entities. |
| Google Threat Intelligence - IP Enrichment | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will enrich IP entities. |
| Google Threat Intelligence - URL Enrichment | Playbook | 📦 Solution | Google Threat Intelligence | This playbook will enrich URL entities. |
| Google DNS - CVE-2021-40444 exploitation | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects CVE-2021-40444 exploitation. |
| Google DNS - Possible data exfiltration | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects possible data exfiltration. |
| Google DNS - Exchange online autodiscover abuse | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects possible Exchange online autodiscover abuse. |
| Google DNS - IP check activity | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects requests to ip lookup resources. |
| Google DNS - Request to dynamic DNS service | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects requests to ip lookup resources. |
| Google DNS - Malicous Python packages | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects requests to resources with malicious Python packages. |
| Google DNS - Multiple errors for source | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects multiple errors for the same source IP address. |
| Google DNS - Multiple errors to same domain | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects multiple errors to same domain. |
| Google DNS - CVE-2021-34527 (PrintNightmare) external exploit | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects CVE-2021-34527 (PrintNightmare) external exploit |
| Google DNS - CVE-2020-1350 (SIGRED) exploitation pattern | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects exploitation pattern of CVE-2020-1350 (SIGRED) vulnerability. |
| Google DNS - UNC2452 (Nobelium) APT Group activity | Analytic Rule | 📦 Solution | GoogleCloudPlatformDNS | Detects UNC2452 (Nobelium) APT Group activity. |
| Google DNS - Errors | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for DNS requests with errors. |
| Google DNS - Requests to IP lookup resources | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for requests to IP lookup resources. |
| Google DNS - Requests to online shares | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for requests to online/cloud shares. |
| Google DNS - Rare domains | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for requests rare domains. |
| Google DNS - Domains with rare errors | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for Domains with rare errors. |
| Google DNS - Requests to TOR resources | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for requests to TOR resources. |
| Google DNS - Server latency | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for server latency. |
| Google DNS - Sources with high number of errors | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for sources with high number of errors. |
| Google DNS - Unexpected top level domains | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for unexpected TLDs. |
| Google DNS - Unusual top level domains | Hunting Query | 📦 Solution | GoogleCloudPlatformDNS | Query searches for unusual TLDs. |
| GCPDNS | Workbook | 📦 Solution | GoogleCloudPlatformDNS | |
| GCPCloudDNS | Parser | 📦 Solution | GoogleCloudPlatformDNS | |
| GCP IAM - Disable Data Access Logging | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects when Data Access Logging is disabled. |
| GCP IAM - Empty user agent | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects requests where user agent is empty. |
| GCP IAM - High privileged role added to service account | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects when high privileged role was added to service account. |
| GCP IAM - New Authentication Token for Service Account | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects when new authentication token is created for service account. |
| GCP IAM - New Service Account | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects new service account creation. |
| GCP IAM - New Service Account Key | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects new service account key creation. |
| GCP IAM - Privileges Enumeration | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects possible privileges enumeration. |
| GCP IAM - Publicly exposed storage bucket | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects possible misconfiguration for bucket policy making it publicly available. |
| GCP IAM - Service Account Enumeration | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects possible service account enumeration. |
| GCP IAM - Service Account Keys Enumeration | Analytic Rule | 📦 Solution | GoogleCloudPlatformIAM | Detects possible service account keys enumeration. |
| GCP IAM - Changed roles | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for roles' modifications. |
| GCP IAM - Deleted service accounts | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for service accounts deleted for the last 24 hours. |
| GCP IAM - Disabled service accounts | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for service accounts disabled for the last 24 hours. |
| GCP IAM - New custom roles | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for new custom roles created for the last 24 hours. |
| GCP IAM - New service accounts | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for new service accounts created for the last 24 hours. |
| GCP IAM - New service account keys | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for new service accounts keys created for the last 24 hours. |
| GCP IAM - Rare IAM actions | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for rare IAM actions by users. |
| GCP IAM - Rare user agent | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for rare user agents. |
| GCP IAM - Top service accounts by failed actions | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for service accounts with top failed actions count. |
| GCP IAM - Top source IP addresses with failed actions | Hunting Query | 📦 Solution | GoogleCloudPlatformIAM | Query searches for source IP addresses with top failed actions count. |
| GCP_IAM | Workbook | 📦 Solution | GoogleCloudPlatformIAM | |
| GCP-DisableServiceAccountFromTeams | Playbook | 📦 Solution | GoogleCloudPlatformIAM | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Sends an adaptive card to the Teams channel where the analyst can choose an action to be ta... |
| GCP-DisableServiceAccountKey | Playbook | 📦 Solution | GoogleCloudPlatformIAM | Once a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. [Disables Service Account Key](https://cloud.google.com/iam/docs/reference/rest/v1/projects... |
| GCP-EnrichServiseAccountInfo | Playbook | 📦 Solution | GoogleCloudPlatformIAM | Once a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. [Gets service Account Information](https://cloud.google.com/iam/docs/reference/rest/v1/proj... |
| GCP_IAM | Parser | 📦 Solution | GoogleCloudPlatformIAM | |
| Google Directory - Enrich Incident With User Info 🔍 | Playbook | 📦 Solution | GoogleDirectory | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets users from the incident. 2. [Obtains information about user.](https://develo... |
| Google Directory - Sign Out User 🔍 | Playbook | 📦 Solution | GoogleDirectory | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets users from the incident. 2. [Signs out users.](https://developers.google.com... |
| Google Directory - Suspend User 🔍 | Playbook | 📦 Solution | GoogleDirectory | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets users from the incident. 2. Sends an adaptive card to the Teams channel wher... |
| GWorkspace - Admin permissions granted | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Triggers on admin permissions granted. |
| GWorkspace - Alert events | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Detects alert events. |
| GWorkspace - API Access Granted | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Triggers when API Access has been granted to a new client. |
| GWorkspace - User access has been changed | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Detects user access change. |
| GWorkspace - Multiple user agents for single source | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Detects requests with different user agents from one source in short timeframe. |
| GWorkspace - An Outbound Relay has been added to a G Suite Domain | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Detects outbound relays may be added to collect email. |
| GWorkspace - Possible brute force attack | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Detects possible brute force attack. |
| GWorkspace - Possible maldoc file name in Google drive | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Detects possible maldoc file name in Google drive. |
| GWorkspace - Two-step authentification disabled for a user | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Triggers on two-step authentification disabled for a user. |
| GWorkspace - Unexpected OS update | Analytic Rule | 📦 Solution | GoogleWorkspaceReports | Detects unexpected OS update. |
| GWorkspace - Document Copied from Share Drive to Private Drive 🔍 | Hunting Query | 📦 Solution | GoogleWorkspaceReports | This hunting query searches for document copy activity from shared drive to a private drive, potential sign of data exfiltration. https://www.mitiga.io/blog/mitiga-security-advisory-lack-of-forensic-v... |
| GWorkspace - Document shared externally | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches document shared externally. |
| GWorkspace - Document shared publicy in web | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches document shared publicy in web. |
| GWorkspace - Document shared publicy with link | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches document shared publicy with link. |
| GWorkspace - License Revoke and Assignment to User 🔍 | Hunting Query | 📦 Solution | GoogleWorkspaceReports | This hunting query searches for license revoke and assignment in quick succession to user, potential sign of data exfiltration. https://www.mitiga.io/blog/mitiga-security-advisory-lack-of-forensic-vis... |
| GWorkspace - Multi IP addresses by user | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches users with multi IP addresses. |
| GWorkspace - Possible SCAM/SPAM or Phishing via Calendar | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches possible SCAM/SPAM or phishing via calendar. |
| GWorkspace - Rare document types by users | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches rare document types by users. |
| GWorkspace - Shared private document | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches shared private document. |
| GWorkspace - Suspended users | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches suspended users. |
| GWorkspace - Uncommon user agent strings | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches uncommon user agent strings. |
| GWorkspace - Unknown login type | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches unknown login type. |
| GWorkspace - User reported calendar invite as spam | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches calendar invites used to deliver spam. This query shows results when user reports a calander invite as spam. |
| GWorkspace - Users with several devices | Hunting Query | 📦 Solution | GoogleWorkspaceReports | Query searches users with several devices. |
| GoogleWorkspace | Workbook | 📦 Solution | GoogleWorkspaceReports | |
| GWorkspaceActivityReports | Parser | 📦 Solution | GoogleWorkspaceReports | |
| GreyNoise TI Map IP Entity to CommonSecurityLog | Analytic Rule | 📦 Solution | GreyNoiseThreatIntelligence | This query maps GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in CommonSecurityLog. |
| GreyNoise TI Map IP Entity to DnsEvents | Analytic Rule | 📦 Solution | GreyNoiseThreatIntelligence | This query maps any IP indicators of compromise (IOCs) from GreyNoise Threat Intelligence (TI), by searching for matches in DnsEvents. |
| GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema) | Analytic Rule | 📦 Solution | GreyNoiseThreatIntelligence | This rule identifies a match Network Sessions for which the source or destination IP address is a known GreyNoise IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-i... |
| GreyNoise TI map IP entity to OfficeActivity | Analytic Rule | 📦 Solution | GreyNoiseThreatIntelligence | This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in OfficeActivity. |
| GreyNoise TI Map IP Entity to SigninLogs | Analytic Rule | 📦 Solution | GreyNoiseThreatIntelligence | This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs. |
| GreyNoiseOverview | Workbook | 📦 Solution | GreyNoiseThreatIntelligence | |
| GIBIndicatorProcessor 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_APT_ThreatActor 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_APT_Threats 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Attacks_ddos 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Attacks_deface 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Attacks_phishing 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Attacks_phishing_kit 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_BP_phishing 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_BP_phishing_kit 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Compromised_account 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Compromised_card 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Compromised_imei 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Compromised_mule 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_HI_Threat 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_HI_Threat_Actor 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Malware_cnc 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Malware_Targeted_Malware 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_OSI_GitLeak 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_OSI_PublicLeak 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_OSI_Vulnerability 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Suspicious_ip_open_proxy 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Suspicious_ip_socks_proxy 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| GIBTIA_Suspicious_ip_tor_node 🔍 | Playbook | 📦 Solution | Group-IB | Author: Hesham Saad |
| HIPAACompliance | Workbook | 📦 Solution | HIPAA Compliance | |
| HYASInsight Enrich Incident By C2Attribution Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with C2Attribution information. |
| HYASInsight Enrich Incident By DynamicDNS Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with Dynamic DNS information. |
| HYASInsight Enrich Incident By Malware Sample Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with Malware Sample information. |
| HYASInsight Enrich Incident By OS Indicator Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with By OS Indicator information. |
| HYASInsight Enrich Incident By Passive Hash Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with By Passive Hash information. |
| HYASInsight Enrich Incident By SSL Certificate Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with By SSL Certificate information. |
| HYASInsight Enrich Incident By WHOIS Current Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with By WHOIS Current information. |
| HYASInsight Enrich Incident By WHOIS Info | Playbook | 📦 Solution | HYAS | This playbook enriches hosts asscociated with an incident with By WHOIS information. |
| HYASInsight Enrich Incident By C2 Attribution | Playbook | 📦 Solution | HYAS | This playbook enriches emails asscociated with an incident with By C2 Attribution information. |
| HYASInsight Enrich Incident By Dynamic DNS | Playbook | 📦 Solution | HYAS | This playbook enriches emails asscociated with an incident with By Dynamic DNS information. |
| HYASInsight Enrich Incident By WHOIS | Playbook | 📦 Solution | HYAS | This playbook enriches emails asscociated with an incident with By WHOIS information. |
| HYASInsight Enrich Incident By C2 Attribution | Playbook | 📦 Solution | HYAS | This playbook enriches file hashes asscociated with an incident with By C2 Attribution information. |
| HYASInsight Enrich Incident By Malware Information | Playbook | 📦 Solution | HYAS | This playbook enriches file hashes asscociated with an incident with by malware information. |
| HYASInsight Enrich Incident By OS Indicator Information | Playbook | 📦 Solution | HYAS | This playbook enriches file hashes asscociated with an incident with by os indicator information. |
| HYASInsight Enrich Incident By C2 Attribution Information | Playbook | 📦 Solution | HYAS | This playbook enriches file hashes asscociated with an incident with ssl_certificate information. |
| HYASInsight Enrich Incident By C2 Attribution Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by c2 attribution information. |
| HYASInsight Enrich Incident By Dynamic DNS Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by dynamic dns information. |
| HYASInsight Enrich Incident By Geo Location Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by geo location information. |
| HYASInsight Enrich Incident By Sample Data Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by sample information. |
| HYASInsight Enrich Incident By OS Indicator Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by os indicator information. |
| HYASInsight Enrich Incident By Passive DNS Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by passivedns information. |
| HYASInsight Enrich Incident By Passive Hash Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by passivehash information. |
| HYASInsight Enrich Incident By SinkHole Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by sinkhole information. |
| HYASInsight Enrich Incident By SSL Certificate Information | Playbook | 📦 Solution | HYAS | This playbook enriches ip addresses asscociated with an incident with by ssl certificate information. |
| HYASInsight Enrich Incident By WHOIS Info | Playbook | 📦 Solution | HYAS | This playbook enriches phone numbers asscociated with an incident with WHOIS information. |
| HYASProtectDNS | Parser | 📦 Solution | HYAS Protect | |
| ibossMalwareAndC2 | Workbook | 📦 Solution | iboss | |
| ibossWebUsage | Workbook | 📦 Solution | iboss | |
| ibossUrlEvent | Parser | 📦 Solution | iboss | |
| IllumioCoreEvent | Parser | 📦 Solution | Illumio Core | |
| Illumio VEN Clone Detection Rule | Analytic Rule | 📦 Solution | IllumioSaaS | Create Microsoft Sentinel Incident When A Cloned Ven Is Detected |
| Illumio VEN Deactivated Detection Rule | Analytic Rule | 📦 Solution | IllumioSaaS | Create Microsoft Sentinel Incident When Ven Goes Into Deactivated state |
| Illumio Enforcement Change Analytic Rule | Analytic Rule | 📦 Solution | IllumioSaaS | Create Microsoft Sentinel Incident When Ven Changes Enforcement State from Full/Selective To Idle/Visibility state |
| Illumio Firewall Tampering Analytic Rule | Analytic Rule | 📦 Solution | IllumioSaaS | Create Microsoft Sentinel Incident When Firewall Is Tampered With |
| Illumio VEN Offline Detection Rule | Analytic Rule | 📦 Solution | IllumioSaaS | Create Microsoft Sentinel Incident When Ven Goes Into Offline state |
| Illumio VEN Suspend Detection Rule | Analytic Rule | 📦 Solution | IllumioSaaS | Create Microsoft Sentinel Incident When Ven Goes Into Suspended state |
| IllumioAuditableEvents | Workbook | 📦 Solution | IllumioSaaS | |
| IllumioFlowData | Workbook | 📦 Solution | IllumioSaaS | |
| IllumioOnPremHealth | Workbook | 📦 Solution | IllumioSaaS | |
| IllumioWorkloadsStats | Workbook | 📦 Solution | IllumioSaaS | |
| Illumio Get Ven Details Playbook | Playbook | 📦 Solution | IllumioSaaS | This playbook leverages Illumio workloads API to enrich IP, Hostname and Labels, found in Microsoft Sentinel alerts. <img src="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/I... |
| Illumio Containment Switch Playbook | Playbook | 📦 Solution | IllumioSaaS | This playbook leverages Illumio workloads API to contain and isolate a workload based on user inputs. <img src="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/IllumioSaaS/Play... |
| Illumio Workload Quarantine Playbook | Playbook | 📦 Solution | IllumioSaaS | This playbook leverages Illumio workloads API to quarantine a workload based on user inputs. <img src="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/IllumioSaaS/Playbooks/Ill... |
| IllumioSyslogAuditEvents | Parser | 📦 Solution | IllumioSaaS | |
| IllumioSyslogNetworkTrafficEvents | Parser | 📦 Solution | IllumioSaaS | |
| Illusive-SentinelIncident-Enrichment 🔍 | Playbook | 📦 Solution | Illusive Active Defense | <p align="left"> <img width="300" height="100" src="./Images/logo.jpg"> </a> </p> |
| Illusive-SentinelIncident-Response 🔍 | Playbook | 📦 Solution | Illusive Active Defense | <p align="left"> <img width="300" height="100" src="./Images/logo.jpg"> </a> </p> |
| Illusive Incidents Analytic Rule | Analytic Rule | 📦 Solution | Illusive Platform | Create a Microsoft Sentinel incident upon a new Illusive alert (incident) and associate all related Illusive events to the relevant Microsoft Sentinel alert. This is done by filtering and processing I... |
| IllusiveADS | Workbook | 📦 Solution | Illusive Platform | |
| IllusiveASM | Workbook | 📦 Solution | Illusive Platform | |
| Imperva - Abnormal protocol usage | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects abnormal protocol usage. |
| Imperva - Request from unexpected IP address to admin panel | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects requests from unexpected IP addresses to admin panel. |
| Imperva - Critical severity event not blocked | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects when critical severity event was not blocked. |
| Imperva - Possible command injection | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects requests with commands in URI. |
| Imperva - Request from unexpected countries | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects request attempts from unexpected countries. |
| Imperva - Forbidden HTTP request method in request | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects connections with unexpected HTTP request method. |
| Imperva - Malicious Client | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects connections from known malicious clients. |
| Imperva - Malicious user agent | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects requests containing known malicious user agent strings. |
| Imperva - Multiple user agents from same source | Analytic Rule | 📦 Solution | ImpervaCloudWAF | 'Detects suspicious number of user agents from the same IP address. |
| Imperva - Request to unexpected destination port | Analytic Rule | 📦 Solution | ImpervaCloudWAF | Detects request attempts to unexpected destination ports. |
| Imperva - Top destinations with blocked requests | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches destination IP addresses requests to which were blocked by the service. |
| Imperva - Applications with insecure web protocol version | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for with insecure web protocol version. |
| Imperva - Non HTTP/HTTPs applications | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for non HTTP/HTTPs applications. |
| Imperva - Rare applications | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for rare application protocols. |
| Imperva - Rare client applications | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for rare client applications used. |
| Imperva - Rare destination ports | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for requests for rare destination ports. |
| Imperva - request from known bots | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for requests from known bots. |
| Imperva - Top sources with blocked requests | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches source IP addresses with blocked requests. |
| Imperva - Top applications with error requests | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for top applications with protocol or network errors. |
| Imperva - Top sources with error requests | Hunting Query | 📦 Solution | ImpervaCloudWAF | Query searches for top source IP addresses with protocol or network errors. |
| Imperva WAF Cloud Overview | Workbook | 📦 Solution | ImpervaCloudWAF | |
| ImpervaWAFCloud | Parser | 📦 Solution | ImpervaCloudWAF | |
| Infoblox - SOC Insight Detected - API Source | Analytic Rule | 📦 Solution | Infoblox | Infoblox SOC Insight detected in logs sourced via REST API. Customize scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxInsi... |
| Infoblox - SOC Insight Detected - CDC Source | Analytic Rule | 📦 Solution | Infoblox | Infoblox SOC Insight detected in logs sourced via Infoblox CDC. Customize scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**Infoblox... |
| Infoblox_Lookup_Workbook | Workbook | 📦 Solution | Infoblox | |
| Infoblox_Workbook | Workbook | 📦 Solution | Infoblox | |
| Infoblox-Block-Allow-IP-Domain | Playbook | 📦 Solution | Infoblox | The playbook will add/remove IP or Domain value in Named List of Infoblox. |
| Infoblox-Block-Allow-IP-Domain-Incident-Based | Playbook | 📦 Solution | Infoblox | The playbook will add / remove IP or Domain values in Named List that available in incidents of Infoblox. |
| Infoblox-Config-Insight-Details | Playbook | 📦 Solution | Infoblox | The playbook retrieves Config Insight Details Data and ingests it into a custom table within the Log Analytics Workspace on an on-demand basis from the Workbook. |
| Infoblox-Config-Insights | Playbook | 📦 Solution | Infoblox | The playbook retrieves Config Insight Data and ingests it into a custom table within the Log Analytics Workspace on a scheduled basis. |
| Infoblox-Data-Connector-Trigger-Sync | Playbook | 📦 Solution | Infoblox | Playbook to sync timer trigger of all Infoblox data connectors. |
| Infoblox-DHCP-Lookup | Playbook | 📦 Solution | Infoblox | The playbook will retrieve IP entities from an incident, search for related DHCP data in a table, and if found, add the DHCP lookup data as a comment on the incident. |
| Infoblox-Get-Host-Name | Playbook | 📦 Solution | Infoblox | The playbook will fetch the data from 'Hosts' API and ingest it into custom table |
| Infoblox-Get-IP-Space-Data | Playbook | 📦 Solution | Infoblox | The playbook will fetch the data from 'IP Space' API and ingest it into custom table |
| Infoblox-Get-Service-Name | Playbook | 📦 Solution | Infoblox | This playbook will fetch the data from 'Services' API and ingest it into custom table |
| Infoblox-IPAM-Lookup | Playbook | 📦 Solution | Infoblox | The playbook will retrieve IP entities from an incident, call an API to obtain IPAM lookup data, and add this data, along with IP space and subnet information, as a comment on the incident. |
| Infoblox-SOC-Get-Insight-Details | Playbook | 📦 Solution | Infoblox | Leverages the Infoblox SOC Insights API to enrich a Microsoft Sentinel Incident triggered by an Infoblox SOC Insight & ingest Insight details into custom InfobloxInsight tables. The tables are used to... |
| Infoblox-SOC-Get-Open-Insights-API | Playbook | 📦 Solution | Infoblox | Leverages the Infoblox SOC Insights API to ingest all Open/Active SOC Insights at time of run into the custom InfobloxInsight table. This playbook is scheduled to run on a daily basis. |
| Infoblox-SOC-Import-Indicators-TI | Playbook | 📦 Solution | Infoblox | Imports each Indicator of a Microsoft Sentinel Incident triggered by an Infoblox SOC Insight into the ThreatIntelligenceIndicator table. You must run the Infoblox-SOC-Get-Insight-Details playbook on a... |
| Infoblox-TIDE-Lookup | Playbook | 📦 Solution | Infoblox | The playbook fetches TIDE lookup data for the provided entity type and value. |
| Infoblox-TIDE-Lookup-Via-Incident | Playbook | 📦 Solution | Infoblox | The playbook takes entity type and value from incident available in Workbook and ingests TIDE Lookup data for that entity into Log table. |
| Infoblox-TIDE-Lookup-Comment-Enrichment | Playbook | 📦 Solution | Infoblox | The playbook enrich an incident by adding TIDE Lookup information as comment on an incident. |
| Infoblox-TimeRangeBased-DHCP-Lookup | Playbook | 📦 Solution | Infoblox | The playbook will retrieve IP entities from an incident, search for related DHCP data in a table for a apecified time range, and if found, add the DHCP lookup data as a comment on the incident. |
| InfobloxCDC_SOCInsights | Parser | 📦 Solution | Infoblox | |
| InfobloxInsight | Parser | 📦 Solution | Infoblox | |
| InfobloxInsightAssets | Parser | 📦 Solution | Infoblox | |
| InfobloxInsightComments | Parser | 📦 Solution | Infoblox | |
| InfobloxInsightEvents | Parser | 📦 Solution | Infoblox | |
| InfobloxInsightIndicators | Parser | 📦 Solution | Infoblox | |
| Infoblox - Data Exfiltration Attack | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called ... |
| Infoblox - High Threat Level Query Not Blocked Detected | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | At least 1 high threat level query generated by single host in 1 hour that is not blocked or redirected. Customize query count, scheduling, responses and more. This rule depends on a parser based on a... |
| Infoblox - Many High Threat Level Queries From Single Host Detected | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser base... |
| Infoblox - Many High Threat Level Single Query Detected | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | Single high threat level domain queried at least 200 times in 1 hour regardless of source. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Functio... |
| Infoblox - Many NXDOMAIN DNS Responses Detected | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule de... |
| Infoblox - TI - CommonSecurityLog Match Found - MalwareC2 | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | CommonSecurityLog (CEF) MalwareC2/MalwareC2DGA match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat prope... |
| Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | InfobloxCDC Lookalike Domain match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. ... |
| Infoblox - TI - Syslog Match Found - URL | Analytic Rule | 📦 Solution | Infoblox Cloud Data Connector | Syslog URL match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. |
| InfobloxCDCB1TDWorkbook | Workbook | 📦 Solution | Infoblox Cloud Data Connector | |
| Infoblox Import AISCOMM Weekly | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all indicators from the AISCOMM data provider on a scheduled... |
| Infoblox Import Emails Weekly | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected emails on a scheduled weekly basis. |
| Infoblox Import Hashes Weekly | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected hashes on a scheduled weekly basis. |
| Infoblox Import Hosts Daily Lookalike Domains | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Lookalike domains on a scheduled daily basis. |
| Infoblox Import Hosts Daily MalwareC2DGA | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected MalwareC2DGA domains on a scheduled daily bas... |
| Infoblox Import Hosts Daily Phishing | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Phishing domains on a scheduled daily basis. |
| Infoblox Import Hosts Hourly | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected hosts on a scheduled hourly basis. |
| Infoblox Import IPs Hourly | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected IPs on a scheduled hourly basis. |
| Infoblox Import URLs Hourly | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected URLs on a scheduled hourly basis. |
| Infoblox Incident Enrichment Domains | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Leverages the Infoblox TIDE API to enrich Microsoft Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on dem... |
| Infoblox Incident Send Email | Playbook | 📦 Solution | Infoblox Cloud Data Connector | Sends a detailed email when an incident occurs. Optionally enriches an applicable entity within the email with Infoblox TIDE data. This playbook can be configured to run automatically when an incident... |
| InfobloxCDC | Parser | 📦 Solution | Infoblox Cloud Data Connector | |
| Excessive NXDOMAIN DNS Queries | Analytic Rule | 📦 Solution | Infoblox NIOS | This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. |
| Potential DHCP Starvation Attack | Analytic Rule | 📦 Solution | Infoblox NIOS | This creates an incident in the event that an excessive amount of DHCPREQUEST have been recieved by a DHCP Server and could potentially be an indication of a DHCP Starvation Attack. |
| Infoblox-Workbook-V2 | Workbook | 📦 Solution | Infoblox NIOS | |
| Infoblox | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_allotherdhcpdTypes | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_allotherdnsTypes | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_allotherlogTypes | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpack | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpadded | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpbindupdate | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpdiscover | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpexpire | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpinform | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpoffer | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpoption | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpother | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcprelease | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpremoved | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcprequest | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcpsession | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dhcp_consolidated | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dnsclient | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dnsgss | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dnszone | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox_dns_consolidated | Parser | 📦 Solution | Infoblox NIOS | |
| Infoblox - SOC Insight Detected - API Source | Analytic Rule | 📦 Solution | Infoblox SOC Insights | Infoblox SOC Insight detected in logs sourced via REST API. Customize scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxInsi... |
| Infoblox - SOC Insight Detected - CDC Source | Analytic Rule | 📦 Solution | Infoblox SOC Insights | Infoblox SOC Insight detected in logs sourced via Infoblox CDC. Customize scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**Infoblox... |
| InfobloxSOCInsightsWorkbook | Workbook | 📦 Solution | Infoblox SOC Insights | |
| Infoblox SOC Get Insight Details | Playbook | 📦 Solution | Infoblox SOC Insights | Leverages the Infoblox SOC Insights API to enrich a Microsoft Sentinel Incident triggered by an Infoblox SOC Insight & ingest Insight details into custom InfobloxInsight tables. The tables are used to... |
| Infoblox SOC Get Open Insights API | Playbook | 📦 Solution | Infoblox SOC Insights | Leverages the Infoblox SOC Insights API to ingest all Open/Active SOC Insights at time of run into the custom InfobloxInsight table. This playbook is scheduled to run on a daily basis. |
| Infoblox SOC Import Indicators TI | Playbook | 📦 Solution | Infoblox SOC Insights | Imports each Indicator of a Microsoft Sentinel Incident triggered by an Infoblox SOC Insight into the ThreatIntelligenceIndicator table. You must run the Infoblox-SOC-Get-Insight-Details playbook on a... |
| InfobloxCDC_SOCInsights | Parser | 📦 Solution | Infoblox SOC Insights | |
| InfobloxInsight | Parser | 📦 Solution | Infoblox SOC Insights | |
| InfobloxInsightAssets | Parser | 📦 Solution | Infoblox SOC Insights | |
| InfobloxInsightComments | Parser | 📦 Solution | Infoblox SOC Insights | |
| InfobloxInsightEvents | Parser | 📦 Solution | Infoblox SOC Insights | |
| InfobloxInsightIndicators | Parser | 📦 Solution | Infoblox SOC Insights | |
| Atlassian Beacon Alert | Analytic Rule | 📦 Solution | Integration for Atlassian Beacon | The analytic rule creates an incident when an alert is created in Atlassian Beacon. The incident's events contains values such as alert name, alert url, actor name, actor details, worskpace id of the ... |
| Atlassian Beacon Integration | Playbook | 📦 Solution | Integration for Atlassian Beacon | This Logic App recieves a webhook from Atlassian Beacon and ingest the payload into Microsoft Sentinel's log analytics workspace |
| [Deprecated] Intel 471 Malware Intelligence to Graph Security | Playbook | 📦 Solution | Intel471 | This playbook ingests malware indicators from Intel 471's Titan API into Microsoft Graph Security as tiIndicator resource type. |
| Intel 471 Malware Intelligence to Sentinel | Playbook | 📦 Solution | Intel471 | This playbook ingests malware indicators from Intel 471's Titan or Verity API into Microsoft Sentinel as tiIndicator resource type. |
| High Urgency IONIX Action Items | Analytic Rule | 📦 Solution | IONIX | This query creates an alert for active IONIX Action Items with high urgency (9-10). Urgency can be altered using the "min_urgency" variable in the query. |
| IONIXOverviewWorkbook | Workbook | 📦 Solution | IONIX | |
| Denial of Service (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect attacks that would prevent the use or proper operation of a DCS system including Denial of Service events. |
| Excessive Login Attempts (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect excessive login attempts that may indicate improper service configuration, human error, or malicious activity on the network such as a cyber threat atte... |
| Firmware Updates (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect unauthorized firmware updates that may indicate malicious activity on the network such as a cyber threat that attempts to manipulate PLC firmware to com... |
| High bandwidth in the network (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect an unusually high bandwidth which may be an indication of a new service/process or malicious activity on the network. An example scenario is a cyber thr... |
| Illegal Function Codes for ICS traffic (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect Illegal function codes in SCADA equipment indicating improper application configuration or malicious activity such using illegal values within a protoco... |
| No traffic on Sensor Detected (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect that a sensor can no longer detect the network traffic, which indicates that the system is potentially insecure. |
| PLC unsecure key state (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect PLC operating mode changes indicating the PLC is potentially insecure. If the PLC is compromised, devices that interact with it may be impacted. This ma... |
| Internet Access (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect an OT device communicating with Internet which is possibly an indication of improper configuration of an application or malicious activity on the networ... |
| Suspicious malware found in the network (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect IoT/OT malware found on the network indicating possible attempts to compromise production systems. |
| Multiple scans in the network (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect multiple scans on the network indicating new devices, functionality, application misconfiguration, or malicious reconnaissance activity on the network. |
| PLC Stop Command (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect PLC stop commands which could indicate improper configuration or malicious activity on the network such as a threat manipulating PLC programming to affe... |
| Unauthorized device in the network (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect a new device indicating a legitimate device recently installed on the network or an indication of malicious activity such as a cyber threat attempting t... |
| Unauthorized DHCP configuration in the network (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect an unauthorized DHCP configuration indicating a possible unauthorized device configuration. |
| Unauthorized PLC changes (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect unauthorized changes to PLC ladder logic code indicating new functionality in the PLC, improper configuration of an application, or malicious activity o... |
| Unauthorized remote access to the network (Microsoft Defender for IoT) | Analytic Rule | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This alert leverages Defender for IoT to detect unauthorized remote access to network devices, if another device on the network is compromised, target devices can be accessed remotely, increasing the ... |
| IoTOTThreatMonitoringwithDefenderforIoT | Workbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | |
| AD4IoT-AutoAlertStatusSync | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | This playbook updates alert statuses in Defender for IoT whenever a related alert in Microsoft Sentinel has a Status update. |
| AD4IoT-AutoCloseIncidents | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | In some cases, maintenance activities generate alerts in Microsoft Sentinel which distracts the SOC team from handling the real problems. This playbook allows to input the time period in which the mai... |
| AD4IoT-AutoTriageIncident | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | SOC and OT engineers can stream their workflows using the playbook, which automatically updates the incident severity based on the devices involved in the incident and their importance. |
| AD4IoT-CVEAutoWorkflow | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | The playbook automates the SOC workflow by automatically enriching incident comments with the CVEs of the involved devices based on Defender for IoT data. An automated triage is performed if the CVE i... |
| Get-AD4IoTDeviceCVEs - Incident 🔍 | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | For each IoT device entity included in the alert, this playbook will get CVEs from the Azure Defender for IoT Sensor. |
| AD4IoT-MailByProductionLine | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | The following playbook will send mail to notify specific stake holders. One example can be in the case of specific security team per product line or per physical location. This playbook requires a wat... |
| AD4IoT-NewAssetServiceNowTicket | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | Normally, the authorized entity to program a PLC is the Engineering Workstation, to program a PLC attackers might create a new Engineering Workstation to create malicious programing. The following pla... |
| AD4IoT-SendEmailtoIoTOwner | Playbook | 📦 Solution | IoTOTThreatMonitoringwithDefenderforIoT | The playbooks automate the SOC workflow by automatically emailing the incident details to the right IoT/OT device owner (based on Defender for IoT dafinition) and allowing him to respond by email. The... |
| Enrich-Sentinel-IPQualityScore-Email-Address-Reputation | Playbook | 📦 Solution | IPQualityScore | This playbook uses the IPQS Fraud and Risk Scoring connector to automatically enrich Email Addresses found in the Sentinel incidents. This Playbook Template provides the Reputation such as **Critical,... |
| Enrich-Sentinel-IPQualityScore-IP-Address-Reputation | Playbook | 📦 Solution | IPQualityScore | This playbook uses the IPQS Fraud and Risk Scoring connector to automatically enrich IP Addresses found in the Sentinel incidents. This Playbook Template provides the Reputation such as **Critical, Hi... |
| Enrich-Sentinel-IPQualityScore-Phone-Number-Reputation | Playbook | 📦 Solution | IPQualityScore | This playbook uses the IPQS Fraud and Risk Scoring connector to automatically enrich Phone Numbers found in the Sentinel incidents. This Playbook Template provides the Reputation such as **High Risk, ... |
| Enrich-Sentinel-IPQualityScore-URL-Reputation | Playbook | 📦 Solution | IPQualityScore | This playbook uses the IPQS Fraud and Risk Scoring connector to automatically enrich URL's found in the Sentinel incidents. This Playbook Template provides the Reputation such as **Critical, High Risk... |
| Enrich_Sentinel_IPQualityScore_Domain_Reputation | Playbook | 📦 Solution | IPQualityScore | This playbook uses the IPQS Fraud and Risk Scoring connector to automatically enrich Domain's found in the Sentinel incidents. This Playbook Template provides the Reputation such as **Critical, High R... |
| Create Incidents from IronDefense | Analytic Rule | 📦 Solution | IronNet IronDefense | Creates incidents based on behavioral detections from IronDefense. |
| IronDefenseAlertDashboard | Workbook | 📦 Solution | IronNet IronDefense | |
| IronDefenseAlertDetails | Workbook | 📦 Solution | IronNet IronDefense | |
| IronNet_UpdateIronDefenseAlerts 🔍 | Playbook | 📦 Solution | IronNet IronDefense | author: IronNet |
| IronNet_UpdateSentinelIncidents 🔍 | Playbook | 📦 Solution | IronNet IronDefense | author: IronNet |
| IronNet_Validate_IronNet_API 🔍 | Playbook | 📦 Solution | IronNet IronDefense | author: IronNet |
| ISCBind | Parser | 📦 Solution | ISC Bind | |
| IslandAdminAuditOverview | Workbook | 📦 Solution | Island | |
| IslandUserActivityOverview | Workbook | 📦 Solution | Island | |
| IvantiUEMEvent | Parser | 📦 Solution | Ivanti Unified Endpoint Management | |
| Jamf Protect - Alerts | Analytic Rule | 📦 Solution | Jamf Protect | Creates an incident based on Jamf Protect Alert data in Microsoft Sentinel |
| Jamf Protect - Network Threats | Analytic Rule | 📦 Solution | Jamf Protect | Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts. |
| Jamf Protect - Unified Logs | Analytic Rule | 📦 Solution | Jamf Protect | Creates an informational incident based on Jamf Protect Unified Log data in Microsoft Sentinel |
| JamfProtectDashboard | Workbook | 📦 Solution | Jamf Protect | |
| Jamf Protect - Set Alert to In Progress | Playbook | 📦 Solution | Jamf Protect | This Jamf Protect Playbook can be used manually or in a Automation Rule to change the state of the Alert in Jamf Protect itself, in an automated way you can mirror the state from a Microsoft Sentinel ... |
| Jamf Protect - Set Alert to Resolved | Playbook | 📦 Solution | Jamf Protect | This Jamf Protect Playbook can be used manually or in a Automation Rule to change the state of the Alert in Jamf Protect itself, in an automated way you can mirror the state from a Microsoft Sentinel ... |
| Jamf Protect - Remote lock computer with Jamf Pro | Playbook | 📦 Solution | Jamf Protect | This Playbook can be used manually or in a Automation Rule to send an remote MDM command with Jamf Pro to lock the computer with an randomised 6 digit passcode. |
| JamfProtectAlerts | Parser | 📦 Solution | Jamf Protect | |
| JamfProtectNetworkTraffic | Parser | 📦 Solution | Jamf Protect | |
| JamfProtectTelemetry | Parser | 📦 Solution | Jamf Protect | |
| JamfProtectThreatEvents | Parser | 📦 Solution | Jamf Protect | |
| JamfProtectUnifiedLogs | Parser | 📦 Solution | Jamf Protect | |
| JBossEvent | Parser | 📦 Solution | JBoss | |
| JoeSandbox File Analyis | Playbook | 📦 Solution | JoeSandbox | Submits a attachment or set of attachment associated with an office 365 email to JoeSandbox for Analyis. |
| JoeSandbox URL Analyis | Playbook | 📦 Solution | JoeSandbox | Submits a url or set of urls associated with an incident to JoeSandbox for Analyis. |
| Joshua Import To Sentinel | Playbook | 📦 Solution | Joshua-Cyberiskvision | Joshua Cyberiskvision provides two main use cases: Get Indicators and Alert Enrichment. |
| Joshua Indicators Processor DOMAIN | Playbook | 📦 Solution | Joshua-Cyberiskvision | Joshua Cyberiskvision provides two main use cases: Get Indicators and Alert Enrichment. |
| Joshua Indicators Processor EMAIL | Playbook | 📦 Solution | Joshua-Cyberiskvision | Joshua Cyberiskvision provides two main use cases: Get Indicators and Alert Enrichment. |
| Joshua Indicators Processor FILE | Playbook | 📦 Solution | Joshua-Cyberiskvision | Joshua Cyberiskvision provides two main use cases: Get Indicators and Alert Enrichment. |
| Joshua Indicators Processor IP | Playbook | 📦 Solution | Joshua-Cyberiskvision | Joshua Cyberiskvision provides two main use cases: Get Indicators and Alert Enrichment. |
| Joshua Indicators Processor URL | Playbook | 📦 Solution | Joshua-Cyberiskvision | Joshua Cyberiskvision provides two main use cases: Get Indicators and Alert Enrichment. |
| Joshua Intel Enrichment File | Playbook | 📦 Solution | Joshua-Cyberiskvision | These playbooks use the Joshua Cyberiskvision threat intelligence to automatically enrich incidents generated by Microsoft Sentinel. From the analyst perspective, it is important that the alert contai... |
| Joshua Intel Enrichment IP | Playbook | 📦 Solution | Joshua-Cyberiskvision | These playbooks use the Joshua Cyberiskvision threat intelligence to automatically enrich incidents generated by Microsoft Sentinel. From the analyst perspective, it is important that the alert contai... |
| Joshua Intel Enrichment URL | Playbook | 📦 Solution | Joshua-Cyberiskvision | These playbooks use the Joshua Cyberiskvision threat intelligence to automatically enrich incidents generated by Microsoft Sentinel. From the analyst perspective, it is important that the alert contai... |
| JuniperSRX | Parser | 📦 Solution | Juniper SRX | |
| JuniperIDP | Parser | 📦 Solution | JuniperIDP | |
| Keeper Security - Password Changed | Analytic Rule | 📦 Solution | Keeper Security | Creates an informational incident based on Keeper Security Password Changed data in Microsoft Sentinel |
| Keeper Security - User MFA Changed | Analytic Rule | 📦 Solution | Keeper Security | Creates an informational incident based on Keeper Security User MFA Changed data in Microsoft Sentinel |
| KeeperSecurityDashboard | Workbook | 📦 Solution | Keeper Security | |
| KnowBe4 Defend - Dangerous Attachment Detected | Analytic Rule | 📦 Solution | KnowBe4 Defend | Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox. |
| KnowBe4 Defend - Dangerous Link Click | Analytic Rule | 📦 Solution | KnowBe4 Defend | Defend has detected a user has clicked a dangerous link in their mailbox. |
| Dangerous emails with links clicked | Hunting Query | 📦 Solution | KnowBe4 Defend | This will check for emails that Defend has identified as dangerous and a user has clicked a link. |
| KnowBe4DefendMetrics | Workbook | 📦 Solution | KnowBe4 Defend | |
| DefendAuditData | Parser | 📦 Solution | KnowBe4 Defend | |
| AdvancedKQL | Workbook | 📦 Solution | KQL Training | |
| IntrotoKQL | Workbook | 📦 Solution | KQL Training | |
| Employee account deleted | Analytic Rule | 📦 Solution | Lastpass Enterprise Activity Monitoring | This rule will monitor for any employee accounts being deleted. Deleting an employee account can have a big potential impact as all of the data for that user will be removed. |
| Failed sign-ins into LastPass due to MFA | Analytic Rule | 📦 Solution | Lastpass Enterprise Activity Monitoring | This rule will check if a sign-in failed into LastPass due to MFA. An incident can indicate the potential brute forcing of a LastPass account. The use of MFA is identified by combining the sign-in lo... |
| Highly Sensitive Password Accessed | Analytic Rule | 📦 Solution | Lastpass Enterprise Activity Monitoring | This rule will monitor access to highly sensitive passwords. Within the Watchlist called 'LastPass' define passwords which are deemed highly sensitive (such as password to a high privileged applicatio... |
| TI map IP entity to LastPass data | Analytic Rule | 📦 Solution | Lastpass Enterprise Activity Monitoring | Identifies a match in LastPass table from any IP IOC from TI |
| Unusual Volume of Password Updated or Removed | Analytic Rule | 📦 Solution | Lastpass Enterprise Activity Monitoring | This rule will check if there is an unnormal activity of sites that are deleted or changed per user. The normal amount of actions is calculated based on the previous 14 days of activity. If there is ... |
| Failed sign-ins into LastPass due to MFA. | Hunting Query | 📦 Solution | Lastpass Enterprise Activity Monitoring | This will check for sign-ins into LastPass which are not confirmed using MFA based on the Sign-in Logs |
| Login into LastPass from a previously unknown IP. | Hunting Query | 📦 Solution | Lastpass Enterprise Activity Monitoring | This query will check how many activity there is in LastPass from IPs that are not seen before in the Sign-in Logs |
| Password moved to shared folders | Hunting Query | 📦 Solution | Lastpass Enterprise Activity Monitoring | This query will check for data that is shared in the LastPass environment. |
| LastPassWorkbook | Workbook | 📦 Solution | Lastpass Enterprise Activity Monitoring | |
| HighlySensitivePasswords | Watchlist | 📦 Solution | Lastpass Enterprise Activity Monitoring | |
| Dev-0056 Command Line Activity November 2021 | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This hunting query looks for process command line activity related to activity observed by Dev-0056.The command lines this query hunts for are used as part of the threat actor's post exploitation acti... |
| Dev-0322 Command Line Activity November 2021 (ASIM Version) | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This query hunts for command line activity linked to Dev-0322's compromise of ZOHO ManageEngine ADSelfService Plus software. It focuses on commands used in post-exploitation activity. Hosts with highe... |
| Dev-0322 Command Line Activity November 2021 | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This query hunts for command line activity linked to Dev-0322's compromise of ZOHO ManageEngine ADSelfService Plus software. It focuses on commands used in post-exploitation activity. Hosts with highe... |
| Dev-0322 File Drop Activity November 2021 (ASIM Version) | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This query hunts for file creation events linked to Dev-0322's compromise of ZOHO ManageEngine ADSelfService Plus software. It focuses on files dropped during post-exploitation activity. Hosts with hi... |
| Dev-0322 File Drop Activity November 2021 | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This query hunts for file creation events linked to Dev-0322's compromise of ZOHO ManageEngine ADSelfService Plus software. It focuses on files dropped during post-exploitation activity. Hosts with hi... |
| Retrospective hunt for Forest Blizzard IP IOCs | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | Matches domain name IOCs related to Forest Blizzard group activity with CommonSecurityLog and SecurityAlert dataTypes. The query is scoped in the time window that these IOCs were active. |
| Connection from external IP to OMI related Ports | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This query detects attempts to exploit OMI vulnerability (CVE-2021-38647) by identifying external IP connections to management ports (5985,5986,1270). It uses the imNetworkSession schema and other log... |
| Nylon Typhoon Command Line Activity November 2021 | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This query hunts for Nylon Typhoon-related activity, specifically data collection and staging. It looks for use of tools like xcopy and renamed archiving tools on hosts with observed signatures. |
| Known Nylon Typhoon Registry modifications patterns | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | This query identifies instances where malware intentionally configures the browser settings for its use by modifying the following registry entries by Nylon Typhoon threat actor. |
| SolarWinds Inventory | Hunting Query | 📦 Solution | Legacy IOC based Threat Protection | Beyond your internal software management systems, it is possible you may not have visibility into your entire footprint of SolarWinds installations. This query helps discover any systems that have Sol... |
| Lookout - Critical Audit and Policy Changes (v2) | Analytic Rule | 📦 Solution | Lookout | Monitors critical audit events and policy changes from Lookout Mobile Risk API v2. Detects unauthorized configuration changes, policy modifications, security setting adjustments, and administrative ac... |
| Lookout - Device Compliance and Security Status Changes (v2) | Analytic Rule | 📦 Solution | Lookout | Monitors device compliance status changes and security posture degradation using Lookout Mobile Risk API v2 enhanced device fields. Detects devices becoming non-compliant, security status changes, and... |
| Lookout - Critical Smishing and Phishing Alerts (v2) | Analytic Rule | 📦 Solution | Lookout | Detects critical smishing (SMS phishing) and phishing alerts from Lookout Mobile Risk API v2. This rule identifies sophisticated social engineering attacks including CEO fraud, credential harvesting, ... |
| Lookout - New Threat events found. | Analytic Rule | 📦 Solution | Lookout | Created to detect new Threat events from the data which is recently synced by Lookout Solution. |
| Lookout - High Severity Mobile Threats Detected (v2) | Analytic Rule | 📦 Solution | Lookout | Detects high severity mobile threats from Lookout Mobile Risk API v2 with enhanced threat intelligence and device context. This rule leverages the comprehensive v2 field set to provide detailed threat... |
| Lookout Advanced Threat Hunting - Multi-Vector Attacks | Hunting Query | 📦 Solution | Lookout | Identifies devices experiencing multiple threat types within a short timeframe, indicating coordinated attacks |
| LookoutEvents | Workbook | 📦 Solution | Lookout | |
| LookoutEventsV2 | Workbook | 📦 Solution | Lookout | |
| LookoutExecutiveDashboard | Workbook | 📦 Solution | Lookout | |
| LookoutIOAInvestigationDashboard | Workbook | 📦 Solution | Lookout | |
| LookoutSecurityInvestigationDashboard | Workbook | 📦 Solution | Lookout | |
| LookoutEvents | Parser | 📦 Solution | Lookout | |
| LookoutCSActivities | Parser | 📦 Solution | Lookout Cloud Security Platform for Microsoft Sentinel | |
| LookoutCSAnomalies | Parser | 📦 Solution | Lookout Cloud Security Platform for Microsoft Sentinel | |
| LookoutCSViolations | Parser | 📦 Solution | Lookout Cloud Security Platform for Microsoft Sentinel | |
| Lumen TI domain in DnsEvents | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query searches for matches between Lumen threat intelligence domain indicators and DnsEvents. |
| Lumen TI IPAddress in CommonSecurityLog | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in CommonSecurityLog. |
| Lumen TI IPAddress in DeviceEvents | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in DeviceEvents. |
| Lumen TI IPAddress in IdentityLogonEvents | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in Azure AD sign-in logs. |
| Lumen TI IPAddress in OfficeActivity | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in OfficeActivity. |
| Lumen TI IPAddress in SecurityEvents | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SecurityEvents. |
| Lumen TI IPAddress in SigninLogs | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs. |
| Lumen TI IPAddress in WindowsEvents | Analytic Rule | 📦 Solution | Lumen Defender Threat Feed | This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in WindowsEvents. |
| Lumen TI IPAddress indicator in CommonSecurityLog | Hunting Query | 📦 Solution | Lumen Defender Threat Feed | This query searches for matches between Lumen threat intelligence IPAddress indicators and security log events. |
| Lumen-Threat-Feed-Overview | Workbook | 📦 Solution | Lumen Defender Threat Feed | |
| MailGuard 365 - High Confidence Threats 🔍 | Hunting Query | 📦 Solution | MailGuard 365 | Query searches for high confidence threats stopped by MailGuard 365. |
| MailGuard 365 - Malware Threats 🔍 | Hunting Query | 📦 Solution | MailGuard 365 | Query searches for malware threats stopped by MailGuard 365. |
| MailGuard 365 - Phishing Threats 🔍 | Hunting Query | 📦 Solution | MailGuard 365 | Query searches for phishing threats stopped by MailGuard 365. |
| MailGuard365Dashboard 🔍 | Workbook | 📦 Solution | MailGuard 365 | |
| Detect Malicious Usage of Recovery Tools to Delete Backup Files | Analytic Rule | 📦 Solution | Malware Protection Essentials | This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies a... |
| Detect Print Processors Registry Driver Key Creation/Modification | Analytic Rule | 📦 Solution | Malware Protection Essentials | This analytic rule detects any registry value creation or modification of print processor registry Driver key. This will load the executable at startup with print spooler service. This could be an ind... |
| Detect Registry Run Key Creation/Modification | Analytic Rule | 📦 Solution | Malware Protection Essentials | This analytic rule detects any registry value or key creation in the registry run keys. This could be an indication of a persistence attempt by an adversary. |
| Process Creation with Suspicious CommandLine Arguments | Analytic Rule | 📦 Solution | Malware Protection Essentials | This analytic rule detects process creation events with base64 encoded command line arguments. This could be an indication of a malicious process being executed. |
| Detect Windows Allow Firewall Rule Addition/Modification | Analytic Rule | 📦 Solution | Malware Protection Essentials | This analytic rule detects any registry value creation or modification of Windows firewall registry keys to allow network traffic. This could be an indication of defense evasion by an adversary to all... |
| Detect Windows Update Disabled from Registry | Analytic Rule | 📦 Solution | Malware Protection Essentials | This analytic rule detects any registry value creation or modification of Windows Update registry keys to disable Windows Update. This could be an indication of defense evasion by an adversary on a co... |
| Executable Files Created in Uncommon Locations | Hunting Query | 📦 Solution | Malware Protection Essentials | This analytic rule detects any executable file creation in uncommon locations like temproray folders. This could be an indication of a persistence or defese evasion attempt by an adversary. |
| Detect File Creation in Startup Folder | Hunting Query | 📦 Solution | Malware Protection Essentials | This hunting query detects when a file is created in the Startup folder. This is a common technique used by adversaries to maintain persistence on a system. |
| Detect Files with Ramsomware Extensions | Hunting Query | 📦 Solution | Malware Protection Essentials | This hunting query identifies cretion of files with ransomware extensions. Ransomware file extensions are defined in a watchlist named RansomwareFileExtensions. |
| Detect New Scheduled Task Creation that Run Executables From Non-Standard Location | Hunting Query | 📦 Solution | Malware Protection Essentials | This hunting query identifies new scheduled task created, to run executables from uncommon location like temp folders. Malware often creates scheduled tasks to execute malicious code and maintain pers... |
| Detect New Scheduled Task Entry Creations | Hunting Query | 📦 Solution | Malware Protection Essentials | This hunting query identifies new scheduled task entry creations. Malware often creates scheduled tasks to execute malicious code and maintain persistence on a system. |
| Detect Modification to System Files or Directories by User Accounts | Hunting Query | 📦 Solution | Malware Protection Essentials | This hunting query searches for modifications to system files or directories by a non system account (User Account). |
| MalwareProtectionEssentialsWorkbook | Workbook | 📦 Solution | Malware Protection Essentials | |
| RansomwareFileExtensions | Watchlist | 📦 Solution | Malware Protection Essentials | |
| MarkLogicAudit | Parser | 📦 Solution | MarkLogicAudit | |
| M2131_AssetStoppedLogging | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is designed to monitor assets within the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when a monitored asset fails to provide a heartbeat within 24 hours. |
| M2131_DataConnectorAddedChangedRemoved | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is designed to monitor data connector configurations. This alert is triggered when a data connector is added, updated, or deleted. |
| M2131_EventLogManagementPostureChanged_EL0 | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is desinged to monitor Azure policies aligned with the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when EL0 policy compliance falls below 70% within a 1 w... |
| M2131_EventLogManagementPostureChanged_EL1 | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is desinged to monitor Azure policies aligned with the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when EL1 policy compliance falls below 70% within a 1 w... |
| M2131_EventLogManagementPostureChanged_EL2 | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is desinged to monitor Azure policies aligned with the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when EL2 policy compliance falls below 70% within a 1 w... |
| M2131_EventLogManagementPostureChanged_EL3 | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is desinged to monitor Azure policies aligned with the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when EL3 policy compliance falls below 70% within a 1 w... |
| M2131_LogRetentionLessThan1Year | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is designed to monitor log retention within the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when a log analytics workspace in active storage is configured... |
| M2131_RecommendedDatatableUnhealthy | Analytic Rule | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert is designed to monitor recommended data tables aligned to the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when a recommended data table hasn't been observ... |
| M2131_RecommendedDatatableNotLogged_EL0 | Hunting Query | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert audits your logging architecture for recommended data tables aligned to Event Logging (EL0) of the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when recomm... |
| M2131_RecommendedDatatableNotLogged_EL1 | Hunting Query | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert audits your logging architecture for recommended data tables aligned to Basic Event Logging (EL1) of the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when ... |
| M2131_RecommendedDatatableNotLogged_EL2 | Hunting Query | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert audits your logging architecture for recommended data tables aligned to Intermediate Event Logging (EL2) of the Maturity Model for Event Log Management (M-21-31) standard. The alert trigger... |
| M2131_RecommendedDatatableNotLogged_EL3 | Hunting Query | 📦 Solution | MaturityModelForEventLogManagementM2131 | This alert audits your logging architecture for recommended data tables aligned to Advanced Event Logging (EL3) of the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers wh... |
| MaturityModelForEventLogManagement_M2131 | Workbook | 📦 Solution | MaturityModelForEventLogManagementM2131 | |
| Notify-LogManagementTeam | Playbook | 📦 Solution | MaturityModelForEventLogManagementM2131 | This Security Orchestration, Automation, & Response (SOAR) capability is designed for configuration with the solution's analytics rules. When analytics rules trigger this automation notifies the log m... |
| Create-AzureDevOpsTask | Playbook | 📦 Solution | MaturityModelForEventLogManagementM2131 | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| Create Jira Issue | Playbook | 📦 Solution | MaturityModelForEventLogManagementM2131 | This playbook will open a Jira Issue when a new incident is opened in Microsoft Sentinel. |
| McAfee ePO - Agent Handler down | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when AgentHandler is down. |
| McAfee ePO - Error sending alert | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when error sending alert occurs. |
| McAfee ePO - Attempt uninstall McAfee agent | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects attempts uninstalling McAfee agent on host. |
| McAfee ePO - Deployment failed | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when errors occur during deployment new changes/policies. |
| McAfee ePO - File added to exceptions | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when file was added to exception list on a host. |
| McAfee ePO - Firewall disabled | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when firewall was disabled from Mctray. |
| McAfee ePO - Logging error occurred | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when logging errors on agent. |
| McAfee ePO - Multiple threats on same host | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Rule fires when multiple threat events were detected on the same host. |
| McAfee ePO - Scanning engine disabled | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when OAS scanning engine was disabled. |
| McAfee ePO - Spam Email detected | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when email was marked as spam. |
| McAfee ePO - Task error | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when task error occurs. |
| McAfee ePO - Threat was not blocked | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when a threat was not blocked on a host. |
| McAfee ePO - Unable to clean or delete infected file | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when McAfee failed to clean or delete infected file. |
| McAfee ePO - Update failed | Analytic Rule | 📦 Solution | McAfee ePolicy Orchestrator | Detects when update failed event occurs on agent. |
| McAfee ePO - Agent Errors | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for error events from McAfee agents. |
| McAfee ePO - Applications blocked or contained | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for blocked or contained applications. |
| McAfee ePO - Email Treats | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for email related threat events. |
| McAfee ePO - Infected files by source | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for infected files which were detected. |
| McAfee ePO - Infected Systems | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for infected systems based on scan results. |
| McAfee ePO - Long term infected systems | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for infected systems which were not cleaned for long term. |
| McAfee ePO - Sources with multiple threats | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for sources with several different threats. |
| McAfee ePO - Objects not scanned | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for unscanned objects. |
| McAfee ePO - Scan Errors | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for scan error events. |
| McAfee ePO - Threats detected and not blocked, cleaned or deleted | Hunting Query | 📦 Solution | McAfee ePolicy Orchestrator | Query searches for events where threats were detected and not blocked, cleaned or deleted. |
| McAfeeePOOverview | Workbook | 📦 Solution | McAfee ePolicy Orchestrator | |
| McAfeeEPOEvent | Parser | 📦 Solution | McAfee ePolicy Orchestrator | |
| McAfeeNSPEvent | Parser | 📦 Solution | McAfee Network Security Platform | |
| Exchange AuditLog Disabled | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies when the exchange audit logging has been disabled which may be an adversary attempt to evade detection or avoid other defenses. |
| Accessed files shared by temporary external user | Analytic Rule | 📦 Solution | Microsoft 365 | This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This migh... |
| External user added and removed in short timeframe | Analytic Rule | 📦 Solution | Microsoft 365 | This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour. |
| Possible Forest Blizzard attempted credential harvesting - Sept 2020 🔍 | Analytic Rule | 📦 Solution | Microsoft 365 | This analytic rule is retired because IoCs are outdated. It is recommended to use Microsoft Entra ID Solution's Analytic rules instead to detect credential harvesting attempts. |
| Exchange workflow MailItemsAccessed operation anomaly | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies anomalous increases in Exchange mail items accessed operations. The query leverages KQL built-in anomaly detection algorithms to find large deviations from baseline patterns. Sudden increas... |
| Mail redirect via ExO transport rule | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies when Exchange Online transport rule configured to forward emails. This could be an adversary mailbox configured to collect mail from multiple user accounts. |
| Malicious Inbox Rule | Analytic Rule | 📦 Solution | Microsoft 365 | Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords. This is done so as to limit ability to warn compromised users that they've be... |
| Multiple Teams deleted by a single user | Analytic Rule | 📦 Solution | Microsoft 365 | This detection flags the occurrences of deleting multiple teams within an hour. This data is a part of Office 365 Connector in Microsoft Sentinel. |
| Multiple users email forwarded to same destination | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies when multiple (more than one) users mailboxes are configured to forward to the same destination. This could be an attacker-controlled destination mailbox configured to collect mail from mu... |
| Office Policy Tampering | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies if any tampering is done to either auditlog, ATP Safelink, SafeAttachment, AntiPhish or Dlp policy. An adversary may use this technique to evade detection or avoid other policy based defen... |
| New executable via Office FileUploaded Operation | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive. List currently includes 'exe', 'inf', 'gzip', 'cmd', 'bat' file extensions. Additionally, identif... |
| Rare and potentially high-risk Office operations | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies Office operations that are typically rare and can provide capabilities useful to attackers. |
| SharePointFileOperation via previously unseen IPs | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compare... |
| SharePointFileOperation via devices with previously unseen user agents | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25). |
| Office365 Sharepoint File transfer above threshold | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies Office365 Sharepoint File Transfers above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array... |
| Office365 Sharepoint File transfer Folders above threshold | Analytic Rule | 📦 Solution | Microsoft 365 | Identifies Office365 Sharepoint File Transfers with distinct folder count above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is... |
| Anomalous access to other users' mailboxes | Hunting Query | 📦 Solution | Microsoft 365 | Looks for users accessing multiple other users' mailboxes or accessing multiple folders in another users mailbox. |
| Exes with double file extension and access summary | Hunting Query | 📦 Solution | Microsoft 365 | Provides a summary of executable files with double file extensions in SharePoint and the users and IP addresses that have accessed them. |
| External user added and removed in a short timeframe | Hunting Query | 📦 Solution | Microsoft 365 | This hunting query identifies external user accounts that are added to a Team and then removed within one hour. |
| External user from a new organisation added to Teams | Hunting Query | 📦 Solution | Microsoft 365 | This query identifies external users added to Teams where the user's domain is not one previously seen in Teams data. |
| Mail redirect via ExO transport rule | Hunting Query | 📦 Solution | Microsoft 365 | Identifies when Exchange Online transport rule configured to forward emails. This could be an adversary mailbox configured to collect mail from multiple user accounts. |
| Multiple Teams deleted by a single user | Hunting Query | 📦 Solution | Microsoft 365 | This hunting query identifies where multiple Teams have been deleted by a single user in a short timeframe. |
| Multiple users email forwarded to same destination | Hunting Query | 📦 Solution | Microsoft 365 | Identifies when multiple (more than one) users mailboxes are configured to forward to the same destination. This could be an attacker-controlled destination mailbox configured to collect mail from mu... |
| Bots added to multiple teams | Hunting Query | 📦 Solution | Microsoft 365 | This hunting query helps identify bots added to multiple Teams in a short space of time. |
| User made Owner of multiple teams | Hunting Query | 📦 Solution | Microsoft 365 | This hunting query identifies users who have been made Owner of multiple Teams. |
| Previously unseen bot or application added to Teams | Hunting Query | 📦 Solution | Microsoft 365 | This hunting query helps identify new, and potentially unapproved applications or bots being added to Teams. |
| New Admin account activity seen which was not seen historically | Hunting Query | 📦 Solution | Microsoft 365 | This will help you discover any new admin account activity which was seen and were not seen historically. Any new accounts seen in the results can be validated and investigated for any suspicious acti... |
| SharePointFileOperation via previously unseen IPs | Hunting Query | 📦 Solution | Microsoft 365 | Shows SharePoint upload/download volume by IPs with high-risk ASNs. New IPs with volume spikes may be unauthorized and exfiltrating documents. |
| SharePointFileOperation via devices with previously unseen user agents | Hunting Query | 📦 Solution | Microsoft 365 | Tracking via user agent is one way to differentiate between types of connecting device. In homogeneous enterprise environments the user agent associated with an attacker device may stand out as unusua... |
| New Windows Reserved Filenames staged on Office file services | Hunting Query | 📦 Solution | Microsoft 365 | This identifies new Windows Reserved Filenames on Office services like SharePoint and OneDrive in the past 7 days. It also detects when a user uploads these files to another user's workspace, which ma... |
| Non-owner mailbox login activity | Hunting Query | 📦 Solution | Microsoft 365 | Finds non-owner mailbox access by admin/delegate permissions. Whitelist valid users and check others for unauthorized access. |
| Office Mail Forwarding - Hunting Version | Hunting Query | 📦 Solution | Microsoft 365 | Adversaries often abuse email-forwarding rules to monitor victim activities, steal information, and gain intelligence on the victim or their organization. This query highlights cases where user mail i... |
| PowerShell or non-browser mailbox login activity | Hunting Query | 📦 Solution | Microsoft 365 | Detects mailbox login from Exchange PowerShell. All accounts can use it by default, but admins can change it. Whitelist benign activities. |
| SharePointFileOperation via clientIP with previously unseen user agents | Hunting Query | 📦 Solution | Microsoft 365 | New user agents associated with a clientIP for SharePoint file uploads/downloads. |
| Files uploaded to teams and access summary | Hunting Query | 📦 Solution | Microsoft 365 | This hunting queries identifies files uploaded to SharePoint via a Teams chat and summarizes users and IP addresses that have accessed these files. This allows for identification of anomolous file sh... |
| User added to Teams and immediately uploads file | Hunting Query | 📦 Solution | Microsoft 365 | This hunting queries identifies users who are added to a Teams Channel or Teams chat and within 1 minute of being added upload a file via the chat. This might be an indicator of suspicious activity. |
| Windows Reserved Filenames staged on Office file services | Hunting Query | 📦 Solution | Microsoft 365 | This identifies Windows Reserved Filenames on Office services like SharePoint and OneDrive. It also detects when a user uploads these files to another user's workspace, which may indicate malicious ac... |
| ExchangeOnline | Workbook | 📦 Solution | Microsoft 365 | |
| Office365 | Workbook | 📦 Solution | Microsoft 365 | |
| SharePointAndOneDrive | Workbook | 📦 Solution | Microsoft 365 | |
| Dataverse - Anomalous application user activity | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies anomalies in activity patterns of Dataverse application (non-interactive) users, based on activity falling outside the normal pattern of use. |
| Dataverse - Audit log data deletion | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies audit log data deletion activity in Dataverse. |
| Dataverse - Audit logging disabled | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies a change in system audit configuration whereby audit logging is turned off. |
| Dataverse - Bulk record ownership re-assignment or sharing | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies individual record ownership changes including sharing of records with other users/teams or re-assignment of ownership exceeding a pre-defined threshold. |
| Dataverse - Executable uploaded to SharePoint document management site | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies executable files and scripts uploaded to SharePoint sites used for Dynamics document management, circumventing native file extension restrictions in Dataverse. |
| Dataverse - Export activity from terminated or notified employee | Analytic Rule | 📦 Solution | Microsoft Business Applications | This query identifies Dataverse export activity triggered by terminated, or employees about to leave the organization. This analytics rule uses the TerminatedEmployees watchlist template. |
| Dataverse - Guest user exfiltration following Power Platform defense impairment | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies a chain of events starting with disablement of Power Platform tenant isolation and removal of an environment's access security group. These events are correlated with Dataverse exfiltration... |
| Dataverse - Hierarchy security manipulation | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies suspicious behaviors in hierarchy security including: - Hierarchy security disabled. - User assigns themselves as a manager. - User assigns themselves to a monitored position. |
| Dataverse - Honeypot instance activity | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies activities in a predefined Honeypot Dataverse instance. Alerts when either sign-in to the Honeypot is detected or when monitored Dataverse tables in the Honeypot are accessed. Note: Requir... |
| Dataverse - Login by a sensitive privileged user | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies Dataverse and Dynamics 365 logons by sensitive users. |
| Dataverse - Login from IP in the block list | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies Dataverse sign-in activity from IPv4 addresses which are on a predefined block list. Blocked network ranges are maintained in the NetworkAddresses watchlist template. |
| Dataverse - Login from IP not in the allow list | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies logons from IPv4 addresses not matching IPv4 subnets maintained on an allow list. This analytics rule uses the NetworkAddresses watchlist template. |
| Dataverse - Malware found in SharePoint document management site | Analytic Rule | 📦 Solution | Microsoft Business Applications | This query identifies malware uploaded via Dynamics 365 document management or directly in SharePoint impacting Dataverse associated SharePoint sites. |
| Dataverse - Mass deletion of records | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies large scale record delete operations based on a predefined threshold and also detects scheduled bulk deletion jobs. |
| Dataverse - Mass download from SharePoint document management | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies mass download (in the last hour) of files from SharePoint sites configured for document management in Dynamics 365. This analytics rule utilizes the MSBizApps-Configuration watchlist to ide... |
| Dataverse - Mass export of records to Excel | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies users exporting a large amount of records from Dynamics 365 to Excel, significantly more records exported than any other recent activity by that user. Large exports from users with no recen... |
| Dataverse - Mass record updates | Analytic Rule | 📦 Solution | Microsoft Business Applications | This query detects mass record update changes in Dataverse and Dynamics 365, exceeding a pre-defined threshold. |
| Dataverse - New Dataverse application user activity type | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies new or previously unseen activity types associated with Dataverse application (non-interactive) user. |
| Dataverse - New non-interactive identity granted access | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies API level access grants, either via the delegated permissions of a Microsoft Entra application or direct assignment within Dataverse as an application user. |
| Dataverse - New sign-in from an unauthorized domain | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies Dataverse sign-in activity originating from users with UPN suffixes that have not been seen previously in the last 14 days and are not present on a predefined list of authorized domains. Co... |
| Dataverse - New user agent type that was not used before | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies users accessing Dataverse from a User Agent that has not been seen in any Dataverse instance in the last 14 days. |
| Dataverse - New user agent type that was not used with Office 365 | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies users accessing Dynamics with a User Agent that has not been seen in any Office 365 workloads in the last 14 days. |
| Dataverse - Organization settings modified | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies changes made at organization level in the Dataverse environment. |
| Dataverse - Removal of blocked file extensions | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies modifications to an environment's blocked file extensions and extracts the removed extension. |
| Dataverse - SharePoint document management site added or updated | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies modifications of SharePoint document management integration. Document management allows storage of data located externally to Dataverse. Combine this analytics rule with the MSBizApps-Add-S... |
| Dataverse - Suspicious security role modifications | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies an unusual pattern of events whereby a new role is created followed by the creator adding members to the role and subsequently removing the member or deleting the role after a short time pe... |
| Dataverse - Suspicious use of TDS endpoint | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies Dataverse TDS (Tabular Data Stream) protocol based queries where the source user or IP address has recent security alerts and the TDS protocol has not been used previously in the target env... |
| Dataverse - Suspicious use of Web API | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies sign-in across multiple Dataverse environments, breaching a predefined threshold, originating from a user with IP address that was used to sign-into the well known Microsoft Entra app regis... |
| Dataverse - Terminated employee exfiltration over email | Analytic Rule | 📦 Solution | Microsoft Business Applications | This query identifies Dataverse exfiltration via email by terminated employees. |
| Dataverse - Terminated employee exfiltration to USB drive | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies files downloaded from Dataverse by departing or terminated employees which are copied to USB mounted drives. |
| Dataverse - TI map IP to DataverseActivity | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies a match in DataverseActivity from any IP IOC from Microsoft Sentinel Threat Intelligence. |
| Dataverse - TI map URL to DataverseActivity | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies a match in DataverseActivity from any URL IOC from Microsoft Sentinel Threat Intelligence. |
| Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies previously unseen IP and user agents in a Dataverse instance following disabling of cookie binding protection. See https://docs.microsoft.com/power-platform/admin/block-cookie-replay-attack |
| Dataverse - User bulk retrieval outside normal activity | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies users retrieving significantly more records from Dataverse than they have previously in the past 2 weeks. |
| F&O - Bank account change following network alias reassignment | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies changes to user accounts where the network alias was modified to a new value. Shortly afterwards, the updated alias is used to update a bank account number. |
| F&O - Mass update or deletion of user records | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies large delete or update operations on Finance & Operations user records based on predefined thresholds. |
| F&O - Non-interactive account mapped to self or sensitive privileged user | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies changes to Microsoft Entra client apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a us... |
| F&O - Reverted bank account number modifications | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies changes to bank account numbers in Finance & Operations, whereby a bank account number is modified but then subsequently reverted a short time later. |
| F&O - Unusual sign-in activity using single factor authentication | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies sucessful sign-in events to Finance & Operations and Lifecycle Services using single factor/password authentication. Sign-in events from tenants not using MFA, coming from a Microsoft Entra... |
| Power Apps - App activity from unauthorized geo | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies Power Apps activity from countries in a predefined list of unauthorized countries. |
| Power Apps - Bulk sharing of Power Apps to newly created guest users | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies unusual bulk sharing, based on a predefined threshold in the query, of Power Apps to newly created Microsoft Entra guest users. |
| Power Apps - Multiple apps deleted | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies mass delete activity where multiple Power Apps are deleted, matching a predefined threshold of total apps deleted or app delete events across multiple Power Platform environments. |
| Power Apps - Multiple users access a malicious link after launching new app | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies a chain of events, where a new Power App is created, followed by mulitple users launching the app within the detection window and clicking on the same malicious URL. |
| Power Automate - Departing employee flow activity | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies instances where an employee who has been notified or is already terminated, on the TerminatedEmployees watchlist, creates or modifies a Power Automate flow. |
| Power Automate - Unusual bulk deletion of flow resources | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies bulk deletion of Power Automate flows that exceed a predefined threshold defined in the query and deviate from activity patterns observed in the last 14 days. |
| Power Platform - Account added to privileged Microsoft Entra roles | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies changes to privileged directory roles impacting Power Platform: - Dynamics 365 Admins - Power Platform Admins - Fabric Admins |
| Power Platform - Connector added to a sensitive environment | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies occurrences of new API connector creations within Power Platform, specifically targeting a predefined list of sensitive environments. |
| Power Platform - DLP policy updated or removed | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies changes to DLP policy, specifically policies which are updated or removed. |
| Power Platform - Possibly compromised user accesses Power Platform services | Analytic Rule | 📦 Solution | Microsoft Business Applications | Identifies user accounts flagged at risk in Microsoft Entra Identity Protection and correlates these users with sign-in activity in Power Platform, including Power Apps, Power Automate and Power Platf... |
| Dataverse - Activity after failed logons | Hunting Query | 📦 Solution | Microsoft Business Applications | This hunting query looks for users conducting Dataverse/Dynamics 365 activity shortly after a number of failed logons. Use this to look for potential post brute force activity. Adjust the threshold fi... |
| Dataverse - Activity after Microsoft Entra alerts | Hunting Query | 📦 Solution | Microsoft Business Applications | This hunting query looks for users conducting Dataverse/Dynamics 365 activity shortly after a Microsoft Entra Identity Protection alert for that user. The query only looks for users not seen before or... |
| Dataverse - Cross-environment data export activity | Hunting Query | 📦 Solution | Microsoft Business Applications | This query searches for data export activity across a predetermined number of Dataverse instances. Data export activity across multiple environments could indicate suspicious activity as users typical... |
| Dataverse - Dataverse export copied to USB devices | Hunting Query | 📦 Solution | Microsoft Business Applications | This query uses XDR data from M365 Defender to detect files downloaded from a Dataverse instance and copied to USB drive. |
| Dataverse - Generic client app used to access production environments | Hunting Query | 📦 Solution | Microsoft Business Applications | This query detects the use of the built-in "Dynamics 365 Example Application" to access production environments. This generic app can not be restricted by Azure AD authorization controls and could be ... |
| Dataverse - Identity management activity outside of privileged directory role membership | Hunting Query | 📦 Solution | Microsoft Business Applications | This query detects identity administration events in Dataverse/Dynamics 365 made by accounts which are not members of privileged directory roles 'Dynamics 365 Admins', 'Power Platform Admins' or 'Glob... |
| Dataverse - Identity management changes without MFA | Hunting Query | 📦 Solution | Microsoft Business Applications | This query is used to show privileged identity administration operations in Dataverse made by accounts that signed in without using MFA |
| Power Apps - Anomalous bulk sharing of Power App to newly created guest users | Hunting Query | 📦 Solution | Microsoft Business Applications | The query detects anomalous attempts to perform bulk sharing of Power App to newly created guest users. |
| Dynamics365Activity | Workbook | 📦 Solution | Microsoft Business Applications | |
| Dataverse: Add SharePoint sites to watchlist | Playbook | 📦 Solution | Microsoft Business Applications | This playbook is used to add new or updated SharePoint document management sites into the configuration watchlist. When combined with a scheduled analytics rule monitoring the Dataverse activity log, ... |
| Dataverse: Add user to blocklist (incident trigger) | Playbook | 📦 Solution | Microsoft Business Applications | This playbook can be triggered when a Microsoft Sentinel incident is raised and will automatically add affected user entitites to a pre-defined Microsoft Entra group, resulting in blocked access. The ... |
| Dataverse: Add user to blocklist (alert trigger) | Playbook | 📦 Solution | Microsoft Business Applications | This playbook can be triggered on-demand when a Microsoft Sentinel alert is raised, allowing the analyst to add affected user entitites to a pre-defined Microsoft Entra group, resulting in blocked acc... |
| Dataverse: Add user to blocklist using Outlook approval workflow | Playbook | 📦 Solution | Microsoft Business Applications | This playbook can be triggered when a Microsoft Sentinel incident is raised and will automatically add affected user entitites to a pre-defined Microsoft Entra group, using an Outlook based approval w... |
| Dataverse: Add user to blocklist using Teams approval workflow | Playbook | 📦 Solution | Microsoft Business Applications | This playbook can be triggered when a Microsoft Sentinel incident is raised and will automatically add affected user entitites to a pre-defined Microsoft Entra group, using a Teams adaptive card appro... |
| Dataverse: Remove user from blocklist | Playbook | 📦 Solution | Microsoft Business Applications | This playbook can be triggered on-demand when a Microsoft Sentinel alert is raised, allowing the analyst to remove affected user entitites from a pre-defined Microsoft Entra group used to block access... |
| Dataverse: Send notification to manager | Playbook | 📦 Solution | Microsoft Business Applications | This playbook can be triggered when a Microsoft Sentinel incident is raised and will automatically send an email notificiation to the manager of the affected user entitites. The Playbook can be config... |
| Security workflow: alert verification with workload owners | Playbook | 📦 Solution | Microsoft Business Applications | This playbook can reduce burden on the SOC by offloading alert verification to IT admins for specific analytics rules. It is triggered when a Microsoft Sentinel alert is generated, creates a message (... |
| DataverseSharePointSites | Parser | 📦 Solution | Microsoft Business Applications | |
| MSBizAppsNetworkAddresses | Parser | 📦 Solution | Microsoft Business Applications | |
| MSBizAppsOrgSettings | Parser | 📦 Solution | Microsoft Business Applications | |
| MSBizAppsTerminatedEmployees | Parser | 📦 Solution | Microsoft Business Applications | |
| MSBizAppsVIPUsers | Parser | 📦 Solution | Microsoft Business Applications | |
| MSBizApps-Configuration | Watchlist | 📦 Solution | Microsoft Business Applications | |
| Copilot - File Uploads Disabled | Analytic Rule | 📦 Solution | Microsoft Copilot | Detects when file uploads are disabled in Copilot. Attackers often disable logging or file upload capabilities to avoid evidence collection and cover their tracks. This rule identifies potential data ... |
| Copilot - Jailbreak Attempt Detected | Analytic Rule | 📦 Solution | Microsoft Copilot | Detects jailbreak attempts in Copilot interactions where users are trying to bypass Copilot guardrails and security controls. This rule identifies prompt injection and LLM abuse scenarios that could l... |
| Copilot - Plugin Created by Non-Admin User | Analytic Rule | 📦 Solution | Microsoft Copilot | Detects when a normal user creates a Copilot plugin. This can be used to inject malicious prompts, tools, or data exfiltration paths. This rule identifies potential persistence or privilege misuse sce... |
| Copilot - Plugin Tampering (Enable and Disable Within 5 Minutes) | Analytic Rule | 📦 Solution | Microsoft Copilot | Detects when a user enables and disables Copilot plugins within a 5-minute window. This behavior often indicates probing for security controls or living-off-Copilot techniques. This rule identifies di... |
| Copilot - Access From External IP Address | Hunting Query | 📦 Solution | Microsoft Copilot | Detects when Copilot is accessed from an external IP address outside the corporate network. This is very dangerous if an attacker is using Copilot to enumerate data. This rule identifies potential acc... |
| Copilot - Plugin Enabled After Being Disabled | Hunting Query | 📦 Solution | Microsoft Copilot | Detects when a Copilot plugin is re-enabled after being previously disabled. This could indicate a possible attacker restoring their backdoor. This rule identifies security control bypass scenarios wh... |
| MicrosoftCopilotActivityMonitoring | Workbook | 📦 Solution | Microsoft Copilot | |
| Detect CoreBackUp Deletion Activity from related Security Alerts | Analytic Rule | 📦 Solution | Microsoft Defender for Cloud | The query identifies any efforts by an attacker to delete backup containers, while also searching for any security alerts that may be linked to the same activity, in order to uncover additional inform... |
| Linked Malicious Storage Artifacts | Analytic Rule | 📦 Solution | Microsoft Defender for Cloud Apps | This query identifies the additional files uploaded by the same IP address which triggered a malware alert for malicious content upload on Azure Blob or File Storage Container. |
| MicrosoftCloudAppSecurity | Workbook | 📦 Solution | Microsoft Defender for Cloud Apps | |
| MicrosoftDefenderForOffice365 | Workbook | 📦 Solution | Microsoft Defender for Office 365 | |
| O365 - Block Malware file extensions | Playbook | 📦 Solution | Microsoft Defender for Office 365 | This Playbook Provides the automation on blocking the suspicious/malicious file attachment on mails |
| O365 - Block Suspicious Sender | Playbook | 📦 Solution | Microsoft Defender for Office 365 | This Playbook Provides the automation on blocking the suspicious/malicious senders |
| O365 - Block Sender Entity Trigger | Playbook | 📦 Solution | Microsoft Defender for Office 365 | This Playbook Provides the automation on blocking the suspicious/malicious sender |
| O365 - Block Spam Domain | Playbook | 📦 Solution | Microsoft Defender for Office 365 | This Playbook Provides the automation on blocking the suspicious/malicious attacker Domains |
| O365 - Delete All Malicious Inbox Rule | Playbook | 📦 Solution | Microsoft Defender for Office 365 | This Playbook provides the automation on deleting all the suspicious/malicious Inbox Rules from Provided Mailbox |
| MicrosoftThreatIntelligence | Workbook | 📦 Solution | Microsoft Defender Threat Intelligence | |
| MDTI-Automated-Triage | Playbook | 📦 Solution | Microsoft Defender Threat Intelligence | This playbook uses the MDTI Reputation data to automatically enrich incidents generated by Microsoft Sentinel. Indicators from an incident will be evaluated with MDTI reputation data. If any indicator... |
| MDTI-Data-Cookies | Playbook | 📦 Solution | Microsoft Defender Threat Intelligence | This playbook uses the MDTI Components data to automatically enrich incidents generated by Microsoft Sentinel. Leverage this playbook in order to enrich your incidents with [Cookies](https://learn.mic... |
| MDTI-Data-WebComponents | Playbook | 📦 Solution | Microsoft Defender Threat Intelligence | This playbook uses the MDTI Components data to automatically enrich incidents generated by Microsoft Sentinel. Leverage this playbook in order to enrich your incidents with [Webcomponents](https://lea... |
| MDTI-Intel-Reputation | Playbook | 📦 Solution | Microsoft Defender Threat Intelligence | This playbook uses the MDTI API to automatically enrich incidents generated by Microsoft Sentinel. Reputation information provides analyst with a decision as to whether an indicator is considered beni... |
| MDTI-Data-PassiveDns | Playbook | 📦 Solution | Microsoft Defender Threat Intelligence | This playbook enriches Microsoft Sentinel incidents by querying Microsoft Defender Threat Intelligence Passive DNS data for related host and IP entities. |
| MDTI-Data-ReverseDnS | Playbook | 📦 Solution | Microsoft Defender Threat Intelligence | This logic app automatically retrieves and enriches incident indicators generated by Microsoft Sentinel by leveraging data from the MDTI Passive DNS Reverse endpoint. |
| MDTI-Data-Trackers | Playbook | 📦 Solution | Microsoft Defender Threat Intelligence | This logic app automatically retrieves and enriches incident indicators generated by Microsoft Sentinel by leveraging data from the MDTI tracker endpoint. |
| AV detections related to Ukraine threats | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine. Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity... |
| AV detections related to SpringShell Vulnerability | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query looks for Microsoft Defender AV detections related to the SpringShell vulnerability. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device. ... |
| AV detections related to Tarrask malware | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query looks for Microsoft Defender AV detections related to Tarrask malware. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device, this query joins... |
| Possible Phishing with CSL and Network Sessions | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. If your workspace doesnt have one of the many data s... |
| Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activit... |
| Potential Build Process Compromise - MDE | Analytic Rule | 📦 Solution | Microsoft Defender XDR | The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process. This query uses... |
| SUNBURST and SUPERNOVA backdoor hashes | Analytic Rule | 📦 Solution | Microsoft Defender XDR | Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in DeviceFileEvents References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply... |
| SUNBURST network beacons | Analytic Rule | 📦 Solution | Microsoft Defender XDR | Identifies SolarWinds SUNBURST domain beacon IOCs in DeviceNetworkEvents References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromis... |
| TEARDROP memory-only dropper | Analytic Rule | 📦 Solution | Microsoft Defender XDR | Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarw... |
| SUNSPOT malware hashes | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query uses Microsoft Defender for Endpoint data to look for IoCs associated with the SUNSPOT malware shared by Crowdstrike. More details: - https://www.crowdstrike.com/blog/sunspot-malware-tec... |
| C2-NamedPipe | Analytic Rule | 📦 Solution | Microsoft Defender XDR | Detects the creation of a named pipe used by known APT malware. Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c |
| DopplePaymer Procdump | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog. DoppelPaymer is ransomware that is spread manually by hu... |
| LSASS Credential Dumping with Procdump | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild". In early March 2021, Microsoft released patches for four different zero-day vulne... |
| Doppelpaymer Stop Services | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog. DoppelPaymer is ransomware that is spread manually by hu... |
| Qakbot Campaign Self Deletion | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware Qakbot is malware that steals login credentials from banking and financial services. It has ... |
| Regsvr32 Rundll32 Image Loads Abnormal Extension | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll. Joins the data to public network events. References: https://threathunt.blog/running-live-mal... |
| Regsvr32 Rundll32 with Anomalous Parent Process | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This analytical rule looks for rundll32.exe or regsvr32.exe being spawned by abnormal processes: wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe. Blog: https://threathunt.blog/running-live... |
| Detect Suspicious Commands Initiated by Webserver Processes | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, Operation Soft Cell. Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers through... |
| Bitsadmin Activity | Analytic Rule | 📦 Solution | Microsoft Defender XDR | Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. This service is commonly used for legitimate purposes, but can also be used as part ... |
| Office Apps Launching Wscipt | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated. Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Origina... |
| Detect Potential Kerberoast Activities | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query aim to detect if someone requests service tickets (where count => maxcount) The query requires trimming to set a baseline level for MaxCount Mitre Technique: Kerberoasting (T1558.003) @Ma... |
| Files Copied to USB Drives | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Adv... |
| MosaicLoader | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection. |
| Unusual Volume of file deletion by users | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here. This applies to SharePoint and OneDrive users. Audit even... |
| Remote File Creation with PsExec | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog. Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread ... |
| Service Accounts Performing Remote PS | Analytic Rule | 📦 Solution | Microsoft Defender XDR | Service Accounts Performing Remote PowerShell. The purpose behind this detection is for finding service accounts that are performing remote powershell sessions. There are two phases to the detection: ... |
| Account Creation | Analytic Rule | 📦 Solution | Microsoft Defender XDR | User accounts may be created to achieve persistence on a machine. Read more here: https://attack.mitre.org/wiki/Technique/T1136. Tags: #CreateAccount. Query #1: Query for users being created using "ne... |
| Local Admin Group Changes | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query searches for changes to the local administrators group. Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes. |
| Rare Process as a Service | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query is looking for rarely seen processes which are launched as a service. Whiltelisted process list need to be updated based on the environment. Author: Jouni Mikkola More info: https://threath... |
| Deletion of data on multiple drives using cipher exe | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption. |
| LaZagne Credential Theft | Analytic Rule | 📦 Solution | Microsoft Defender XDR | LaZagne is a popular open-source tool used to recover passwords stored on a local computer. It has been used in ransomware attacks to steal credentials and escalate privileges. This query looks for th... |
| Clearing of forensic evidence from event logs using wevtutil | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. Clearing event logs can be a sign of ransomware activity, as ransomware often attempts to cover its trac... |
| Stopping multiple processes using taskkill | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. This is a common technique used by ransomware to stop security products and other processes. |
| Potential Ransomware activity related to Cobalt Strike | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. It looks for alerts that indicate potential ransomware activity... |
| Qakbot Discovery Activies | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. It looks for discovery commands such as net.exe, whoami.e... |
| Shadow Copy Deletions | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors. This query detects know commands that have been used by the ransomware actors. Some i... |
| Disabling Security Services via Registry | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query checks for processes modifying the registry to disable security features. This is a common technique used by threat actors for defence evasion. |
| Deimos Component Execution | Analytic Rule | 📦 Solution | Microsoft Defender XDR | Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization... |
| Imminent Ransomware | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query checks for a series of commands that are commonly used by attackers to disable security tools and system recovery tools before deploying Macaw ransomware in an organization. |
| Java Executing cmd to run Powershell | Analytic Rule | 📦 Solution | Microsoft Defender XDR | This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc... |
| Appspot Phishing Abuse | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps surface phishing campaigns associated with Appspot abuse.These emails frequently contain phishing links that utilize the recipients' own email address as a unique identifier in the UR... |
| Spoofing attempts from Specific Domains | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query identifies potential phishing or spoofing attempts originating from specific domains with authentication failures. |
| Determine Successfully Delivered Phishing Emails by top IP Addresses | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query identifies phishing emails sent that were successfully delivered, by top IP addressess. cutoff default value is 5, adjust the value as needed. |
| Determine Successfully Delivered Phishing Emails to Inbox/Junk folder. | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query identifies threats which got successfully delivered to Inbox/Junk folder. |
| Judgement Panda Exfil Activity | Hunting Query | 📦 Solution | Microsoft Defender XDR | Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml. Questions via Twitter: @janvonkirchheim. |
| Robbinhood Driver | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query detects the presence of the Robbinhood ransomware driver. |
| Snip3 Malicious Network Connectivity | Hunting Query | 📦 Solution | Microsoft Defender XDR | This hunting query looks for potentially hollowed processes that may be used to facilitate command-and-control or exfiltration by Snip3 malware. |
| C2-NamedPipe | Hunting Query | 📦 Solution | Microsoft Defender XDR | Detects the creation of a named pipe used by known APT malware. Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c |
| Recon with Rundll | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query detects suspicious rundll.exe activity associated with Trickbot campaigns. |
| DopplePaymer Procdump | Hunting Query | 📦 Solution | Microsoft Defender XDR | Detects the use of ProcDump to dump credentials from LSASS memory by DoppelPaymer ransomware operators. |
| Credential Harvesting Using LaZagne | Hunting Query | 📦 Solution | Microsoft Defender XDR | Detects the use of LaZagne to steal credentials from the SAM database by Ryuk ransomware operators. |
| LSASS Credential Dumping with Procdump | Hunting Query | 📦 Solution | Microsoft Defender XDR | Detects the use of Procdump to dump credentials from LSASS memory. |
| Clear System Logs | Hunting Query | 📦 Solution | Microsoft Defender XDR | This hunting query searches for attempts to use fsutil.exe to clear system logs and delete forensic artifacts. |
| Doppelpaymer Stop Services | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for attempts to stop security services, which is a common tactic used by DoppelPaymer ransomware operators. |
| Qakbot Campaign Self Deletion | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query detects if an instance of Qakbot has attempted to overwrite its original binary. |
| Regsvr32 Rundll32 Image Loads Abnormal Extension | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll. |
| Regsvr32 Rundll32 with Anomalous Parent Process | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for rundll32.exe or regsvr32.exe being spawned by abnormal processes such as wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe. |
| Detect Suspicious Commands Initiated by Webserver Processes | Hunting Query | 📦 Solution | Microsoft Defender XDR | Detect suspicious commands initiated by web server processes used for network discovery and user/owner discovery. |
| Enumeration of Users & Groups for Lateral Movement | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query hunts for attempts to list users or groups using Net commands, which are commonly used for lateral movement. |
| Anomalous Payload Delivered from ISO files | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for lnk file executions from other locations than C: drive, which can relate to mounted ISO-files. |
| Bitsadmin Activity | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for use of bitsadmin.exe for file transfer, which can be used for legitimate purposes or as part of a malware downloader. |
| Detect Malicious use of MSIExec | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query detects possible download and execution using Msiexec. |
| Detect Malicious use of Msiexec Mimikatz | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for malicious use of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool. |
| Office Apps Launching Wscipt | Hunting Query | 📦 Solution | Microsoft Defender XDR | The query searches for Office applications launching wscript.exe to run a JSE file. |
| Detect Potential kerberoast Activities | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query aim to detect if someone requests service tickets (where count => maxcount). The query requires trimming to set a baseline level for MaxCount. |
| PowerShell Downloads | Hunting Query | 📦 Solution | Microsoft Defender XDR | The query searches for PowerShell execution events that could involve a download. |
| Webserver Executing Suspicious Applications | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript). |
| Detect Suspicious Mshta Usage | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query detects when mshta.exe has been run, which might include illegitimate usage by attackers. |
| Files Copied to USB Drives | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. |
| Suspicious Tomcat Confluence Process Launch | Hunting Query | 📦 Solution | Microsoft Defender XDR | The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134. |
| MosaicLoader | Hunting Query | 📦 Solution | Microsoft Defender XDR | This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection. |
| PrintNightmare CVE-2021-1675 usage Detection | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looks for any file creations in the print spooler drivers folder. |
| Windows Print Spooler Service Suspicious File Creation | Hunting Query | 📦 Solution | Microsoft Defender XDR | The query digs in Windows print spooler drivers folder for any file creations. This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999. |
| MITRE - Suspicious Events | Hunting Query | 📦 Solution | Microsoft Defender XDR | This hunting query looks for several different MITRE techniques, grouped by risk level. A weighting is applied to each risk level and a total score calculated per machine. Techniques can be added/remo... |
| Unusual Volume of file deletion by users | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here. |
| Detect MaiSniper | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for usage of MailSniper Exchange attack tool. |
| Account Brute Force | Hunting Query | 📦 Solution | Microsoft Defender XDR | This hunting query searches for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded. |
| Remote File Creation with PsExec | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query detects remote file creation events that might indicate an active attack using PsExec. |
| Service Accounts Performing Remote PS | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for any Service Accounts Performing Remote PowerShell. |
| Account Creation | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looks for the creation of user accounts on a machine using the "net user" command. |
| Local Admin Group Changes | Hunting Query | 📦 Solution | Microsoft Defender XDR | This hunting query searches for changes to the local administrators group. |
| Rare Process as a Service | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looks for rarely seen processes which are launched as a service. |
| Scheduled Task Creation | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for any scheduled task creation event. |
| SAM Name Change CVE-2021-42278 | Hunting Query | 📦 Solution | Microsoft Defender XDR | The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity. |
| Deletion of data on multiple drives using cipher exe | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption. |
| Check for multiple signs of Ransomware Activity | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query checks for multiple signs of ransomware activity to identify affected devices. |
| Suspicious Image Load related to IcedId | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to IcedId ransomware. |
| LaZagne Credential Theft | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query can be used to locate processes executing credential theft activity, often LaZagne in ransomware compromises. |
| Clearing of forensic evidence from event logs using wevtutil | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. |
| Stopping multiple processes using taskkill | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. |
| Potential Ransomware activity related to Cobalt Strike | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. |
| Qakbot Discovery Activies | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. |
| Shadow Copy Deletions | Hunting Query | 📦 Solution | Microsoft Defender XDR | This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors. |
| Turning off services using sc exe | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query checks for attempts to turn off at least 10 existing services using sc.exe. |
| Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities | Hunting Query | 📦 Solution | Microsoft Defender XDR | This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a |
| Disabling Services via Registry | Hunting Query | 📦 Solution | Microsoft Defender XDR | Search for processes modifying the registry to disable security features. |
| DLLHost.exe WMIC domain discovery | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query checks for dllhost.exe calling WMIC to discover additional hosts and associated domain. |
| PowerShell adding exclusion path for Microsoft Defender of ProgramData | Hunting Query | 📦 Solution | Microsoft Defender XDR | Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor. |
| Spoolsv Spawning Rundll32 | Hunting Query | 📦 Solution | Microsoft Defender XDR | Look for the spoolsv.exe launching rundll32.exe with an empty command line. |
| Suspicious DLLs in spool Folder | Hunting Query | 📦 Solution | Microsoft Defender XDR | Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old. |
| Suspicious Files in spool Folder | Hunting Query | 📦 Solution | Microsoft Defender XDR | Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. |
| Suspicious Spoolsv Child Process | Hunting Query | 📦 Solution | Microsoft Defender XDR | Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675 |
| ATP policy status check | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365. |
| JNLP-File-Attachment | Hunting Query | 📦 Solution | Microsoft Defender XDR | JNLP file extensions are an uncommon file type often used to deliver malware. |
| Safe Attachments detections | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query provides insights on the detections done by Safe Attachment detections |
| Authentication failures by time and authentication type | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth |
| CompAuth Failure Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spoof - Composite Authentication fails summarizing the data daily. |
| DKIM Failure Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spoof - DKIM fails summarizing the data daily. |
| DMARC Failure Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spoof - DMARC fails summarizing the data daily. |
| SPF Failure Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spoof - SPF fails summarizing the data daily. |
| Spoof attempts with auth failure | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in checking for spoofing attempts on the domain with Authentication failures |
| Top Spoof external domain detections by Sender domain (P1/P2) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). |
| Top Spoof DMARC detections by Sender domain (P1/P2) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). |
| Top Spoof intra-org detections by Sender domain (P1/P2) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). |
| Message from an Accepted Domain with DMARC TempError | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result. |
| Message with URL listed on OpenPhish delivered into Inbox | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox |
| Potential OAuth phishing email delivered into Inbox | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious OAuth app URL has been delivered into an Inbox. |
| Potentially malicious svg file delivered to Inbox | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox. |
| Audit Email Preview-Download action | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365 |
| Bad email percentage of Inbound emails | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily. |
| Calculate overall MDO efficacy | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught. |
| Email sender IP address Geo location information | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps getting GeoIP information of emails SenderIPv4 addresses. |
| Hunt for Admin email access | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps report on email access by administrators |
| Hunt for TABL changes | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365 |
| Local time to UTC time conversion | Hunting Query | 📦 Solution | Microsoft Defender XDR | Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in securit... |
| Mail item accessed | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing emails accessed by end users using cloud app events data |
| Malicious email senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for emails from a sender with at least one email in quarantine |
| MDO daily detection summary report | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365 |
| New TABL Items | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps identifying when new items being added to the Tenant/Allow Block List (TABL) in Defender for Office 365. |
| Top 10 Domains sending Malicious Emails (Malware+Phish+Spam) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftde... |
| Top 10 External Senders (Malware) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Identifies the top 10 external sender addresses delivering inbound emails classified as malware. If you want to exclude your own organization's domains (including subdomains), add a filter after the m... |
| Top 10 External Senders (Phish) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Identifies the top 10 external sender addresses delivering inbound emails classified as phishing. If you want to exclude your own organization's domains (including subdomains), add a filter after the ... |
| Top 10 External Senders (Spam) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Identifies the top 10 external sender addresses delivering inbound emails classified as spam. If you want to exclude your own organization's domains (including subdomains), add a filter after the spam... |
| Top 10 External Senders (Spam) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Identifies the top 10 external sender addresses delivering inbound emails classified as spam. To exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g... |
| Top 10 Targeted Users (Malware+Phish+Spam) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam. Based on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.... |
| Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises the top 10 users with click attempts on URLs in emails detected as malware, phishing, or spam, helping analysts identify risky user behaviour and potential targets. Based on Defender for Of... |
| MDO Threat Protection Detections trend over time | Hunting Query | 📦 Solution | Microsoft Defender XDR | Graph of MDO detections trended over time |
| Total number of detections by MDO | Hunting Query | 📦 Solution | Microsoft Defender XDR | Provides a summary of total number of detections |
| Automated email notifications and suspicious sign-in activity | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for Automated email notifications and suspicious sign-in activity |
| BEC - File sharing tactics - Dropbox | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for BEC - File sharing tactics - Dropbox |
| BEC - File sharing tactics - OneDrive or SharePoint | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint |
| Email bombing attacks | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing recipients who are potentially victim of email bombing attacks |
| Emails containing links to IP addresses | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for Emails containing links to IP addresses |
| Files share contents and suspicious sign-in activity | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for Files share contents and suspicious sign-in activity |
| Good emails from senders with bad patterns | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for good emails from senders with bad patterns |
| Hunt for email bombing attacks | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365. |
| Hunt for email conversation take over attempts | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for email conversation take over attempts |
| Hunt for malicious attachments using external IOC source | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source |
| Hunt for malicious URLs using external IOC source | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for emails with malicious URLs based on external IOC source |
| Inbox rule changes which forward-redirect email | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for Inbox rule changes which forward-redirect email |
| MDO_CountOfRecipientsEmailaddressbySubject | Hunting Query | 📦 Solution | Microsoft Defender XDR | Count of recipient's email addresses by subject |
| MDO_Countofrecipientsemailaddressesbysubject | Hunting Query | 📦 Solution | Microsoft Defender XDR | Count of recipient's email addresses by subject |
| MDO_CountOfSendersEmailaddressbySubject | Hunting Query | 📦 Solution | Microsoft Defender XDR | Count of sender's email addresses by subject |
| MDO_SummaryOfSenders | Hunting Query | 📦 Solution | Microsoft Defender XDR | Count of all Senders and where they were delivered |
| MDO_URLClickedinEmail | Hunting Query | 📦 Solution | Microsoft Defender XDR | URLs clicked in Email |
| Top outbound recipient domains sending inbound emails with threats | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for top outbound recipient domains which are sending inbound emails with threats |
| Detections by detection methods | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing malicious email detections by detection methods |
| Mail reply to new domain | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new |
| Mailflow by directionality | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing inbound / outbound / intra-org emails by domain per day |
| Malicious emails detected per day | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing Malware, Phishing, Spam emails caught per day |
| Sender recipient contact establishment | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in checking the sender-recipient contact establishment status |
| Spam Detections (High) by delivery location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails with Spam detections (High confidence) summarizing the data by Delivery Location. |
| Spam Detections (Normal) by delivery location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location. |
| Top 100 malicious email senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing top 100 malicious senders |
| Top 100 senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing top 100 senders in your organization in last 30 days |
| Zero day threats | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing zero day threats via URL and file detonations |
| Email containing malware accessed on a unmanaged device | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we are looking for emails containing malware accessed on a unmanaged device |
| Email containing malware sent by an internal sender | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we are looking for emails containing malware attachment sent by an internal sender |
| Email malware detection report | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing email malware detection cases |
| File Malware Detection Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily. |
| File Malware by Top Malware Families (Anti Virus) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoin... |
| File Malware by Top Malware Families (Safe Attachments) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Offic... |
| Malware Detections Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Malware detections over time summarizing the data daily. |
| Malware Detections by delivery location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location. |
| Malware Detections by Detection technology Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls. |
| Malware Detections by Detection technology | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls. |
| Malware detections by Workload Locations | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored |
| Malware detections by Workload Type | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored |
| Email Top Domains sending Malware | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain) |
| Top Malware Families | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected. |
| Top Users receiving Malware | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress) |
| Zero-day Malware Detections Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware. |
| Teams communication from suspicious external users | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for communication from suspicious external users. |
| Teams communication to suspicious external users | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for communication with suspicious external users. |
| Expanding recipients into separate rows | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for recipients of Teams messages. |
| External malicious Teams messages sent from internal senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for external malicious Teams messages sent from internal senders |
| Hunt for malicious messages using External Threat Intelligence | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source |
| Inbound Teams messages by sender domains | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing volume of inbound external Teams message by sender domains |
| Malicious Teams messages by URL detection methods | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing malicious Teams message detections by URL detection methods |
| Malicious Teams messages received from external senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for malicious Teams messages received from external senders. |
| Microsoft Teams chat initiated by a suspicious external user | Hunting Query | 📦 Solution | Microsoft Defender XDR | Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages. |
| Number of unique accounts performing Teams message Admin submissions | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives |
| Number of unique accounts performing Teams message User submissions | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises number of unqiue accounts performing Teams message user submissions as false negatives or false positives |
| Possible partner impersonation in external Team messages | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message |
| Possible Teams phishing activity | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looks for possible Teams phishing activity. |
| Potentially malicious URL click in Teams | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query provides insights on a potentially malicious URL click in Teams |
| Rare Domains in External Teams Messages | Hunting Query | 📦 Solution | Microsoft Defender XDR | Detects rare domains (seen in fewer than 3 Teams messages) appearing in external Microsoft Teams threads within the last 24 hours. |
| Suspicious Teams Display Name | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looks for Teams messages from an external user with a suspicious display name. |
| Teams Admin submission of Malware and Phish daily trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware |
| Teams Admin submission of No Threats daily trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of admin false positive Teams message submissions |
| Teams Admin-User Submissions Grading Verdicts | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualizes Teams messages submitted by users or admins then graded in the submission process. |
| Teams blocked URL clicks daily trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages. |
| Teams Malware ZAP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams messages with Malware threats that have been ZAPed. |
| Teams Message with URL listed on OpenPhish | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered. |
| Teams message ZAPed with the same URL in Email | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams messages that have been ZAPed with the same URL in Email. |
| Teams messages from a specific sender by ThreadType | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams messages from a specific sender by ThreadType. |
| Teams messages with suspicious URL domains | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams messages with suspicious URL domains. |
| Teams Phish ZAP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams messages with Phish threats that have been ZAPed. |
| Teams post delivery events daily trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualizes the daily amount of post delivery events on Teams messages. |
| Teams Spam ZAP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams messages with Spam threats that have been ZAPed. |
| Teams URL clicks actions summarized by URLs clicked on | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them. |
| Teams URL clicks through actions on Phish or Malware URLs summarized by URLs | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls. |
| Teams User submissions daily trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of user false negative and false postive Teams message submissions |
| Teams users clicking on suspicious URL domains | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for Teams users clicking on suspicious URL domains. |
| Top 10 Attacked user by Phish messages | Hunting Query | 📦 Solution | Microsoft Defender XDR | Top 10 attacked users by Phish messages from external senders using Teams |
| Top 10 external senders sending Teams messages | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visulises all up Top 10 external senders sending Teams messages |
| Top 10 External senders sending Teams phishing messsages | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looking for top 10 External senders sending Team phishing messsages. |
| Top 10 sender domains - Admin Teams message submissions FN | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages |
| Top 10 sender domains - Teams user submissions FN or FP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages |
| Top 10 senders - Teams users submissions FN or FP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages |
| Top 10 senders of Admin Teams message submissions FN | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages |
| Top 10 senders of Admin Teams message submissions FP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises Teams messages submitted by admins as false positives, summarizing the data by top 10 indidvidual senders of those messages |
| Top 10 Users clicking on malicious URLs in Teams | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams. |
| Top accounts performing Teams admin submissions FN or FP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the top admins performing false negative or false positive admin submissions of Teams messages |
| Top accounts performing Teams user submissions FN or FP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the top users performing false negative or false positive user submissions of Teams messages |
| Top domains outbound sending Malicious Teams messages inbound | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query looking for potential partner compromise via comparing outbound Teams message traffic per target domain and looking for malicious Teams messages from the same domains as inbound. |
| Top External malicious Senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | Top external senders sending malicious inbound Teams messages Spam, Phish, Malware |
| Top External Sender domains - Malware | Hunting Query | 📦 Solution | Microsoft Defender XDR | Top External Sender domains sending Teams message with Malware threats |
| Top External Sender domains - Phish | Hunting Query | 📦 Solution | Microsoft Defender XDR | Top External Sender domains sending Teams message with Phish threats |
| Top External Sender domains - Spam | Hunting Query | 📦 Solution | Microsoft Defender XDR | Top External Sender domains sending Teams message with Spam threats |
| Top malicious URLs clicked by users in Teams | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunt for top malicious URLs clicked by users in Teams |
| Total number of MDO Teams protection detections daily | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visulises Total number of MDO Teams protection detections daily |
| URL click on URLs in ZAP-d Teams messages | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP. |
| Spam and Phish allowed to inbox by Admin Overrides | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in reviewing malicious emails allowed due to admin overrides |
| Spam and Phish allowed to inbox by User Overrides | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in reviewing malicious emails allowed due to user overrides |
| Top policies performing admin overrides | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in reviewing top policies for admin overrides (Allow/Block) |
| Top policies performing user overrides | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in reviewing top policies for user overrides (Allow/Block) |
| Total Emails with Admin Overrides (Allow) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override |
| Total Emails with Admin Overrides (Block) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily |
| Total Emails with User Overrides (Allow) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found |
| Total Emails with User Overrides (Block) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily |
| Appspot Phishing Abuse | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps surface phishing campaigns associated with Appspot abuse. |
| Phish Detections Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish detections over time summarizing the data daily. |
| Phish Detections (High) by delivery location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location. |
| Phish Detections (Normal) by delivery location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location. |
| Phish Detections by delivery location trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location. |
| Phish Detections by Detection technology Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls |
| Phish Detections by Detection technology | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls |
| Possible device code phishing attempts | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps hunting for possible device code Phishing attempts |
| Punycode lookalikes | Hunting Query | 📦 Solution | Microsoft Defender XDR | Punycode lookalike domains in Emails and Teams messages |
| Email Top Domains sending Phish | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain). |
| Top Users receiving Phish | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress) |
| Zero-day Phish Detections Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish |
| Campaign with randomly named attachments | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients |
| Campaign with suspicious keywords | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection, we track emails with suspicious keywords in subjects. |
| Custom detection-Emails with QR from non-prevalent senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code |
| Emails delivered having URLs from QR codes | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we hunt for inbound emails delivered having URLs from QR codes |
| Emails with QR codes and suspicious keywords in subject | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject |
| Emails with QR codes from non-prevalent sender | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders |
| Hunting for sender patterns | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents |
| Hunting for user signals-clusters | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign. |
| Inbound emails with QR code URLs | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we summarize volume of inbound emails with QR code URLs in last 30 days |
| Personalized campaigns based on the first few keywords | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection, we track emails with personalized subjects. |
| Personalized campaigns based on the last few keywords | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection, we track emails with personalized subjects. |
| Risky sign-in attempt from a non-managed device | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device. |
| Suspicious sign-in attempts from QR code phishing campaigns | Hunting Query | 📦 Solution | Microsoft Defender XDR | This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices. |
| Group quarantine release | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released. |
| High Confidence Phish Released | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query shows information about high confidence phish email that has been released from the Quarantine. |
| Quarantine Phish Reason trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method |
| Quarantine Phish Reason | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total amount of phish emails that are quarantined, summarized by the detection method |
| Quarantine Release Email Details | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query shows information about email that has been released from the Quarantine in Defender for Office 365. |
| Quarantine release trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing quarantine release trend in Defender for Office 365 |
| Quarantine releases by Detection Types | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails released from quarantine and summarizing the result by the original filter verdict |
| Quarantine Spam Reason trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method |
| Quarantine Spam Reason | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total amount of spam emails that are quarantined, summarized by the detection method |
| AIR investigation actions insight | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query provides insights into AIR investigation actions in Microsoft Defender for Office 365. |
| Listing Email Remediation Actions via Explorer | Hunting Query | 📦 Solution | Microsoft Defender XDR | Listing Email Remediation Actions performed via Explorer in Defender for Office 365 |
| Top 10 domains sending Bulk email | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails which has any Bulk complaint level. |
| Spam detection by delivery location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location. |
| Spam detection by IP and its location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6). |
| Bulk Emails by Sender Bulk Complaint level | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails which has any Bulk complaint level. |
| Spam detection technologies | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls. |
| Email Top 10 Domains sending Spam | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails with Spam detections. |
| Email Top 10 Targeted Users (Spam) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises top 10 users targeted with Spam. |
| Email Top 15 Domains sending Spam with Additional Details | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). |
| Email Top 15 Targeted Users (Spam) with Additional Details | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises top 15 users targeted with Spam with summarized spam detections. |
| Spam detection trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spam detections over time summarizing the data daily |
| Spam Detections by Detection technology | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls. |
| Display Name - Spoof and Impersonation | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name |
| Impersonation Detections by Detection Technology Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time |
| Impersonation Detections by Detection Technology | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology |
| Impersonation Detections Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish (BEC) - Impersonation detections over time. |
| referral-phish-emails | Hunting Query | 📦 Solution | Microsoft Defender XDR | Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data |
| Spoof and impersonation detections by sender IP | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing count of spoof and impersonation detections done per sender IP |
| Spoof and impersonation phish detections | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing count of phish detections done by spoof detection methods |
| Spoof Detections by Detection Technology Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time |
| Spoof Detections by Detection Technology | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology |
| Spoof Detections Trend | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily. |
| Top Domains Outbound with Emails with Threats Inbound (Partner BEC) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) |
| User not covered under display name impersonation | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps to find threats using display name impersonation for users not already protected with User Impersonation |
| Admin Submission Trend (FN) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of admin false negative submission by submission type. |
| Admin Submission Trend (FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of admin false positive submission by submission type. |
| Admin Submissions by DetectionMethod (Phish FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the original detection technology of emails submitted as phish false positive by admins |
| Admin Submissions by DetectionMethod (Spam FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the original detection technology of emails submitted as spam false positive by admins |
| Admin Submissions by Detection Type | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type |
| Admin Submissions by Grading verdict (FN-FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading. |
| Admin Submissions by Submission State (FN) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total amount of admin false negative submissions by the state of the submission. |
| Admin Submissions by Submission State (FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total amount of admin false positive submissions by the state of the submission. |
| Admin Submissions by Submission Type (FN) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing admin reported email submissions |
| Admin Submissions by Submission Type (FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total amount of admin false positive submission by submission type. |
| Top accounts performing admin submissions (FN) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the top admins performing false negative submissions |
| Top accounts performing admin submissions (FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the top admins performing false positive submissions |
| Top accounts performing user submissions | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query graphs top accounts performing user submissions |
| Top 10 Detection Overrides - Admin Email Submissions (FN) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override |
| Top 10 sender domains - Admin email submissions (FN) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails |
| Top 10 sender domains - Admin email submissions (FP) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails |
| Total Submissions by Submission Type | Hunting Query | 📦 Solution | Microsoft Defender XDR | Total Submissions by Submission Status |
| Total Submissions by Submission Type | Hunting Query | 📦 Solution | Microsoft Defender XDR | Total Submissions by Submission Type |
| User reported submissions | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing user reported email submissions |
| User Email Submissions accuracy vs Admin review verdict | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises user submissions type compared to admin review verdict |
| User Email Submissions (FN) - Top Detection Overrides by Admins | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override |
| User Email Submissions (FN) - Top Detection Overrides by Users | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override. |
| User Email Submissions (FN) - Top Inbound P2 Senders domains | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises top sender domains of inbound emails submitted as false negatives by users. |
| User Email Submissions (FN) - Top Inbound P2 Senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises top sender email addresses of inbound emails submitted as false negatives by users. |
| User Email Submissions (FN) - Top Intra-Org P2 Senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises top sender email addresses of intra-org emails submitted as false negatives by users. |
| User Email Submissions (FN) - Top Intra-Org Subjects | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises top 10 subjects of intra-org emails submitted as false negatives by users. |
| User Email Submissions by Admin review status (Mark and Notify) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises user submissions where admin also performed 'mark and notify' action on the submission |
| User Email Submissions (FN-FP) by Grading verdict | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading. |
| User Email Submissions (FN) by Submission Type | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total ammount of user false negative submission by submission type, including the phish simulations reported emails |
| User email submissions (FN) from Junk Folder | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the total ammount of user false negative submissions from the junk folder |
| User Email Submission Trend (FN) | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users. |
| Attacked more than x times average | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing count of users attacked more than x times average. |
| Malicious mails by sender IPs | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing sender IPs sending malicious email of type Malware or Phish |
| Top 10% of most attacked users | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing the list of top 10% of most attacked users |
| Top 10 URL domains attacking organization | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing list of top 10 URL domains attacking the organization |
| Top external malicious senders | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days |
| Top targeted users | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days |
| Malicious Clicks allowed (click-through) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content. Based on Defender for Offi... |
| Malicious Emails with QR code Urls | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns. Based on Defender for Office 365 workbook: https://techcommuni... |
| PhishingEmailUrlRedirector (1) | Hunting Query | 📦 Solution | Microsoft Defender XDR | The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data. |
| SafeLinks URL detections | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query provides insights on the detections done by SafeLinks protection in Defender for Office 365 |
| Top 10 Users clicking on Malicious URLs (Malware) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook: ... |
| Top 10 Users clicking on Malicious URLs (Phish) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook:... |
| Top 10 Users clicking on Malicious URLs (Spam) | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets. Based on Defender for Office 365 workbook: htt... |
| URL Click attempts by threat type | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/bl... |
| URL Clicks by Action | Hunting Query | 📦 Solution | Microsoft Defender XDR | Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog... |
| URLs by location | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk. Based on Defender for Office 36... |
| End user malicious clicks | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing list of top users click on Phis URLs |
| URL click count by click action | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing URL click count by ClickAction |
| URL click on ZAP email | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge |
| URL clicks actions by URL | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we are looking URL click actions by URL in the last 7 days |
| URLClick details based on malicious URL click alert | Hunting Query | 📦 Solution | Microsoft Defender XDR | In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected |
| User clicked through events | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page. |
| User clicks on malicious inbound emails | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query provides insights on users who clicked on a suspicious URL |
| User clicks on phishing URLs in emails | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query helps in determining clickthroughs when email delivered because of detection overrides. |
| Post Delivery Events by Admin | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type |
| Post Delivery Events by Location | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action |
| Post Delivery Events by ZAP type | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action |
| Post Delivery Events over time | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge. |
| Dropping Payload via certutil | Hunting Query | 📦 Solution | Microsoft Defender XDR | BazaCall campaign tricks users into calling a fake customer support center, and download a malicious Excel file which contains a macro to infect users' device with BazaLoader. This query searches for ... |
| Deimos Component Execution | Hunting Query | 📦 Solution | Microsoft Defender XDR | Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization... |
| LemonDuck Registration Function | Hunting Query | 📦 Solution | Microsoft Defender XDR | LemonDuck is a malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operatio... |
| Devices with Log4j vulnerability alerts and additional other alert related context | Hunting Query | 📦 Solution | Microsoft Defender XDR | Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J. |
| Alerts Related to Log4j Vulnerability | Hunting Query | 📦 Solution | Microsoft Defender XDR | Microsoft has observed attackers exploiting vulnerabilities associated with Log4J. |
| Imminent Ransomware | Hunting Query | 📦 Solution | Microsoft Defender XDR | Before deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools. |
| Malicious Use of MSBuild as LOLBin | Hunting Query | 📦 Solution | Microsoft Defender XDR | Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2. |
| Qakbot Reconnaissance Activities | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query searches for reconnaissance and beaconing activities after code injection occurs in Qakbot infections. |
| Java Executing cmd to run Powershell | Hunting Query | 📦 Solution | Microsoft Defender XDR | This query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script. |
| Blocked Clicks Trend 🔍 | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises the trend of malicious URL clicks that were blocked by Safe Links over the past 30 days, helping analysts monitor the effectiveness of click protection policies. Based on Defender for Offic... |
| Malicious URL Clicks by workload 🔍 | Hunting Query | 📦 Solution | Microsoft Defender XDR | Visualises click attempts on malicious URLs, grouped by workload (such as Exchange, Teams, SharePoint, Copilot etc.), to help analysts understand which workloads are most targeted. Based on Defender f... |
| MicrosoftDefenderForEndPoint | Workbook | 📦 Solution | Microsoft Defender XDR | |
| MicrosoftDefenderForIdentity | Workbook | 📦 Solution | Microsoft Defender XDR | |
| MicrosoftDefenderForOffice365detectionsandinsights | Workbook | 📦 Solution | Microsoft Defender XDR | |
| Create an Attack Simulator training simulation for users who did not report a phishing attempt 🔍 | Playbook | 📦 Solution | Microsoft Defender XDR | This playbook creates an educational Attack Simulator 'How-To Guide' simulation for end-users who failed to report a message as phishing (e.g. reported as junk, deleted the email, etc.) to the SOC. |
| Account Created and Deleted in Short Timeframe | Analytic Rule | 📦 Solution | Microsoft Entra ID | Search for user principal name (UPN) events. Look for accounts created and then deleted in under 24 hours. Attackers may create an account for their use, and then remove the account when no longer nee... |
| Account created or deleted by non-approved user | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies accounts that were created or deleted by a defined list of non-approved user principal names. Add to this list before running the query for accurate results. Ref : https://docs.microsoft.co... |
| Modified domain federation trust settings | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user or application modifies the federation settings on the domain or Update domain authentication from Managed to Federated. For example, this alert will trigger when a new Act... |
| Password spray attack against ADFSSignInLogs | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies evidence of password spray activity against Connect Health for AD FS sign-in events by looking for failures from multiple accounts from the same IP address within a time window. Reference: ... |
| Admin promotion after Role Management Application Permission Grant | Analytic Rule | 📦 Solution | Microsoft Entra ID | This rule looks for a service principal being granted the Microsoft Graph RoleManagement.ReadWrite.Directory (application) permission before being used to add an Microsoft Entra ID object or user acco... |
| Anomalous sign-in location by user account and authenticating application | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query over Microsoft Entra ID sign-in considers all user sign-ins for each Microsoft Entra ID application and picks out the most anomalous change in location profile for a user within an individu... |
| Authentication Methods Changed for Privileged Account | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies authentication methods being changed for a privileged account. This could be an indication of an attacker adding an auth method to the account so they can have continued access. Ref : https... |
| Microsoft Entra ID PowerShell accessing non-Entra ID resources | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user or application signs in using Microsoft Entra ID PowerShell to access non-Active Directory resources, such as the Azure Key Vault, which may be undesired or unauthorized be... |
| Microsoft Entra ID Role Management Permission Grant | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when the Microsoft Graph RoleManagement.ReadWrite.Directory (Delegated or Application) permission is granted to a service principal. This permission allows an application to read and manage... |
| Azure Portal sign in from another Azure Tenant | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query looks for successful sign in attempts to the Azure Portal where the user who is signing in from another Azure tenant, and the IP address the login attempt is from is an Azure IP. A threat a... |
| Azure RBAC (Elevate Access) | Analytic Rule | 📦 Solution | Microsoft Entra ID | Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator ... |
| Brute Force Attack against GitHub Account | Analytic Rule | 📦 Solution | Microsoft Entra ID | Attackers who are trying to guess your users' passwords or use brute-force methods to get in. If your organization is using SSO with Microsoft Entra ID, authentication logs to GitHub.com will be gener... |
| Brute force attack against a Cloud PC | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies evidence of brute force activity against a Windows 365 Cloud PC by highlighting multiple authentication failures and by a successful authentication within a given time window. |
| Bulk Changes to Privileged Account Permissions | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when changes to multiple users permissions are changed at once. Investigate immediately if not a planned change. This setting could enable an attacker access to Azure subscriptions in your ... |
| Attempt to bypass conditional access rule in Microsoft Entra ID | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies an attempt to Bypass conditional access rule(s) in Microsoft Entra ID. The ConditionalAccessStatus column value details if there was an attempt to bypass Conditional Access or if the Condit... |
| Conditional Access - A Conditional Access app exclusion has changed | Analytic Rule | 📦 Solution | Microsoft Entra ID | A Conditional Access app exclusion has changed in Entra ID. |
| Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) | Analytic Rule | 📦 Solution | Microsoft Entra ID | A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID. |
| Conditional Access - A Conditional Access policy was deleted | Analytic Rule | 📦 Solution | Microsoft Entra ID | A Conditional Access policy was deleted from Entra ID. |
| Conditional Access - A Conditional Access policy was disabled | Analytic Rule | 📦 Solution | Microsoft Entra ID | A Conditional Access policy was disabled in Entra ID. |
| Conditional Access - A Conditional Access policy was put into report-only mode | Analytic Rule | 📦 Solution | Microsoft Entra ID | A Conditional Access policy was put into report-only mode in Entra ID. |
| Conditional Access - A Conditional Access policy was updated | Analytic Rule | 📦 Solution | Microsoft Entra ID | A Conditional Access policy was updated in Entra ID. |
| Conditional Access - A Conditional Access user/group/role exclusion has changed | Analytic Rule | 📦 Solution | Microsoft Entra ID | A Conditional Access user/group/role exclusion has changed in Azure AD. |
| Conditional Access - A new Conditional Access policy was created | Analytic Rule | 📦 Solution | Microsoft Entra ID | A new Conditional Access policy was created in Entra ID. |
| Conditional Access - Dynamic Group Exclusion Changes | Analytic Rule | 📦 Solution | Microsoft Entra ID | // Detects changes to Dynamic Membership Rules for specified groups (often used in CA exclusions) |
| Credential added after admin consented to Application | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query will identify instances where Service Principal credentials were added to an application by one user after the application was granted admin consent rights by another user. If a threat act... |
| Cross-tenant Access Settings Organization Added | Analytic Rule | 📦 Solution | Microsoft Entra ID | Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when an Organization is added other than th... |
| Cross-tenant Access Settings Organization Deleted | Analytic Rule | 📦 Solution | Microsoft Entra ID | Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when an Organization is deleted from the Mi... |
| Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed | Analytic Rule | 📦 Solution | Microsoft Entra ID | Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Inbound Collaboration Set... |
| Cross-tenant Access Settings Organization Inbound Direct Settings Changed | Analytic Rule | 📦 Solution | Microsoft Entra ID | Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Inbound Direct Settings a... |
| Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed | Analytic Rule | 📦 Solution | Microsoft Entra ID | Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Outbound Collaboration Se... |
| Cross-tenant Access Settings Organization Outbound Direct Settings Changed | Analytic Rule | 📦 Solution | Microsoft Entra ID | Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Outbound Direct Settings ... |
| Attempts to sign in to disabled accounts | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies failed attempts to sign in to disabled accounts across multiple Azure Applications. Default threshold for Azure Applications attempted to sign in to is 3. References: https://docs.microsoft... |
| Distributed Password cracking attempts in Microsoft Entra ID | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies distributed password cracking attempts from the Microsoft Entra ID SigninLogs. The query looks for unusually high number of failed password attempts coming from multiple locations for a use... |
| full_access_as_app Granted To Application | Analytic Rule | 📦 Solution | Microsoft Entra ID | This detection looks for the full_access_as_app permission being granted to an OAuth application with Admin Consent. This permission provide access to all Exchange mailboxes via the EWS API can could ... |
| [Deprecated] Explicit MFA Deny | Analytic Rule | 📦 Solution | Microsoft Entra ID | User explicitly denies MFA push, indicating that login was not expected and the account's password may be compromised. This rule is deprecated as of July-2024. Alternative rule with similar logic and ... |
| Failed login attempts to Azure Portal | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies failed login attempts in the Microsoft Entra ID SigninLogs to the Azure Portal. Many failed logon attempts or some failed logon attempts from multiple IPs could indicate a potential brute ... |
| First access credential added to Application or Service Principal where no credential was present | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where there was no previous verify KeyCredential associated. If a threat actor obtains a... |
| Guest accounts added in Entra ID Groups other than the ones specified | Analytic Rule | 📦 Solution | Microsoft Entra ID | Guest Accounts are added in the Organization Tenants to perform various tasks i.e projects execution, support etc.. This detection notifies when guest users are added to Microsoft Entra ID Groups othe... |
| Mail.Read Permissions Granted to Application | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query look for applications that have been granted (Delegated or App/Role) permissions to Read Mail (Permissions field has Mail.Read) and subsequently has been consented to. This can help identif... |
| Suspicious application consent similar to O365 Attack Toolkit | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the MDSec O365 Attack Toolkit (https://github.com/mdsecactivebreach/o365-... |
| Suspicious application consent similar to PwnAuth | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user consents to provide a previously-unknown Azure application with the same OAuth permissions used by the FireEye PwnAuth toolkit (https://github.com/fireeye/PwnAuth). The def... |
| MFA Rejected by User | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies occurances where a user has rejected an MFA prompt. This could be an indicator that a threat actor has compromised the username and password of this user account and is using it to try and ... |
| MFA Spamming followed by Successful login | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies MFA Spamming followed by Successful logins and by a successful authentication within a given time window. Default Failure count is 10 and 1 successful login with default Time Window is 5 mi... |
| Multiple admin membership removals from newly created admin. | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query detects when newly created Global admin removes multiple existing global admins which can be an attempt by adversaries to lock down organization and retain sole access. Investigate reason... |
| New access credential added to Application or Service Principal | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where a verify KeyCredential was already present for the app. If a threat actor obtains ... |
| New onmicrosoft domain added to tenant | Analytic Rule | 📦 Solution | Microsoft Entra ID | This detection looks for new onmicrosoft domains being added to a tenant. An attacker who compromises a tenant may register a new onmicrosoft domain in order to masquerade as a service provider for l... |
| NRT Modified domain federation trust settings | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user or application modifies the federation settings on the domain or Update domain authentication from Managed to Federated. For example, this alert will trigger when a new Act... |
| NRT Authentication Methods Changed for VIP Users | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access. |
| NRT First access credential added to Application or Service Principal where no credential was present | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where there was no previous verify KeyCredential associated. If a threat actor obtains a... |
| NRT New access credential added to Application or Service Principal | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where a verify KeyCredential was already present for the app. If a threat actor obtains ... |
| NRT PIM Elevation Request Rejected | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when a user is rejected for a privileged role elevation via PIM. Monitor rejections for indicators of attacker compromise of the requesting account. Ref : https://docs.microsoft.com/azure/a... |
| NRT Privileged Role Assigned Outside PIM | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies a privileged role being assigned to a user outside of PIM Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1 |
| NRT User added to Microsoft Entra ID Privileged Groups | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-aud... |
| PIM Elevation Request Rejected | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when a user is rejected for a privileged role elevation via PIM. Monitor rejections for indicators of attacker compromise of the requesting account. Ref : https://docs.microsoft.com/azure/a... |
| Possible SignIn from Azure Backdoor | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when a user adds an unverified domain as an authentication method, followed by a sign-in from a user the newly added domain. Threat actors may add custom domains to create a backdoor to you... |
| Privileged Accounts - Sign in Failure Spikes | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies spike in failed sign-ins from Privileged accounts. Privileged accounts list can be based on IdentityInfo UEBA table. Spike is determined based on Time series anomaly which will look at his... |
| Privileged Role Assigned Outside PIM | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies a privileged role being assigned to a user outside of PIM Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1 |
| Rare application consent | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when the "Consent to application" operation occurs by a user that has not done this operation before or rarely does this. This could indicate that permissions to access the listed Azur... |
| Password spray attack against Microsoft Entra ID Seamless SSO | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query detects when there is a spike in Microsoft Entra ID Seamless SSO errors. They may not be caused by a Password Spray attack, but the cause of the errors might need to be investigated. Micros... |
| GitHub Signin Burst from Multiple Locations | Analytic Rule | 📦 Solution | Microsoft Entra ID | This detection triggers when there is a Signin burst from multiple locations in GitHub (Entra ID SSO). This detection is based on configurable threshold which can be prone to false positives. To view... |
| Sign-ins from IPs that attempt sign-ins to disabled accounts | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies IPs with failed attempts to sign in to one or more disabled accounts using the IP through which successful signins from other accounts have happened. This could indicate an attacker who obt... |
| Brute force attack against Azure Portal | Analytic Rule | 📦 Solution | Microsoft Entra ID | Detects Azure Portal brute force attacks by monitoring for multiple authentication failures and a successful login within a 20-minute window. Default settings: 10 failures, 25 deviations. Ref: https:/... |
| Password spray attack against Microsoft Entra ID application | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies evidence of password spray activity against Microsoft Entra ID applications by looking for failures from multiple accounts from the same IP address within a time window. If the number of ac... |
| Successful logon from IP and failure from a different IP | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when a user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guess... |
| Suspicious Entra ID Joined Device Update | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query looks for suspicious updates to an Microsoft Entra ID joined device where the device name is changed and the device falls out of compliance. This could occur when a threat actor updates the... |
| Suspicious application consent for offline access | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user consents to provide a previously-unknown Azure application with offline access via OAuth. Offline access will provide the Azure App with access to the listed resources with... |
| Suspicious Service Principal creation activity | Analytic Rule | 📦 Solution | Microsoft Entra ID | This alert will detect creation of an SPN, permissions granted, credentials created, activity and deletion of the SPN in a time frame (default 10 minutes) |
| Suspicious Sign In Followed by MFA Modification | Analytic Rule | 📦 Solution | Microsoft Entra ID | This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user. |
| External guest invitation followed by Microsoft Entra ID PowerShell signin | Analytic Rule | 📦 Solution | Microsoft Entra ID | By default guests have capability to invite more external guest users, guests also can do suspicious Microsoft Entra ID enumeration. This detection look at guest users, who have been invited or have i... |
| User Accounts - Sign in Failure due to CA Spikes | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies spike in failed sign-ins from user accounts due to conditional access policied. Spike is determined based on Time series anomaly which will look at historical baseline values. Ref : https:... |
| User added to Microsoft Entra ID Privileged Groups | Analytic Rule | 📦 Solution | Microsoft Entra ID | This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-aud... |
| User Assigned New Privileged Role | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when a new eligible or active privileged role is assigned to a user. Does not alert on PIM activations. Any account eligible for a role is now being given privileged access. If the assignme... |
| New User Assigned to Privileged Role | Analytic Rule | 📦 Solution | Microsoft Entra ID | Identifies when a privileged role is assigned to a new user. Any account eligible for a role is now being given privileged access. If the assignment is unexpected or into a role that isn't the respons... |
| AzureActiveDirectoryAuditLogs | Workbook | 📦 Solution | Microsoft Entra ID | |
| AzureActiveDirectorySignins | Workbook | 📦 Solution | Microsoft Entra ID | |
| ConditionalAccessSISM | Workbook | 📦 Solution | Microsoft Entra ID | |
| Revoke-Entra ID SignInSessions alert trigger | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will revoke all signin sessions for the user using Graph API. It will send an email to the user's manager. |
| Revoke Entra ID Sign-in session using entity trigger | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will revoke user's sign-in sessions and user will have to perform authentication again. It invalidates all the refresh tokens issued to applications for a user (as well as session cookie... |
| Revoke Entra ID SignIn Sessions - incident trigger | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will revoke all signin sessions for the user using Graph API. It will send an email to the user's manager. |
| Reset Microsoft Entra ID User Password - Alert Trigger | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will reset the user password using Graph API. It will send the password (which is a random guid substring) to the user's manager. The user will have to reset the password upon login. |
| Reset Microsoft Entra ID User Password - Entity trigger | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will reset the user password using Graph API. It will send the password (which is a random guid substring) to the user's manager. The user will have to reset the password upon login. |
| Reset Microsoft Entra ID User Password - Incident Trigger | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will reset the user password using Graph API. It will send the password (which is a random guid substring) to the user's manager. The user will have to reset the password upon login. |
| Prompt User - Alert | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will ask the user if they completed the action from the alert in Microsoft Sentinel. If so, it will close the incident and add a comment. If not, it will post a message to teams for the ... |
| Prompt User - Incident | Playbook | 📦 Solution | Microsoft Entra ID | This playbook will ask the user if they completed the action from the Incident in Microsoft Sentinel. If so, it will close the incident and add a comment. If not, it will post a message to teams for t... |
| Block Microsoft Entra ID user - Alert | Playbook | 📦 Solution | Microsoft Entra ID | For each account entity included in the alert, this playbook will disable the user in Microsoft Entra ID, add a comment to the incident that contains this alert and notify manager if available. Note: ... |
| Block Microsoft Entra ID user - Entity trigger | Playbook | 📦 Solution | Microsoft Entra ID | This playbook disables the selected user (account entity) in Microsoft Entra ID. If this playbook triggered from an incident context, it will add a comment to the incident. This playbook will notify t... |
| Block Entra ID user - Incident | Playbook | 📦 Solution | Microsoft Entra ID | For each account entity included in the incident, this playbook will disable the user in Microsoft Entra ID, add a comment to the incident that contains this alert and notify manager if available. Not... |
| ConditionalAccessBenignStatusCodes | Watchlist | 📦 Solution | Microsoft Entra ID | |
| Correlate Unfamiliar sign-in properties & atypical travel alerts | Analytic Rule | 📦 Solution | Microsoft Entra ID Protection | The combination of an Unfamiliar sign-in properties alert and an Atypical travel alert about the same user within a +10m or -10m window is considered a high severity incident. |
| Identity Protection response from Teams | Playbook | 📦 Solution | Microsoft Entra ID Protection | Run this playbook on incidents which contains suspicious Microsoft Entra ID identities. For each account, this playbook posts an adaptive card in the SOC Microsoft Teams channel, including the potenti... |
| Dismiss Microsoft Entra ID Risky User - Alert Triggered | Playbook | 📦 Solution | Microsoft Entra ID Protection | This playbook will dismiss the Risky User property in Microsoft Entra ID using Microsoft Entra ID Connectors. |
| Dismiss Microsoft Entra ID Risky User – Incident Triggered | Playbook | 📦 Solution | Microsoft Entra ID Protection | This playbook will dismiss the Risky User property in Microsoft Entra ID using Microsoft Entra ID Connectors. |
| Confirm Microsoft Entra ID Risky User - Alert Triggered | Playbook | 📦 Solution | Microsoft Entra ID Protection | This playbook will set the Risky User property in Microsoft Entra ID using Graph API. |
| Confirm Microsoft Entra ID Risky User - Incident Triggered | Playbook | 📦 Solution | Microsoft Entra ID Protection | For each account entity included in the incident, this playbook will set the Risky User property in Microsoft Entra ID using Graph API using a Beta API. |
| VIP Mailbox manipulation | Analytic Rule | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox. |
| Server Oriented Cmdlet And User Oriented Cmdlet used | Analytic Rule | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | Detect if a server oriented cmdlet and a user oriented cmdlet that are monitored are launched by the same user in the same server within a 10 minutes timeframe |
| Microsoft Exchange Admin Activity | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| Microsoft Exchange Least Privilege with RBAC | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| Microsoft Exchange Search AdminAuditLog | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| Microsoft Exchange Security Review | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| ExchangeAdminAuditLogs | Parser | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| ExchangeConfiguration | Parser | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| ExchangeEnvironmentList | Parser | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| MESCheckVIP | Parser | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| MESCompareDataOnPMRA | Parser | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| ExchangeServicesMonitoring | Watchlist | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| ExchangeVIP | Watchlist | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | |
| Microsoft Exchange Admin Activity - Online | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| Microsoft Exchange Least Privilege with RBAC - Online | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| Microsoft Exchange Search AdminAuditLog - Online | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| Microsoft Exchange Security Review - Online | Workbook | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| ExchangeConfiguration | Parser | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| ExchangeEnvironmentList | Parser | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| MESCheckOnlineVIP | Parser | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| MESCompareDataMRA | Parser | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| MESOfficeActivityLogs | Parser | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| ExchOnlineVIP | Watchlist | 📦 Solution | Microsoft Exchange Security - Exchange Online | |
| MicrosoftPowerBIActivityWorkbook | Workbook | 📦 Solution | Microsoft PowerBI | |
| Sensitive Data Discovered in the Last 24 Hours | Analytic Rule | 📦 Solution | Microsoft Purview | Identifies all classifications that have been detected on assets during a scan by Microsoft Purview within the last 24 hours. |
| Sensitive Data Discovered in the Last 24 Hours - Customized | Analytic Rule | 📦 Solution | Microsoft Purview | Customized query used to identify specific classifications and parameters that have been discovered on assets in the last 24 hours by Microsoft Purview. By default, the query identifies Social Securit... |
| MicrosoftPurview | Workbook | 📦 Solution | Microsoft Purview | |
| Failed Logon Attempts on SQL Server | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This query detects failed logons on SQL Server using the SQLEvent KQL Parser function. |
| Failed Logon on SQL Server from Same IPAddress in Short time Span | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This query detects multiple failed logon attempts from the same IP within a short span of time. It relies on the SQLEvent KQL Parser function. |
| Multiple Failed Logon on SQL Server in Short time Span | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This query looks multiple failed logon attempts from the same IP within a short span of time. It relies on the SQLEvent KQL Parser function. |
| New User created on SQL Server | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This query detects new user creation from SQL Server using the SQLEvent KQL Parser function. |
| User added to SQL Server SecurityAdmin Group | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This hunting query identifies user added in the SecurityAdmin group of SQL Server. |
| SQL User deleted from Database | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This hunting query identifies deletion of user from SQL Database. It relies on the SQLEvent KQL Parser function. |
| User removed from SQL Server SecurityAdmin Group | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This hunting query identifies user removed from the SecurityAdmin group of SQL Server. It relies on the SQLEvent KQL Parser function. |
| User removed from SQL Server Roles | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This hunting query identifies user removed from a SQL Server Role. It relies on the SQLEvent KQL Parser function. |
| User Role altered on SQL Server | Hunting Query | 📦 Solution | Microsoft Windows SQL Server Database Audit | This hunting query identifies user role altered on SQL Server. It relies on the SQLEvent KQL Parser function. |
| Aqua Blizzard AV hits - Feb 2022 | Analytic Rule | 📦 Solution | MicrosoftDefenderForEndpoint | Identifies a match in the Security Alert table for MDATP hits related to the Aqua Blizzard actor |
| SUNBURST suspicious SolarWinds child processes | Hunting Query | 📦 Solution | MicrosoftDefenderForEndpoint | Identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor |
| Probable AdFind Recon Tool Usage | Hunting Query | 📦 Solution | MicrosoftDefenderForEndpoint | Identifies the host and account that executed AdFind by hash and filename in addition to common and unique flags that are used by many threat actors in discovery. |
| Unisolate MDE Machine using entity trigger | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will unisolate Microsoft Defender for Endpoint (MDE) device using entity trigger. |
| Unisolate MDE Machine - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will release a machine from isolation in Microsoft Defender for Endpoint. It is triggered by an alert in Microsoft Sentinel. |
| Unisolate MDE Machine - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will release a machine from isolation in Microsoft Defender for Endpoint. It is triggered by an incident creation in Microsoft Sentinel. The playbook will search for the host entity in t... |
| Run MDE Antivirus - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will run a antivirus (full) scan on the machine in Microsoft Defender for Endpoint. It is triggered by an alert in Microsoft Sentinel. |
| Run MDE Antivirus - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will run a antivirus (full) scan on the machine in Microsoft Defender for Endpoint. It is triggered by an incident creation in Microsoft Sentinel. The playbook will look for the host ent... |
| Restrict MDE Url - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take Url entities and generate alert and block threat indicators for each IP in MDE for 90 days. |
| Restrict MDE URL - Entity Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take the triggering entity and generate an alert and block threat indicator for the URL in MDE for 90 days. |
| Restrict MDE Url - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take Url entities and generate alert and block threat indicators for each IP in MDE for 90 days. |
| Restrict MDE Ip Address - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take IP entities and generate alert and block threat indicators for each IP in MDE for 90 days. |
| Restrict MDE Ip Address - Entity Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will and generate alert and block threat indicators for the IP entity in MDE for 90 days. |
| Restrict MDE Ip Address - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take IP entities and generate alert and block threat indicators for each IP in MDE for 90 days. |
| Restrict MDE FileHash - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take FileHash entities and generate alert and block threat indicators for each file hash in MDE for 90 days. It will also add a comment to the incident with the file hash and action... |
| Restrict MDE FileHash - Entity Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take the triggering FileHash entity and generate an alert and block threat indicator for the file hash in MDE for 90 days. It will also add a comment to the incident with the file h... |
| Restrict MDE FileHash - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take FileHash entities and generate alert and block threat indicators for each file hash in MDE for 90 days. |
| Restrict MDE Domain - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This play book will take DNS entities and generate alert and block threat indicators for each domain in Microsoft Defender for Endpoint for 90 days. |
| Restrict MDE Domain - Entity Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will take the triggering entity and generate an alert and block threat indicator for the domain in MDE for 90 days. |
| Restrict MDE Domain - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This play book will take DNS entities and generate alert and block threat indicators for each domain in Microsoft Defender for Endpoint for 90 days. |
| Restrict MDE App Execution - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will restrict app execution on the machine in Microsoft Defender for Endpoint. |
| Restrict MDE App Execution - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will restrict app execution on the machine in Microsoft Defender for Endpoint. |
| Isolate MDE Machine using entity trigger | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will isolate Microsoft Defender for Endpoint MDE device using entity trigger. It will be triggered by Microsoft Sentinel when an entity of type 'Host' is detected in an incident. The pla... |
| Isolate MDE Machine - Alert Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will isolate (full) the machine in Microsoft Defender for Endpoint. It is triggered by an alert in Microsoft Sentinel. The playbook will add a comment to the incident with the result of ... |
| Isolate endpoint - MDE - Incident Triggered | Playbook | 📦 Solution | MicrosoftDefenderForEndpoint | This playbook will isolate (full) the machine in Microsoft Defender for Endpoint. It is triggered by an incident in Microsoft Sentinel. |
| AssignedIPAddress | Parser | 📦 Solution | MicrosoftDefenderForEndpoint | |
| Devicefromip | Parser | 📦 Solution | MicrosoftDefenderForEndpoint | |
| Insider Risk_High User Security Alert Correlations | Analytic Rule | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This alert joins SecurityAlerts from Microsoft Products with SecurityIncidents from Microsoft Sentinel and Microsoft Defender XDR. This join allows for identifying patterns in user principal names ass... |
| Insider Risk_High User Security Incidents Correlation | Analytic Rule | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This alert joins SecurityAlerts to SecurityIncidents to associate Security Alerts and Incidents with user accounts. This aligns all Microsoft Alerting Products with Microsoft Incident Generating Produ... |
| Insider Risk_Microsoft Purview Insider Risk Management Alert Observed | Analytic Rule | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This alert is triggered when a Microsoft Purview Insider Risk Management alert is recieved in Microsoft Sentinel via the Microsoft Purview Insider Risk Management Connector. The alert extracts usernam... |
| Insider Risk_Sensitive Data Access Outside Organizational Geo-location | Analytic Rule | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This alert joins Azure Information Protection Logs (InformationProtectionLogs_CL) with Microsoft Entra ID Sign in Logs (SigninLogs) to provide a correlation of sensitive data access by geo-location. R... |
| Insider Risk_Risky User Access By Application | Analytic Rule | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This alert evaluates Microsoft Entra ID Sign in risk via Machine Learning correlations in the basket operator. The basket threshold is adjustable, and the default is set to .01. There is an optional c... |
| Insider Risk_Entity Anomaly Followed by IRM Alert | Hunting Query | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This query joins Microsoft Sentinel Entity Insights with Microsoft Purview Insider Risk Management Alerts. There is also an option for configuration of correlations against watchlists. For more inform... |
| Insider Risk_ISP Anomaly to Exfil | Hunting Query | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This query joins UEBA to Security Alerts from Microsoft products for a correlation of Internet Service Provider anomalies to data exfiltration (watchlist options). For more information, see https://do... |
| Insider Risk_Multiple Entity-Based Anomalies | Hunting Query | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This query returns entity counts by anomaly and user principal name including ranges for start/end time observed (watchlists configurable). For more information, see https://docs.microsoft.com/azure/s... |
| Insider Risk_Possible Sabotage | Hunting Query | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This query correlates users with entity anomalies, security alerts, and delete/remove actions for identification of possible sabotage activities (watchlists configurable). For more information, see ht... |
| Insider Risk_Sign In Risk Followed By Sensitive Data Access | Hunting Query | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This query correlates a risky user sign ins with access to sensitive data classified by data loss prevention capabilities (watchlist configurable). For more information, see https://docs.microsoft.com... |
| InsiderRiskManagement | Workbook | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | |
| Notify-InsiderRiskTeam | Playbook | 📦 Solution | MicrosoftPurviewInsiderRiskManagement | This playbook should be configured as an automation action with the Insider Risk Management Analytics Rules. Upon triggering an Analytic Rule, this playbook captures respective details and both emails... |
| Mimecast Audit - Logon Authentication Failed | Analytic Rule | 📦 Solution | Mimecast | Detects threat when logon authentication failure found in audit |
| Mimecast Secure Email Gateway - Attachment Protect | Analytic Rule | 📦 Solution | Mimecast | Detect threat for mail attachment under the targeted threat protection. |
| Mimecast Secure Email Gateway - AV | Analytic Rule | 📦 Solution | Mimecast | Detects threats from email anti virus scan. |
| Mimecast Secure Email Gateway - Impersonation Protect | Analytic Rule | 📦 Solution | Mimecast | Detects threats from impersonation mail under targeted threat protection. |
| Mimecast Secure Email Gateway - Internal Email Protect | Analytic Rule | 📦 Solution | Mimecast | Detects threats from internal email threat protection. |
| Mimecast Secure Email Gateway - Spam Event Thread | Analytic Rule | 📦 Solution | Mimecast | Detects threat from spam event thread protection logs. |
| Mimecast Secure Email Gateway - URL Protect | Analytic Rule | 📦 Solution | Mimecast | Detect threat when potentially malicious url found. |
| Mimecast Secure Email Gateway - Virus | Analytic Rule | 📦 Solution | Mimecast | Detect threat for virus from mail receipt virus event. |
| Mimecast Data Leak Prevention - Hold | Analytic Rule | 📦 Solution | Mimecast | Detects threat for data leak when action is hold |
| Mimecast Data Leak Prevention - Notifications | Analytic Rule | 📦 Solution | Mimecast | Detects threat for data leak when action is notification |
| Mimecast Targeted Threat Protection - Attachment Protect | Analytic Rule | 📦 Solution | Mimecast | Detects a threat for an unsafe attachment in an email. |
| Mimecast Targeted Threat Protection - Impersonation Protect | Analytic Rule | 📦 Solution | Mimecast | Detects a maliciously tagged impersonation. |
| Mimecast Targeted Threat Protection - URL Protect | Analytic Rule | 📦 Solution | Mimecast | Detects malicious scan results and actions which are not allowed. |
| Mimecast_Audit_Workbook | Workbook | 📦 Solution | Mimecast | |
| Mimecast_Awareness_Training_Workbook | Workbook | 📦 Solution | Mimecast | |
| Mimecast_Cloud_Integrated_Workbook | Workbook | 📦 Solution | Mimecast | |
| Mimecast_SEG_Workbook | Workbook | 📦 Solution | Mimecast | |
| Mimecast_TTP_Workbook | Workbook | 📦 Solution | Mimecast | |
| Mimecast-Data-Connector-Trigger-Sync | Playbook | 📦 Solution | Mimecast | Playbook to sync timer trigger of all Mimecast data connectors. |
| Mimecast_AT_Performane_Detail | Parser | 📦 Solution | Mimecast | |
| Mimecast_AT_Safe_Score | Parser | 📦 Solution | Mimecast | |
| Mimecast_AT_User_Data | Parser | 📦 Solution | Mimecast | |
| Mimecast_AT_Watchlist | Parser | 📦 Solution | Mimecast | |
| Mimecast_Audit | Parser | 📦 Solution | Mimecast | |
| Mimecast_Cloud_Integrated | Parser | 📦 Solution | Mimecast | |
| Mimecast_SEG_CG | Parser | 📦 Solution | Mimecast | |
| Mimecast_SEG_DLP | Parser | 📦 Solution | Mimecast | |
| Mimecast_TTP_Attachment | Parser | 📦 Solution | Mimecast | |
| Mimecast_TTP_Impersonation | Parser | 📦 Solution | Mimecast | |
| Mimecast_TTP_Url | Parser | 📦 Solution | Mimecast | |
| Mimecast Audit - Logon Authentication Failed | Analytic Rule | 📦 Solution | MimecastAudit | Detects threat when logon authentication failure found in audit |
| MimecastAudit | Workbook | 📦 Solution | MimecastAudit | |
| Mimecast Data Leak Prevention - Notifications | Analytic Rule | 📦 Solution | MimecastSEG | Detects threat for data leak when action is notification |
| Mimecast Data Leak Prevention - Hold | Analytic Rule | 📦 Solution | MimecastSEG | Detects threat for data leak when action is hold |
| Mimecast Secure Email Gateway - Attachment Protect | Analytic Rule | 📦 Solution | MimecastSEG | Detect threat for mail attachment under the targeted threat protection |
| Mimecast Secure Email Gateway - AV | Analytic Rule | 📦 Solution | MimecastSEG | Detects threats from email anti virus scan |
| Mimecast Secure Email Gateway - Impersonation Protect | Analytic Rule | 📦 Solution | MimecastSEG | Detects threats from impersonation mail under targeted threat protection |
| Mimecast Secure Email Gateway - Internal Email Protect | Analytic Rule | 📦 Solution | MimecastSEG | Detects threats from internal email threat protection |
| Mimecast Secure Email Gateway - Spam Event Thread | Analytic Rule | 📦 Solution | MimecastSEG | Detects threat from spam event thread protection logs |
| Mimecast Secure Email Gateway - URL Protect | Analytic Rule | 📦 Solution | MimecastSEG | Detect threat when potentially malicious url found |
| Mimecast Secure Email Gateway - Virus | Analytic Rule | 📦 Solution | MimecastSEG | Detect threat for virus from mail receipt virus event |
| MimecastSEGworkbook | Workbook | 📦 Solution | MimecastSEG | |
| MimecastTIRegional | Workbook | 📦 Solution | MimecastTIRegional | |
| Mimecast Targeted Threat Protection - Attachment Protect | Analytic Rule | 📦 Solution | MimecastTTP | Detects a threat for an unsafe attachment in an email |
| Mimecast Targeted Threat Protection - Impersonation Protect | Analytic Rule | 📦 Solution | MimecastTTP | Detects a maliciously tagged impersonation |
| Mimecast Targeted Threat Protection - URL Protect | Analytic Rule | 📦 Solution | MimecastTTP | Detects malicious scan results and actions which are not allowed |
| MimecastTTPWorkbook | Workbook | 📦 Solution | MimecastTTP | |
| Create Indicator - Minemeld | Playbook | 📦 Solution | Minemeld | This playbook search for indicators in Minemeld related to the entities(IP, filehash, URL) gathered from Sentinel incident. If the search result is positive a comment stating the indicator is already ... |
| Entity (IP, URL, FileHash) Enrichment - Minemeld | Playbook | 📦 Solution | Minemeld | This playbook search for indicators in Minemeld related to the entities(IP, filehash, URL) gathered from Sentinel incident. If the search result is positive a comment will be added to enrich the incid... |
| MongoDBAudit | Parser | 📦 Solution | MongoDBAudit | |
| Critical Severity Incident | Analytic Rule | 📦 Solution | Morphisec | Triggers an incident for every Morphisec alert whose attacks severity is critical. |
| Device Alert Surge | Analytic Rule | 📦 Solution | Morphisec | Triggers an incident when a device generates 5 or more Medium or High severity alerts, indicating potential compromise. |
| Process-Level Anomaly | Analytic Rule | 📦 Solution | Morphisec | Triggers an incident when the same process name appears in 50 or more alerts across multiple devices, suggesting widespread activity. |
| Morphisec | Parser | 📦 Solution | Morphisec | |
| MuleSoftCloudhub | Parser | 📦 Solution | Mulesoft | |
| Cross-Cloud Password Spray detection | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This detection focuses on identifying potential cross-cloud brute force / Password Spray attempts involving Azure and AWS platforms. It monitors sign-in activities within the Azure Portal and AWS Cons... |
| Cross-Cloud Suspicious Compute resource creation in GCP | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This detection identifies potential suspicious activity across multi-cloud environments by combining AWS GuardDuty findings with GCP Audit Logs. It focuses on AWS activities related to unauthorized a... |
| Cross-Cloud Suspicious user activity observed in GCP Envourment | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This detection query aims to correlate potentially suspicious user activities logged in Google Cloud Platform (GCP) Audit Logs with security alerts originating from Microsoft Security products. This c... |
| Cross-Cloud Unauthorized Credential Access Detection From AWS RDS Login | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This detection correlates AWS GuardDuty Credential Access alerts related to Amazon Relational Database Service (RDS) activity with Azure portal sign-in activities. It identifies successful and failed ... |
| Successful AWS Console Login from IP Address Observed Conducting Password Spray | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This query aims to detect instances of successful AWS console login events followed by multiple failed app logons alerts generated by Microsoft Cloud App Security or password spray alerts generated by... |
| Suspicious AWS console logins by credential access alerts | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This query aims to detect instances of successful AWS console logins that align with high-severity credential access or Initial Access alerts generated by Defender Products. Specifically, it focuses ... |
| Unauthorized user access across AWS and Azure | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This detection compiles and correlates unauthorized user access alerts originating from AWS GuardDuty with Azure portal sign-in activities. It focuses on AWS GuardDuty alerts related to unauthorized u... |
| User impersonation by Identity Protection alerts | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This detection focuses on identifying user-related events involving IAM roles, groups, user access, and password changes. It examines instances where the user's IP address matches and alerts generated... |
| High-Risk Cross-Cloud User Impersonation | Analytic Rule | 📦 Solution | Multi Cloud Attack Coverage Essentials - Resource Abuse | This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs ... |
| Ransomware Attack Detected | Analytic Rule | 📦 Solution | Nasuni | Identifies ransomware attacks detected by the Ransomware Protection service running on a Nasuni Edge Appliance. |
| Ransomware Client Blocked | Analytic Rule | 📦 Solution | Nasuni | Identifies malicious clients blocked by the Ransomware Protection service running on a Nasuni Edge Appliance. |
| Nasuni File Delete Activity | Hunting Query | 📦 Solution | Nasuni | This query looks for file delete audit events generated by a Nasuni Edge Appliance. |
| NucleusCyber_NCProtect_Workbook | Workbook | 📦 Solution | NC Protect Data Connector | |
| NCSCNLShareSTIXBundle | Playbook | 📦 Solution | NCSC-NL NDN Cyber Threat Intelligence Sharing | This playbook gets triggered every hour and perform the following actions: 1. Get all the threat intelligence indicators from Microsoft Sentinel Workspace with given tag. 2. Filter all the indicators ... |
| NetApp Ransomware Resilience Authentication Playbook | Playbook | 📦 Solution | NetApp Ransomware Resilience | This playbook creates a shared Key Vault for NetApp Ransomware Resilience credentials and provides authentication services to all NetApp Ransomware Resilience playbooks in the solution. |
| NetApp RRS Manual IP to Volume Offline | Playbook | 📦 Solution | NetApp Ransomware Resilience | Manually trigger playbook to take a volume offline based on IP address enrichment |
| NetApp Ransomware Resilience Async Poll Playbook | Playbook | 📦 Solution | NetApp Ransomware Resilience | This playbook polls NetApp Ransomware Resilience job status asynchronously until completion or timeout using the updated job status API endpoint. |
| NetApp Ransomware Resilience Enrich IP Playbook | Playbook | 📦 Solution | NetApp Ransomware Resilience | This playbook enriches IP data by calling the updated NetApp Ransomware Resilience enrich IP address API endpoint and asynchronously polls multiple job results. |
| NetApp Ransomware Resilience Enrich StorageVM Playbook | Playbook | 📦 Solution | NetApp Ransomware Resilience | This playbook enriches storage data by calling the updated NetApp Ransomware Resilience enrich storage API endpoint. |
| NetApp Ransomware Resilience Volume Offline Playbook | Playbook | 📦 Solution | NetApp Ransomware Resilience | This playbook takes a NetApp volume offline using the updated NetApp Ransomware Resilience take-volume-offline API endpoint and optionally polls for completion. |
| NetApp Ransomware Resilience Volume Snapshot Playbook | Playbook | 📦 Solution | NetApp Ransomware Resilience | This playbook creates a NetApp volume snapshot using the updated NetApp Ransomware Resilience take-snapshot API endpoint and optionally polls for completion. |
| NetClean ProActive Incidents | Analytic Rule | 📦 Solution | NetClean ProActive | NetClean Incident |
| NetCleanProActiveWorkbook | Workbook | 📦 Solution | NetClean ProActive | |
| NetskopeEvents | Workbook | 📦 Solution | Netskope | |
| Netskope 🔍 | Parser | 📦 Solution | Netskope | |
| Netskope - WebTransaction Error Detection | Analytic Rule | 📦 Solution | Netskopev2 | Rule helps to track error occurred in Netskope WebTransaction Data Connector. |
| NetskopeCCFWebtxDashboard | Workbook | 📦 Solution | Netskopev2 | |
| NetskopeCCPDashboard | Workbook | 📦 Solution | Netskopev2 | |
| NetskopeCEDashboard | Workbook | 📦 Solution | Netskopev2 | |
| NetskopeDashboard | Workbook | 📦 Solution | Netskopev2 | |
| NetskopeDataConnectorsTriggerSync | Playbook | 📦 Solution | Netskopev2 | Playbook to sync timer trigger of all Netskope data connectors. |
| NetskopeWebTxErrorEmail | Playbook | 📦 Solution | Netskopev2 | This playbook sends email when Netskope Web Transaction data connector error is detected. |
| AlertsCompromisedCredential | Parser | 📦 Solution | Netskopev2 | |
| AlertsCtep | Parser | 📦 Solution | Netskopev2 | |
| AlertsDLP | Parser | 📦 Solution | Netskopev2 | |
| AlertsMalsite | Parser | 📦 Solution | Netskopev2 | |
| AlertsMalware | Parser | 📦 Solution | Netskopev2 | |
| AlertsPolicy | Parser | 📦 Solution | Netskopev2 | |
| AlertsQuarantine | Parser | 📦 Solution | Netskopev2 | |
| AlertsRemediation | Parser | 📦 Solution | Netskopev2 | |
| AlertsSecurityAssessment | Parser | 📦 Solution | Netskopev2 | |
| AlertsUba | Parser | 📦 Solution | Netskopev2 | |
| EventIncident | Parser | 📦 Solution | Netskopev2 | |
| EventsApplication | Parser | 📦 Solution | Netskopev2 | |
| EventsAudit | Parser | 📦 Solution | Netskopev2 | |
| EventsConnection | Parser | 📦 Solution | Netskopev2 | |
| EventsNetwork | Parser | 📦 Solution | Netskopev2 | |
| EventsPage | Parser | 📦 Solution | Netskopev2 | |
| NetskopeAlerts | Parser | 📦 Solution | Netskopev2 | |
| NetskopeCCFWebTransactions | Parser | 📦 Solution | Netskopev2 | |
| NetskopeCEAlerts | Parser | 📦 Solution | Netskopev2 | |
| NetskopeCEEventsApplication | Parser | 📦 Solution | Netskopev2 | |
| NetskopeCEWebTransactions | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsApplication | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsAudit | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsConnection | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsDLP | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsEndpoint | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsInfrastructure | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsNetwork | Parser | 📦 Solution | Netskopev2 | |
| NetskopeEventsPage | Parser | 📦 Solution | Netskopev2 | |
| NetskopeWebTransactions | Parser | 📦 Solution | Netskopev2 | |
| Netskope - Anomalous User Behavior (High Volume from Unmanaged Device) | Analytic Rule | 📦 Solution | NetskopeWebTx | Detects anomalous user behavior including high data volume transfers from unmanaged devices, unusual access patterns, and suspicious application usage. |
| Netskope - Unsanctioned/Risky Cloud App Access (Shadow IT) | Analytic Rule | 📦 Solution | NetskopeWebTx | Alerts when users access unsanctioned or risky cloud applications based on Cloud Confidence Level (CCL) and app tags. Detects Shadow IT usage. |
| Netskope - Data Movement Tracking (Upload/Download Monitoring) | Analytic Rule | 📦 Solution | NetskopeWebTx | Tracks file uploads and downloads, monitoring data movement direction, size, and destination. Provides visibility into data flow patterns. |
| Netskope - Excessive Downloads Detection (Spike vs Baseline) | Analytic Rule | 📦 Solution | NetskopeWebTx | Detects users with excessive download activity compared to their 7-day baseline. Triggers when current download volume exceeds 3x the average. |
| Netskope - Heavy Personal Cloud Storage Usage (Shadow IT) | Analytic Rule | 📦 Solution | NetskopeWebTx | Detects heavy usage of personal cloud storage applications like personal Dropbox, Google Drive, OneDrive personal, etc. Indicates potential Shadow IT or data leakage risk. |
| Netskope - Impossible Travel Detection (Two Countries in Less Than 1 Hour) | Analytic Rule | 📦 Solution | NetskopeWebTx | Detects when a user accesses resources from two distinct countries within less than 1 hour, indicating potential credential compromise or VPN abuse. |
| Netskope - Large Outbound Data Transfer / Sensitive Upload (DLP) | Analytic Rule | 📦 Solution | NetskopeWebTx | Detects large outbound data transfers and sensitive file uploads. Monitors for potential data exfiltration via cloud applications. |
| Netskope - New Risky App Access vs 7-Day Baseline | Analytic Rule | 📦 Solution | NetskopeWebTx | Compares today's accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before. |
| Netskope - Repeated or Critical Policy Violations | Analytic Rule | 📦 Solution | NetskopeWebTx | Detects users with repeated policy violations or critical policy blocks. Monitors policy enforcement effectiveness and compliance. |
| Netskope - Suspicious Network Context (Unusual IPs/Geo/Ports) | Analytic Rule | 📦 Solution | NetskopeWebTx | Detects suspicious network activity based on unusual source/destination IPs, geographic anomalies, uncommon ports, and high traffic volumes. |
| NetskopeWebTx_Workbook | Workbook | 📦 Solution | NetskopeWebTx | |
| NetskopeWebtx | Parser | 📦 Solution | NetskopeWebTx | |
| Anomaly in SMB Traffic(ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This detection detects abnormal SMB traffic, a file-sharing protocol. By calculating the average deviation of SMB connections over last 14 days, flagging sources exceeding 50 average deviations. |
| Anomaly found in Network Session Traffic (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | The rule identifies anomalous pattern in network session traffic based on previously seen data, different Device Action, Network Protocol, Network Direction or overall volume. The rule utilize [ASIM](... |
| Detect port misuse by anomaly based detection (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This rule detects anomalous pattern in port usage. The rule utilize [ASIM](https://aka.ms/AboutASIM) normalization, and is applied to any source which supports the ASIM Network Session schema. To tune... |
| Detect port misuse by static threshold (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This detection rule detects port usage above the configured threshold. The rule utilize [ASIM](https://aka.ms/AboutASIM) normalization, and is applied to any source which supports the ASIM Network Ses... |
| Excessive number of failed connections from a single source (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive ... |
| Network Port Sweep from External Network (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This detection rule detects scenarios when a particular port is being scanned by multiple external sources. The rule utilize [ASIM](https://aka.ms/AboutASIM) normalization, and is applied to any sourc... |
| Port scan detected (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port scanner](https://en.wikipedi... |
| Potential beaconing activity (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated... |
| Remote Desktop Network Brute force (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Network Session Essentials | This detection identifies RDP application network traffic and filters any source/destination pair generating more than 25 events hard threshold. |
| Detect Outbound LDAP Traffic(ASIM Network Session schema) | Hunting Query | 📦 Solution | Network Session Essentials | Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall... |
| Detect port misuse by anomaly (ASIM Network Session schema) | Hunting Query | 📦 Solution | Network Session Essentials | This hunting query detect anomalous pattern in port usage with ASIM normalization. To tune the query to your environment configure it using the 'NetworkSession_Monitor_Configuration' watchlist. |
| Detect port misuse by static threshold (ASIM Network Session schema) | Hunting Query | 📦 Solution | Network Session Essentials | There is an normal amount of traffic that goes on a particular port in any organization. This hunting query identifies port usage higher than threshold defined in 'NetworkSession_Monitor_Configuration... |
| Detects several users with the same MAC address (ASIM Network Session schema) | Hunting Query | 📦 Solution | Network Session Essentials | Ideally one user should be associated with one MAC ID, this hunting query will identify if same MAC ID is associated with more than one user which can be a case of MAC spoofing attack. |
| Mismatch between Destination App name and Destination Port (ASIM Network Session schema) | Hunting Query | 📦 Solution | Network Session Essentials | Every standard app has a port associated with it. This query will identify if destination port associated with destination app is not standard which can be a case of network spoofing attack. |
| Protocols passing authentication in cleartext (ASIM Network Session schema) | Hunting Query | 📦 Solution | Network Session Essentials | This hunting query identifies cleartext protocols like telnet, POP3, IMAP, and non-anonymous FTP that could leak sensitive information. These protocols may use SSL, but usually on different ports. |
| Remote Desktop Network Traffic(ASIM Network Session schema) | Hunting Query | 📦 Solution | Network Session Essentials | This hunting query looks for unusual remote desktop activity by monitoring TCP/3389 traffic. While RDP is common, focus on atypical connections to identify potential threats. |
| NetworkSessionEssentials | Workbook | 📦 Solution | Network Session Essentials | |
| NetworkSessionEssentialsV2 | Workbook | 📦 Solution | Network Session Essentials | |
| Summarize Data for Network Session Essentials | Playbook | 📦 Solution | Network Session Essentials | This playbook summarizes data for Network Session Essentials and lands it into custom tables. |
| NetworkSession_Monitor_Configuration | Watchlist | 📦 Solution | Network Session Essentials | |
| NetworkSummary_Country | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries of traffic between source and destination countries, grou... |
| NetworkSummary_IP | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession function. It creates hourly summaries of traffic between source and destination IP addresses, grouped by ... |
| NetworkSummary_Protocol | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It generates 20-minute summaries of traffic grouped by network protocol, destination por... |
| NetworkSummary_Result | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by event result, network direction, device action... |
| NetworkSummary_Rule | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by rule name, network direction, and device actio... |
| NetworkSummary_SourceInfo | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by product name (vendor-product combination) and ... |
| NetworkSummary_Source_Port | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession function. It creates hourly summaries of traffic grouped by source port, network direction, and device ac... |
| NetworkSummary_Threat | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by threat identifier or name, threat category, ev... |
| NetworkSummary_Threat_IOC | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries of sessions involving threat-related activity, grouped by... |
| NetworkSummary_Country | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries of traffic between source and destination countries, grou... |
| NetworkSummary_IP | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession function. It creates hourly summaries of traffic between source and destination IP addresses, grouped by ... |
| NetworkSummary_Protocol | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It generates 20-minute summaries of traffic grouped by network protocol, destination por... |
| NetworkSummary_Result | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by event result, network direction, device action... |
| NetworkSummary_Rule | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by rule name, network direction, and device actio... |
| NetworkSummary_SourceInfo | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by product name (vendor-product combination) and ... |
| NetworkSummary_Source_Port | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession function. It creates hourly summaries of traffic grouped by source port, network direction, and device ac... |
| NetworkSummary_Threat | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries grouped by threat identifier or name, threat category, ev... |
| NetworkSummary_Threat_IOC | Summary Rule | 📦 Solution | Network Session Essentials | This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSession function. It creates 20-minute summaries of sessions involving threat-related activity, grouped by... |
| Network endpoint to host executable correlation | Analytic Rule | 📦 Solution | Network Threat Protection Essentials | Correlates blocked URLs hosting [malicious] executables with host endpoint data to identify potential instances of executables of the same name having been recently run. |
| New UserAgent observed in last 24 hours | Analytic Rule | 📦 Solution | Network Threat Protection Essentials | Identifies new UserAgents observed in the last 24 hours versus the previous 14 days. This detection extracts words from user agents to build the baseline and determine rareity rather than perform a di... |
| Base64 encoded IPv4 address in request url | Hunting Query | 📦 Solution | Network Threat Protection Essentials | This query detects Base64-encoded IPv4 addresses in outbound request URLs. It uses pre-computed base64 offsets for IPv4 sequences, eliminating the need for decoding. After identifying a candidate,the ... |
| Risky base64 encoded command in URL | Hunting Query | 📦 Solution | Network Threat Protection Essentials | This query detects risky Base64-encoded commands in web requests. It identifies potential C2 server communication and illuminates injected webshells. Note that base64 is case-sensitive, requiring mult... |
| Exploit and Pentest Framework User Agent | Hunting Query | 📦 Solution | Network Threat Protection Essentials | This query detects suspicious user agent strings used by exploit and pen test frameworks.There are several exploit and pen test frameworks that are being used by pen testers as well as attackers to c... |
| NetwrixAuditor | Parser | 📦 Solution | Netwrix Auditor | |
| EnrichIP-GeoInfo-Neustar | Playbook | 📦 Solution | Neustar IP GeoPoint | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets IP Addresses from incident. 2. Gets Geographical location information from Neustart IP... |
| NGINX - Command in URI | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects command in URI |
| NGINX - Core Dump | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts. |
| NGINX - Multiple user agents for single source | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects requests with different user agents from one source in short timeframe. |
| NGINX - Known malicious user agent | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects known malicious user agents |
| NGINX - Multiple client errors from single IP address | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects multiple client errors from one source in short timeframe |
| NGINX - Multiple server errors from single IP address | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects multiple server errors from one source in short timeframe |
| NGINX - Private IP address in URL | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects requests to unusual URL |
| NGINX - Put file and get file from same IP address | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects put or get files from one source in short timeframe |
| NGINX - Request to sensitive files | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects request to sensitive files. |
| NGINX - Sql injection patterns | Analytic Rule | 📦 Solution | NGINX HTTP Server | Detects possible sql injection patterns |
| NGINX - Abnormal request size | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows abnormal request size. |
| NGINX - Rare files requested | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows rare files requested |
| NGINX - Rare URLs requested | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows rare URLs requested. |
| NGINX - Requests from bots and crawlers | Hunting Query | 📦 Solution | NGINX HTTP Server | Query searches requests from bots and crawlers. |
| NGINX - Requests to unexisting files | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows list of requests to unexisting files |
| NGINX - Top files requested | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows list of files requested |
| NGINX - Top files with error requests | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows list of files with error requests. |
| NGINX - Top URLs client errors | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows URLs list with client errors. |
| NGINX - Top URLs server errors | Hunting Query | 📦 Solution | NGINX HTTP Server | Query shows URLs list with server errors. |
| NGINX - Uncommon user agent strings | Hunting Query | 📦 Solution | NGINX HTTP Server | Query searches uncommon user agent strings. |
| NGINX | Workbook | 📦 Solution | NGINX HTTP Server | |
| NGINXHTTPServer | Parser | 📦 Solution | NGINX HTTP Server | |
| NIST SP 800-53 Posture Changed | Analytic Rule | 📦 Solution | NISTSP80053 | This alert is desinged to monitor Azure policies aligned with the NIST SP 800-53 Regulatory Compliance initative. The alert triggers when policy compliance falls below 70% within a 1 week timeframe. |
| NISTSP80053 | Workbook | 📦 Solution | NISTSP80053 | |
| Create-AzureDevOpsTask | Playbook | 📦 Solution | NISTSP80053 | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| Create Jira Issue | Playbook | 📦 Solution | NISTSP80053 | This playbook will open a Jira Issue when a new incident is opened in Microsoft Sentinel. |
| Notify_GovernanceComplianceTeam | Playbook | 📦 Solution | NISTSP80053 | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| NordPass - Domain data detected in breach | Analytic Rule | 📦 Solution | NordPass | This will alert you when Data Breach Scanner discovers data related to your organization's domains on the dark web. !This rule should be enabled only by the organizations that have set up Data Breach... |
| NordPass - Declined invitation | Analytic Rule | 📦 Solution | NordPass | This will alert you when the user declines the invite to the NordPass organization. |
| NordPass - User deletes items in bulk | Analytic Rule | 📦 Solution | NordPass | This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. If a mix of bulk and one-off deletions were performed, this will group all actions and re... |
| NordPass - Deleting items of deleted member | Analytic Rule | 📦 Solution | NordPass | This will alert you if the deleted user's items have been removed without being transferred to another active user, as this could result in the loss of access to critical tools or information. |
| NordPass - Manual invitation, suspension, or deletion | Analytic Rule | 📦 Solution | NordPass | This will alert you when the user is manually invited, suspended, or deleted. !This rule should be enabled only by organizations that have User and Group Provisioning enabled. |
| NordPass - Activity token revocation | Analytic Rule | 📦 Solution | NordPass | This will alert you when the event reporting token is revoked, posing the risk of active integration being blocked. |
| NordPass - User data detected in breach | Analytic Rule | 📦 Solution | NordPass | This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web. |
| NordPass - User fails authentication | Analytic Rule | 📦 Solution | NordPass | This will alert you if a user fails to log in to their NordPass account or SSO authentication three or more times in the last 24 hours. |
| NordPass - Vault export | Analytic Rule | 📦 Solution | NordPass | This will alert you if the vault has been exported, allowing you to review and evaluate the incident to mitigate potential risks. NOTE: The organization can control whether it allows its members to ex... |
| NordPass | Workbook | 📦 Solution | NordPass | |
| NozomiNetworksEvents | Parser | 📦 Solution | NozomiNetworks | |
| NXLog_parsed_AIX_Audit_view 🔍 | Parser | 📦 Solution | NXLogAixAudit | |
| ASimDnsMicrosoftNXLog | Parser | 📦 Solution | NXLogDNSLogs | |
| Device Registration from Malicious IP | Analytic Rule | 📦 Solution | Okta Single Sign-On | This query identifies Device Registration from IP addresses identified as malicious by Okta ThreatInsight. |
| Failed Logins from Unknown or Invalid User | Analytic Rule | 📦 Solution | Okta Single Sign-On | This query searches for numerous login attempts to the management console with an unknown or invalid user name. |
| High-Risk Admin Activity | Analytic Rule | 📦 Solution | Okta Single Sign-On | The Okta risk engine auto-assigns risk levels to each login attempt. This query identifies admin operations originating from events associated with high-risk profiles. |
| User Login from Different Countries within 3 hours | Analytic Rule | 📦 Solution | Okta Single Sign-On | This query searches for successful user logins to the Okta Console from different countries within 3 hours. |
| MFA Fatigue (OKTA) | Analytic Rule | 📦 Solution | Okta Single Sign-On | MFA fatigue attack is a cybersecurity threat where attackers exploit user exhaustion from multi-factor authentication prompts to trick them into providing their MFA details thus compromising their own... |
| New Device/Location sign-in along with critical operation | Analytic Rule | 📦 Solution | Okta Single Sign-On | This query identifies users seen login from new geo location/country as well as a new device and performing critical operations. |
| Potential Password Spray Attack | Analytic Rule | 📦 Solution | Okta Single Sign-On | This query searches for failed attempts to log into the Okta console from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spra... |
| Okta Fast Pass phishing Detection | Analytic Rule | 📦 Solution | Okta Single Sign-On | This query detects cases in which Okta FastPass effectively prevented access to a known phishing website. |
| User Session Impersonation(Okta) | Analytic Rule | 📦 Solution | Okta Single Sign-On | A user has started a session impersonation, gaining access with the impersonated users permissions. This typically signifies Okta admin access and should only happen if anticipated and requested. |
| Admin privilege granted (Okta) | Hunting Query | 📦 Solution | Okta Single Sign-On | Query checks for admin permissions granted to users/groups, often used by adversaries for access and privilege elevation. |
| Create API Token (Okta) | Hunting Query | 📦 Solution | Okta Single Sign-On | Okta API tokens are used to authenticate requests to Okta APIs. This query searches for attempts to create new API Token. Refrence: https://developer.okta.com/docs/reference/api/event-types/ |
| Initiate impersonation session (Okta) | Hunting Query | 📦 Solution | Okta Single Sign-On | User.session.impersonation, usually triggered by Okta Support, are rare. This query checks for impersonation events used in LAPSUS$ breach. |
| Okta login attempts using Legacy Auth | Hunting Query | 📦 Solution | Okta Single Sign-On | This query identifies use of legacy authentication protocol in the Okta Logs. |
| Okta Login from multiple locations | Hunting Query | 📦 Solution | Okta Single Sign-On | This query identifies accounts associated with multiple authentications from different geographical locations in a short period of time. |
| Sign-ins from Nord VPN Providers | Hunting Query | 📦 Solution | Okta Single Sign-On | This query searches for sign-in activity from Nord VPN providers. The purpose is to identify any unfamiliar sign-in attempts from VPN providers, that are not typically observed among users in the orga... |
| Logins originating from VPS Providers | Hunting Query | 📦 Solution | Okta Single Sign-On | This query searches for successful logons from known VPS provider network ranges. This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed. |
| New device registration from unfamiliar location | Hunting Query | 📦 Solution | Okta Single Sign-On | This query identifies new device being registered from a location where the user does not normally login from |
| Rare MFA Operations (Okta) | Hunting Query | 📦 Solution | Okta Single Sign-On | MFA prevents credential compromise. This query checks for rare MFA operations like deactivation, update, reset, and bypass attempts often used by adversaries to compromise networks/accounts. |
| User password reset(Okta) | Hunting Query | 📦 Solution | Okta Single Sign-On | Adversaries often manipulate accounts for access. This query checks for admin attempts to reset user passwords in Okta logs. |
| OktaSingleSignOn | Workbook | 📦 Solution | Okta Single Sign-On | |
| User enrichment - Okta | Playbook | 📦 Solution | Okta Single Sign-On | This playbook will collect user information from Okta and post a report on the incident. |
| Prompt Okta user | Playbook | 📦 Solution | Okta Single Sign-On | This playbook uses the OKTA connector to prompt the risky user on Teams. User is asked action was taken by them. Based on the user confirmation the SOC admin is notified to investige on the user accou... |
| Response on Okta user from Teams | Playbook | 📦 Solution | Okta Single Sign-On | This playbooks sends an adaptive card to the SOC Teams channel with information about the Okta user and incident details. The SOC is allowed to take action such suspend, reset password, expire passwor... |
| OktaSSO | Parser | 📦 Solution | Okta Single Sign-On | |
| OnapsisAlarmsOverview | Workbook | 📦 Solution | Onapsis Platform | |
| OnapsisLookup | Parser | 📦 Solution | Onapsis Platform | |
| OneIdentity | Workbook | 📦 Solution | OneIdentity | |
| OneIdentity_Safeguard 🔍 | Parser | 📦 Solution | OneIdentity | |
| OneLogin | Parser | 📦 Solution | OneLoginIAM | |
| AuthASIMParser 🔍 | Parser | 📦 Solution | Open Systems | |
| FirewallASIMParser 🔍 | Parser | 📦 Solution | Open Systems | |
| FirewallASIMParserFilter 🔍 | Parser | 📦 Solution | Open Systems | |
| ProxyASIMParser 🔍 | Parser | 📦 Solution | Open Systems | |
| ProxyASIMParserFilter 🔍 | Parser | 📦 Solution | Open Systems | |
| Create Indicator - OpenCTI | Playbook | 📦 Solution | OpenCTI | This playbook adds new indicator in OpenCTI based on the entities info present in Sentinel incident. This playbook search in OpenCTI for indicatoes based on the entities (Account, Host, IP, FileHash, ... |
| Entity (IP, URL, FileHash, Account, Host) Enrichment - OpenCTI | Playbook | 📦 Solution | OpenCTI | This playbook search in OpenCTI for indicatoes based on the entities (Account, Host, IP, FileHash, URL) present in Microsoft Sentinel incident. If it presnts in OpenCTI, information will be added to i... |
| Read Stream- OpenCTI Indicators | Playbook | 📦 Solution | OpenCTI | This playbook fetches indicators from OpenCTI and send to Sentinel. Supported types are Domain, File, IPv4, IPv6, Account, Url. This runs for every 10 minutes |
| Send to Security Graph API - Batch Import (OpenCTI) | Playbook | 📦 Solution | OpenCTI | This playbook sends messages to Security GraphAPI in batches |
| OpenVpnEvent | Parser | 📦 Solution | OpenVPN | |
| OCI - Discovery activity | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects possible discovery activity. |
| OCI - Event rule deleted | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects when event rule was deleted. |
| OCI - Inbound SSH connection | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects inbound SSH connection. |
| OCI - Insecure metadata endpoint | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects insecure metadata endpoint. |
| OCI - Instance metadata access | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects instance metadata access. |
| OCI - Multiple instances launched | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects when multiple instances were launched. |
| OCI - Multiple instances terminated | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects when multiple instances were terminated. |
| OCI - Multiple rejects on rare ports | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects multiple rejects on rare ports. |
| OCI - SSH scanner | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects possible SSH scanning activity. |
| OCI - Unexpected user agent | Analytic Rule | 📦 Solution | Oracle Cloud Infrastructure | Detects unexpected user agent strings. |
| OCI - Destination ports (inbound traffic) | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for destination ports of inbound traffic. |
| OCI - Destination ports (outbound traffic) | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for destination ports of outbound traffic. |
| OCI - Launched instances | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for new launched instances. |
| OCI - Update activities | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for update activities performed by users. |
| OCI - Delete operations | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for delete operations performed by user. |
| OCI - Deleted users | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for users being deleted. |
| OCI - New users | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for new users created. |
| OCI - User source IP addresses | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for user source IP addresses. |
| OCI - Terminated instances | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for terminated instances. |
| OCI - Updated instances | Hunting Query | 📦 Solution | Oracle Cloud Infrastructure | Query searches for updated instances. |
| OracleCloudInfrastructureOCI | Workbook | 📦 Solution | Oracle Cloud Infrastructure | |
| OCILogs | Parser | 📦 Solution | Oracle Cloud Infrastructure | |
| OracleDBAudit - Connection to database from external IP | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when connection to database is from external IP source. |
| OracleDBAudit - Multiple tables dropped in short time | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when user drops many tables in short period of time. |
| OracleDBAudit - Connection to database from unknown IP | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when user connects to a database from IP address which is not present in AllowList. |
| OracleDBAudit - User connected to database from new IP | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when a user connects to database from new IP address. |
| OracleDBAudit - New user account | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when an action was made by new user. |
| OracleDBAudit - Query on Sensitive Table | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when user queries sensitive tables. |
| OracleDBAudit - User activity after long inactivity time | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when an action was made by a user which last activity was observed more than 30 days ago. |
| OracleDBAudit - Unusual user activity on multiple tables | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when user queries many tables in short period of time. |
| OracleDBAudit - Shutdown Server | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects when "SHUTDOWN" command was sent to server. |
| OracleDBAudit - SQL injection patterns | Analytic Rule | 📦 Solution | OracleDatabaseAudit | Detects common known SQL injection patterns used in automated scripts. |
| OracleDBAudit - Action by Ip | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query searches sources from which DbActions were made. |
| OracleDBAudit - Action by user | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query searches actions made by user. |
| OracleDBAudit - Active Users | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query for searching active database user accounts. |
| OracleDBAudit - Users connected to databases during non-operational hours. | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query searches for users who have connected to databases during non-operational hours. |
| OracleDBAudit - Dropped Tables | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query searches for dropped tables. |
| OracleDBAudit - Inactive Users | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query for searching user accounts which last activity was more than 30 days ago. |
| OracleDBAudit - Audit large queries | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query for auditing large queries. |
| OracleDBAudit - Top tables queries | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query searches for tables queries. |
| OracleDBAudit - Users with new privileges | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query for searching user accounts whith new privileges. |
| OracleDBAudit - Users Privileges Review | Hunting Query | 📦 Solution | OracleDatabaseAudit | Query searches for user accounts and their privileges. |
| OracleDatabaseAudit | Workbook | 📦 Solution | OracleDatabaseAudit | |
| OracleDatabaseAuditEvent | Parser | 📦 Solution | OracleDatabaseAudit | |
| Oracle - Command in URI | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects command in URI |
| Oracle - Multiple user agents for single source | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects requests with different user agents from one source in short timeframe. |
| Oracle - Oracle WebLogic Exploit CVE-2021-2109 | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109 |
| Oracle - Malicious user agent | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects known malicious user agent strings |
| Oracle - Multiple client errors from single IP | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects multiple client errors from one source in short timeframe |
| Oracle - Multiple server errors from single IP | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects multiple server errors from one source in short timeframe |
| Oracle - Private IP in URL | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects requests to unusual URL |
| Oracle - Put file and get file from same IP address | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects put or get files from one source in short timeframe |
| Oracle - Put suspicious file | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects PUT or POST of suspicious file |
| Oracle - Request to sensitive files | Analytic Rule | 📦 Solution | OracleWebLogicServer | Detects request to sensitive files. |
| Oracle - Request to forbidden files | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows request to forbidden files. |
| Oracle - Abnormal request size | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows abnormal request size. |
| Oracle - Critical event severity | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows critical event severity |
| Oracle - Error messages | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows error messages. |
| Oracle - Top files requested by users with error | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows list of files with error requests. |
| Oracle - Rare user agents with client errors | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows rare user agent strings with client errors |
| Oracle - Rare URLs requested | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows rare URLs requested. |
| Oracle - Rare user agents | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows rare user agents |
| Oracle - Top URLs client errors | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows URLs list with client errors. |
| Oracle - Top URLs server errors | Hunting Query | 📦 Solution | OracleWebLogicServer | Query shows URLs list with server errors. |
| OracleWorkbook | Workbook | 📦 Solution | OracleWebLogicServer | |
| OracleWebLogicServerEvent | Parser | 📦 Solution | OracleWebLogicServer | |
| OrcaAlerts | Workbook | 📦 Solution | Orca Security Alerts | |
| OSSECEvent | Parser | 📦 Solution | OSSEC | |
| PaloAltoXDR 🔍 | Workbook | 📦 Solution | Palo Alto - XDR (Cortex) | |
| PaloAltoXDR 🔍 | Playbook | 📦 Solution | Palo Alto - XDR (Cortex) | 1. Overview 1. Prerequisites 1. Deploy Palo Alot XDR playbook 1. Deployment Instructions 1. Post-Deployment Instructions 1. References |
| Microsoft COVID-19 file hash indicator matches | Analytic Rule | 📦 Solution | PaloAlto-PAN-OS | Identifies a match in CommonSecurityLog Event data from any FileHash published in the Microsoft COVID-19 Threat Intel Feed - as described at https://www.microsoft.com/security/blog/2020/05/14/open-sou... |
| Palo Alto - potential beaconing detected | Analytic Rule | 📦 Solution | PaloAlto-PAN-OS | Identifies beaconing patterns from Palo Alto Network traffic logs based on recurrent timedelta patterns. The query leverages various KQL functions to calculate time deltas and then compares it with to... |
| Palo Alto - possible internal to external port scanning | Analytic Rule | 📦 Solution | PaloAlto-PAN-OS | Identifies a list of internal Source IPs (10.x.x.x Hosts) that have triggered 10 or more non-graceful tcp server resets from one or more Destination IPs which results in an "ApplicationProtocol = inco... |
| Palo Alto - possible nmap scan on with top 100 option | Analytic Rule | 📦 Solution | PaloAlto-PAN-OS | Detect possible execution of Nmap top 100 option. This detection will detect scanning of 90% of Top 100 port of NMAP in less than 2 minutes. Unusual port only access through a scan are present in this... |
| Palo Alto Threat signatures from Unusual IP addresses | Analytic Rule | 📦 Solution | PaloAlto-PAN-OS | Identifies Palo Alto Threat signatures from unusual IP addresses which are not historically seen. This detection is also leveraged and required for MDE and PAN Fusion scenario https://docs.microsoft.... |
| Palo Alto - potential beaconing detected | Hunting Query | 📦 Solution | PaloAlto-PAN-OS | Identifies beaconing patterns from PAN traffic logs based on recurrent timedelta patterns. Reference Blog:https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/detect-network-beaconing-via-i... |
| Palo Alto - high-risk ports | Hunting Query | 📦 Solution | PaloAlto-PAN-OS | Identifies network connections whose ports are frequent targets of attacks and should not cross network boundaries or reach untrusted public networks. Consider updating the firewall policies to block ... |
| PaloAltoNetworkThreat | Workbook | 📦 Solution | PaloAlto-PAN-OS | |
| PaloAltoOverview | Workbook | 📦 Solution | PaloAlto-PAN-OS | |
| PaloAlto-PAN-OS-BlockIP | Playbook | 📦 Solution | PaloAlto-PAN-OS | This playbook allows blocking/unblocking IPs in PaloAlto, using **Address Object Groups**. This allows to make changes on predefined address group, which is attached to predefined security policy rule... |
| Block IP - Palo Alto PAN-OS - Entity trigger | Playbook | 📦 Solution | PaloAlto-PAN-OS | This playbook interacts with relevant stakeholders, such incident response team, to approve blocking/allowing IPs in Palo Alto PAN-OS, using **Address Object Groups**. This allows to make changes on p... |
| PaloAlto-PAN-OS-BlockURL | Playbook | 📦 Solution | PaloAlto-PAN-OS | This playbook allows blocking/unblocking URLs in PaloAlto, using **predefined address group**. This allows to make changes on predefined address group, which is attached to security policy rule. |
| PaloAlto-PAN-OS-BlockURL-EntityTrigger | Playbook | 📦 Solution | PaloAlto-PAN-OS | This playbook allows blocking/unblocking URLs in PaloAlto, using **predefined address group**. This allows to make changes on predefined address group, which is attached to security policy rule. |
| Get System Info - Palo Alto PAN-OS XML API | Playbook | 📦 Solution | PaloAlto-PAN-OS | This playbook allows us to get System Info of a Palo Alto device for a Microsoft Sentinel alert. |
| Get Threat PCAP - Palo Alto PAN-OS XML API | Playbook | 📦 Solution | PaloAlto-PAN-OS | This playbook allows us to get a threat PCAP for a given PCAP ID. |
| PaloAlto-PAN-OS-GetURLCategoryInfo | Playbook | 📦 Solution | PaloAlto-PAN-OS | When a new sentinal incident is created, this playbook gets triggered and performs below actions: |
| PaloAlto - MAC address conflict | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects several users with the same MAC address. |
| PaloAlto - Dropping or denying session with traffic | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects dropping or denying session with traffic. |
| PaloAlto - File type changed | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects when file type changed. |
| PaloAlto - Inbound connection to high risk ports | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects inbound connection to high risk ports. |
| PaloAlto - Possible attack without response | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects possible attack without response. |
| PaloAlto - Possible flooding | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects possible flooding. |
| PaloAlto - Possible port scan | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects possible port scan. |
| PaloAlto - User privileges was changed | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects changing of user privileges. |
| PaloAlto - Put and post method request in high risk file type | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects put and post method request in high risk file type. |
| PaloAlto - Forbidden countries | Analytic Rule | 📦 Solution | PaloAltoCDL | Detects suspicious connections from forbidden countries. |
| PaloAlto - Critical event result | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows critical event result |
| PaloAlto - File permission with PUT or POST request | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows file permission with PUT or POST request |
| PaloAlto - Incomplete application protocol | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows incomplete application protocol |
| PaloAlto - Destination ports by IPs | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows destination ports by IP address. |
| PaloAlto - Multiple Deny result by user | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows multiple Deny results by user |
| PaloAlto - Agent versions | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows agents which are not updated to the latest version |
| PaloAlto - Outdated config vesions | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows outdated config vesions |
| PaloAlto - Rare application layer protocols | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows Rare application layer protocols |
| PaloAlto - Rare files observed | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows rare files observed |
| PaloAlto - Rare ports by user | Hunting Query | 📦 Solution | PaloAltoCDL | Query shows rare ports by user. |
| PaloAltoCDL | Workbook | 📦 Solution | PaloAltoCDL | |
| PaloAltoCDLEvent | Parser | 📦 Solution | PaloAltoCDL | |
| Palo Alto Prisma Cloud - Access keys are not rotated for 90 days | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects access keys which were not rotated for 90 days. |
| Palo Alto Prisma Cloud - Network ACL allow all outbound traffic | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects network ACLs with outbound rule to allow all traffic. |
| Palo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects Network ACLs allow ingress traffic to server administration ports. |
| Palo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects Network ACLs with Inbound rule to allow All Traffic. |
| Palo Alto Prisma Cloud - Anomalous access key usage | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects anomalous API key usage activity. |
| Palo Alto Prisma Cloud - High risk score alert | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects alerts with high risk score value. |
| Palo Alto Prisma Cloud - High severity alert opened for several days | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects high severity alert which is opened for several days. |
| Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects IAM Groups with Administrator Access Permissions. |
| Palo Alto Prisma Cloud - Inactive user | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects users inactive for 30 days. |
| Palo Alto Prisma Cloud - Maximum risk score alert | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects alerts with maximum risk score value. |
| Palo Alto Prisma Cloud - Multiple failed logins for user | Analytic Rule | 📦 Solution | PaloAltoPrismaCloud | Detects multiple failed logins for the same user account. |
| Palo Alto Prisma Cloud - Access keys used | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches for access keys used for programmatic access. |
| Palo Alto Prisma Cloud - Top sources of failed logins | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches for top source IP addresses of failed logins. |
| Palo Alto Prisma Cloud - Top users by failed logins | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches for users who have large number of failed logins. |
| Palo Alto Prisma Cloud - High risk score opened alerts | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches for alerts with high risk score value. |
| Palo Alto Prisma Cloud - High severity alerts | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches for high severity alerts. |
| Palo Alto Prisma Cloud - New users | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches for new users. |
| Palo Alto Prisma Cloud - Opened alerts | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches opened alerts. |
| Palo Alto Prisma Cloud - Top recources with alerts | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches for resources which appeared in different alerts. |
| Palo Alto Prisma Cloud - Updated resources | Hunting Query | 📦 Solution | PaloAltoPrismaCloud | Query searches recently updated resources. |
| PaloAltoPrismaCloudOverview | Workbook | 📦 Solution | PaloAltoPrismaCloud | |
| Fetch Security Posture from Prisma Cloud | Playbook | 📦 Solution | PaloAltoPrismaCloud | This playbook provides/updates the compliance security posture details of asset in comments section of triggered incident so that SOC analysts can directly take corrective measure to prevent the attac... |
| Remediate assets on prisma cloud | Playbook | 📦 Solution | PaloAltoPrismaCloud | This playbook provides/updates the compliance security posture details of asset in comments section of triggered incident so that SOC analysts can directly take corrective measure to prevent the attac... |
| PaloAltoPrismaCloud | Parser | 📦 Solution | PaloAltoPrismaCloud | |
| PCIDSSCompliance | Workbook | 📦 Solution | PCI DSS Compliance | |
| Perimeter81OverviewWorkbook | Workbook | 📦 Solution | Perimeter 81 | |
| Ping Federate - Abnormal password reset attempts | Analytic Rule | 📦 Solution | PingFederate | Detects abnormal password reset attempts for user in short period of time. |
| Ping Federate - Authentication from new IP. | Analytic Rule | 📦 Solution | PingFederate | Detects authentication requests from new IP address. |
| Ping Federate - Forbidden country | Analytic Rule | 📦 Solution | PingFederate | Detects requests from forbidden countries. |
| Ping Federate - Abnormal password resets for user | Analytic Rule | 📦 Solution | PingFederate | Detects multiple password reset for user. |
| Ping Federate - New user SSO success login | Analytic Rule | 📦 Solution | PingFederate | Detects new user SSO success login. |
| Ping Federate - OAuth old version | Analytic Rule | 📦 Solution | PingFederate | Detects requests using not the latest version of OAuth protocol. |
| Ping Federate - Password reset request from unexpected source IP address.. | Analytic Rule | 📦 Solution | PingFederate | Detects password reset requests from unexpected source IP address. |
| Ping Federate - SAML old version | Analytic Rule | 📦 Solution | PingFederate | Detects requests using not the latest version of SAML protocol. |
| Ping Federate - Unexpected authentication URL. | Analytic Rule | 📦 Solution | PingFederate | Detects unexpected authentication URL. |
| Ping Federate - Unexpected country for user | Analytic Rule | 📦 Solution | PingFederate | Detects requests from different countries for user in shotr term. |
| Ping Federate - Unusual mail domain. | Analytic Rule | 📦 Solution | PingFederate | Detects unusual mail domain in authentication requests. |
| Ping Federate - Authentication URLs | Hunting Query | 📦 Solution | PingFederate | Query searches for authentication URLs used. |
| Ping Federate - Failed Authentication | Hunting Query | 📦 Solution | PingFederate | Query searches for failed authentication events |
| Ping Federate - New users | Hunting Query | 📦 Solution | PingFederate | Query searches for new users. |
| Ping Federate - Password reset requests | Hunting Query | 📦 Solution | PingFederate | Query searches for password reset requests events. |
| Ping Federate - Rare source IP addresses | Hunting Query | 📦 Solution | PingFederate | Query searches for rare source IP addresses of requests |
| Ping Federate - SAML subjects | Hunting Query | 📦 Solution | PingFederate | Query searches for SAML subjects used in requests |
| Ping Federate - Top source IP addresses | Hunting Query | 📦 Solution | PingFederate | Query searches for source IP addresses with the most requests |
| Ping Federate - Requests from unusual countries | Hunting Query | 📦 Solution | PingFederate | Query searches for requests from unusual countries. |
| Ping Federate - Authentication from unusual sources | Hunting Query | 📦 Solution | PingFederate | Query searches for unusual sources of authentication. |
| Ping Federate - Users recently reseted password | Hunting Query | 📦 Solution | PingFederate | Query searches for users who recently reseted their passwords. |
| PingFederate | Workbook | 📦 Solution | PingFederate | |
| PingFederateEvent | Parser | 📦 Solution | PingFederate | |
| PostgreSQLEvent | Parser | 📦 Solution | PostgreSQL | |
| Disks Alerts From Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity disk alerts found by Prancer. |
| Flow Logs Alerts for Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity flow Log alerts found by Prancer. |
| NetworkSecurityGroups Alert From Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity network security groups alerts found by Prancer. |
| PAC high severity 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity alerts found by Prancer. |
| Registries Alerts for Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity registry alerts found by Prancer. |
| Sites Alerts for Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity sites alerts found by Prancer. |
| Storage Accounts Alerts From Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity storage account alerts found by Prancer. |
| Subnets Alerts for Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity subnet alerts found by Prancer. |
| Vaults Alerts for Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity vault alerts found by Prancer. |
| VirtualNetworkPeerings Alerts From Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity virtual network peerings alerts found by Prancer. |
| Virtual Machines Alerts for Prancer 🔍 | Analytic Rule | 📦 Solution | Prancer PenSuiteAI Integration | High severity virtual machine alerts found by Prancer. |
| Hunting Query for Failed CSPM Scan Items 🔍 | Hunting Query | 📦 Solution | Prancer PenSuiteAI Integration | This query pulls in all the failed scan results from the CSPM scans |
| Hunting Query for High Severity PAC findings 🔍 | Hunting Query | 📦 Solution | Prancer PenSuiteAI Integration | This query pulls in all the high severity Pensuite AI pentest findings into one location |
| PrancerSentinelAnalytics 🔍 | Workbook | 📦 Solution | Prancer PenSuiteAI Integration | |
| ProofpointPOD - Binary file in attachment | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when email received with binary file as attachment. |
| ProofpointPOD - Possible data exfiltration to private email | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when sender sent email to the non-corporate domain and recipient's username is the same as sender's username. |
| ProofpointPOD - Email sender in TI list | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Email sender in TI list. |
| ProofpointPOD - Email sender IP in TI list | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Email sender IP in TI list. |
| ProofpointPOD - High risk message not discarded | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when email with high risk score was not rejected or discarded by filters. |
| ProofpointPOD - Multiple archived attachments to the same recipient | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when multiple emails where sent to the same recipient with large archived attachments. |
| ProofpointPOD - Multiple large emails to the same recipient | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when multiple emails with large size where sent to the same recipient. |
| ProofpointPOD - Multiple protected emails to unknown recipient | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when multiple protected messages where sent to early not seen recipient. |
| ProofpointPOD - Suspicious attachment | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when email contains suspicious attachment (file type). |
| ProofpointPOD - Weak ciphers | Analytic Rule | 📦 Solution | Proofpoint On demand(POD) Email Security | Detects when weak TLS ciphers are used. |
| ProofpointPOD - Emails with high score of 'adult' filter classifier value | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for emails with high score of 'adult' filter classifier value. |
| ProofpointPOD - Emails with high score of 'malware' filter classifier value | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for emails with high score of 'malware' filter classifier value. |
| ProofpointPOD - Emails with high score of 'phish' filter classifier value | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for emails with high score of 'phish' filter classifier value. |
| ProofpointPOD - Emails with high score of 'spam' filter classifier value | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for emails with high score of 'spam' filter classifier value. |
| ProofpointPOD - Emails with high score of 'suspect' filter classifier value | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for emails with high score of 'suspect' filter classifier value. |
| ProofpointPOD - Large size outbound emails | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for emails which size is 2 times grater than average size of outbound email for user. |
| ProofpointPOD - Recipients with high number of discarded or rejected emails | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for recipients with high number of discarded or rejected emails. |
| ProofpointPOD - Recipients with large number of corrupted emails | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for recipients with large number of corrupted emails. |
| ProofpointPOD - Senders with large number of corrupted messages | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Search for senders with large number of corrupted messages. |
| ProofpointPOD - Suspicious file types in attachments | Hunting Query | 📦 Solution | Proofpoint On demand(POD) Email Security | Hunting for suspicious file types in attachments. |
| ProofpointPOD | Workbook | 📦 Solution | Proofpoint On demand(POD) Email Security | |
| ProofpointPOD | Parser | 📦 Solution | Proofpoint On demand(POD) Email Security | |
| Malware attachment delivered | Analytic Rule | 📦 Solution | ProofPointTap | This query identifies a message containing a malware attachment that was delivered. |
| Malware Link Clicked | Analytic Rule | 📦 Solution | ProofPointTap | This query identifies a user clicking on an email link whose threat category is classified as a malware |
| ProofpointTAP | Workbook | 📦 Solution | ProofPointTap | |
| ProofpointTAP-AddForensicsInfoToIncident | Playbook | 📦 Solution | ProofPointTap | Once a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. [Gets Forensics](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/For... |
| ProofpointTAP-CheckAccountInVAP | Playbook | 📦 Solution | ProofPointTap | Once a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets [Very Attacked People](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Docume... |
| ProofpointTAPEvent | Parser | 📦 Solution | ProofPointTap | |
| PulseConnectSecure - Potential Brute Force Attempts | Analytic Rule | 📦 Solution | Pulse Connect Secure | This query identifies evidence of potential brute force attack by looking at multiple failed attempts to log into the VPN server |
| PulseConnectSecure - Large Number of Distinct Failed User Logins | Analytic Rule | 📦 Solution | Pulse Connect Secure | This query identifies evidence of failed login attempts from a large number of distinct users on a Pulse Connect Secure VPN server |
| PulseConnectSecure | Workbook | 📦 Solution | Pulse Connect Secure | |
| PulseConnectSecure | Parser | 📦 Solution | Pulse Connect Secure | |
| External Fabric Module XFM1 is unhealthy | Analytic Rule | 📦 Solution | Pure Storage | External Fabric Module XFM1 is unhealthy |
| Pure Controller Failed | Analytic Rule | 📦 Solution | Pure Storage | Detect controller failure and take appropriate response action. |
| Pure Failed Login | Analytic Rule | 📦 Solution | Pure Storage | Detect failed login attacks and delete user |
| Pure Storage FlashBlade File System Snapshot | Playbook | 📦 Solution | Pure Storage | This playbook gets triggered when a Microsoft Sentinel Incident created for suspicious activity and it takes files system snapshot of specific file systems listed in key vault |
| Pure Storage Protection Group Snapshot | Playbook | 📦 Solution | Pure Storage | This playbook gets triggered when a Microsoft Sentinel Incident created for suspicious activity and it takes protection group snapshot of specific protection groups listed in key vault. |
| Pure Storage User Deletion | Playbook | 📦 Solution | Pure Storage | This playbook gets triggered when a Microsoft Sentinel Incident created for suspicious user activity and it deletes the respective user from storage array |
| Pure Storage Volume Snapshot | Playbook | 📦 Solution | Pure Storage | This playbook gets triggered when a Microsoft Sentinel Incident created for suspicious activity and it takes snapshot of specific volumes mentioned in key vault. |
| PureStorageFlashArrayParser | Parser | 📦 Solution | Pure Storage | |
| PureStorageFlashBladeParser | Parser | 📦 Solution | Pure Storage | |
| QualysKB | Parser | 📦 Solution | Qualys VM Knowledgebase | |
| High Number of Urgent Vulnerabilities Detected | Analytic Rule | 📦 Solution | QualysVM | This Creates an incident when a host has a high number of Urgent, severity 5, vulnerabilities detected. |
| New High Severity Vulnerability Detected Across Multiple Hosts | Analytic Rule | 📦 Solution | QualysVM | This creates an incident when a new high severity vulnerability is detected across multilple hosts |
| QualysVMv2 | Workbook | 📦 Solution | QualysVM | |
| QualysVM-GetAssetDetails | Playbook | 📦 Solution | QualysVM | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Get IP Addresses from incident. 2. Get Asset Details for all IP Addresses. 3. Add asset det... |
| QualysVM-GetAssets-ByCVEID | Playbook | 📦 Solution | QualysVM | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Get CVE IDs from incident. 2. Create a Dynamic Search List with CVE IDs as filter criteria.... |
| QualysVM-GetAssets-ByOpenPort | Playbook | 📦 Solution | QualysVM | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Gets Port from incident. (Only one port) 2. Search the Qualys platform and get the asset co... |
| QualysVM-LaunchVMScan-GenerateReport | Playbook | 📦 Solution | QualysVM | When a new sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Get IP Addresses from incident. 2. Scan IP Addresses with Qualys Scanner. 3. Generate the S... |
| QualysHostDetection | Parser | 📦 Solution | QualysVM | |
| Quokka - Malicious Results Detected | Analytic Rule | 📦 Solution | Quokka | Detects if there are any malicious results in the app events coming from organization devices. |
| QscoutDashboards | Workbook | 📦 Solution | Quokka | |
| Radiflow - Exploit Detected | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when the use of an exploit is detected by Radiflow's iSID. |
| Radiflow - Network Scanning Detected | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when a network scan is detected either by Radiflow's iSID. |
| Radiflow - New Activity Detected | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when a new asset or MAC is detected either by Radiflow's iSID. |
| Radiflow - Platform Alert | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when an alert raised by Radiflow's iSID is not contemplated by any of the other analytic rules |
| Radiflow - Policy Violation Detected | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when an unauthorized session or action is detected either by Radiflow's iSID. |
| Radiflow - Suspicious Malicious Activity Detected | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when malware is detected by Radiflow's iSID. |
| Radiflow - Unauthorized Command in Operational Device | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when an unauthorized command is detected in the network by Radiflow's iSID. |
| Radiflow - Unauthorized Internet Access | Analytic Rule | 📦 Solution | Radiflow | Generates an incident when an unauthorized link between the network and the Internet is detected by Radiflow's iSID. |
| RadiflowEvent | Parser | 📦 Solution | Radiflow | |
| Rapid7 Insight VM - Enrich incident with asset info | Playbook | 📦 Solution | Rapid7InsightVM | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Obtains IPs from the incident. 2. Searches asset ids by the IPs. 3. Gets assets i... |
| Rapid7 Insight VM - Enrich vulnerability info | Playbook | 📦 Solution | Rapid7InsightVM | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Obtains IPs from the incident. 2. Searches asset ids by the IPs. 3. Gets vulnerab... |
| Rapid7 Insight VM - Run scan | Playbook | 📦 Solution | Rapid7InsightVM | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Obtains IPs from the incident. 2. Searches asset ids by the IPs. 3. Obtains a lis... |
| InsightVMAssets | Parser | 📦 Solution | Rapid7InsightVM | |
| InsightVMVulnerabilities | Parser | 📦 Solution | Rapid7InsightVM | |
| RecordedFuture Threat Hunting Domain All Actors | Analytic Rule | 📦 Solution | Recorded Future | Recorded Future Threat Hunting domain correlation for all actors. |
| RecordedFuture Threat Hunting Hash All Actors | Analytic Rule | 📦 Solution | Recorded Future | Recorded Future Threat Hunting hash correlation for all actors. |
| RecordedFuture Threat Hunting IP All Actors | Analytic Rule | 📦 Solution | Recorded Future | Recorded Future Threat Hunting IP correlation for all actors. |
| RecordedFuture Threat Hunting Url All Actors | Analytic Rule | 📦 Solution | Recorded Future | Recorded Future Threat Hunting Url correlation for all actors. |
| RecordedFuture Threat Hunting Domain All Actors 🔍 | Hunting Query | 📦 Solution | Recorded Future | Recorded Future Threat Hunting domain correlation for all actors. |
| RecordedFuture Threat Hunting Hash All Actors 🔍 | Hunting Query | 📦 Solution | Recorded Future | Recorded Future Threat Hunting hash correlation for all actors. |
| RecordedFuture Threat Hunting IP All Actors 🔍 | Hunting Query | 📦 Solution | Recorded Future | Recorded Future Threat Hunting IP correlation for all actors. |
| RecordedFuture Threat Hunting URL All Actors 🔍 | Hunting Query | 📦 Solution | Recorded Future | Recorded Future URL Threat Actor Hunt. |
| RecordedFutureAlertOverview | Workbook | 📦 Solution | Recorded Future | |
| RecordedFutureDomainCorrelation | Workbook | 📦 Solution | Recorded Future | |
| RecordedFutureHashCorrelation | Workbook | 📦 Solution | Recorded Future | |
| RecordedFutureIPCorrelation | Workbook | 📦 Solution | Recorded Future | |
| RecordedFutureMalwareThreatHunting | Workbook | 📦 Solution | Recorded Future | |
| RecordedFuturePlaybookAlertOverview | Workbook | 📦 Solution | Recorded Future | |
| RecordedFutureThreatActorHunting | Workbook | 📦 Solution | Recorded Future | |
| RecordedFutureURLCorrelation | Workbook | 📦 Solution | Recorded Future | |
| RecordedFuture-ActorThreatHunt-IndicatorImport | Playbook | 📦 Solution | Recorded Future | This playbook will write Recorded Future threat hunting indicators to ThreatIntelligenceIndicator log analytics table via the RecordedFuture-ThreatIntelligenceImport playbook. |
| RecordedFuture-MalwareThreatHunt-IndicatorImport | Playbook | 📦 Solution | Recorded Future | This playbook will write Recorded Future threat hunting indicators to ThreatIntelligenceIndicator log analytics table via the RecordedFuture-ThreatIntelligenceImport playbook. |
| RecordedFuture-ThreatMap-Importer | Playbook | 📦 Solution | Recorded Future | This playbook will import Threat Map data from Recorded Future and store it in a custom log. |
| RecordedFuture-ThreatMapMalware-Importer | Playbook | 📦 Solution | Recorded Future | This playbook will import Threat Map data from Recorded Future and store it in a custom log. |
| RecordedFuture-Sandbox_Enrichment-Url | Playbook | 📦 Solution | Recorded Future | This playbook will enrich url entities in an incident and send them to Recorded Future Sandbox. The result will be written as a incident comment. |
| RecordedFuture-Sandbox_Outlook_Attachment | Playbook | 📦 Solution | Recorded Future | This playbook will trigger on emails with attachmets and send them to Recorded Future Sandbox. The result will be written as a reply and a Sentinel Incident will be created if the file attachment has ... |
| RecordedFuture-Sandbox_StorageAccount | Playbook | 📦 Solution | Recorded Future | This playbook will trigger on files in a Storage Account and send them to Recorded Future Sandbox. The result will be written as a reply and a Sentinel Incident will be created if the file attachment ... |
| RecordedFuture-Domain-IndicatorImport | Playbook | 📦 Solution | Recorded Future | This playbook imports Domain risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes. This playbook depends on RecordedFuture-Th... |
| RecordedFuture-Hash-IndicatorImport | Playbook | 📦 Solution | Recorded Future | This playbook imports Hash risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes. This playbook depends on RecordedFuture-Thre... |
| RecordedFuture-IP-IndicatorImport | Playbook | 📦 Solution | Recorded Future | This playbook imports IP risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes. This playbook depends on RecordedFuture-Threat... |
| RecordedFuture-ThreatIntelligenceImport | Playbook | 📦 Solution | Recorded Future | This playbook will write indicators in batch to ThreatIntelligenceIndicator log analytics table. |
| RecordedFuture-URL-IndicatorImport | Playbook | 📦 Solution | Recorded Future | This playbook imports URL risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes. This playbook depends on RecordedFuture-Threa... |
| RecordedFuture-IOC_Enrichment | Playbook | 📦 Solution | Recorded Future | This playbook leverages the Recorded Future API to enrich IP, Domain, Url & Hash indicators, found in Microsoft Sentinel incidents, with the following context: Risk Score, Risk Rules and Link to Intel... |
| RecordedFuture-DOMAIN-C2_DNS_Name-TIProcessor | Playbook | 📦 Solution | Recorded Future | **[Deprecated]** Deprecated due to changes in the Threat Intelligence Platform. Use the new IndicatorImport playbooks that is provided in this Solution. This playbook leverages the Recorded Future API... |
| RecordedFuture-HASH-Obs_in_Underground-TIProcessor | Playbook | 📦 Solution | Recorded Future | **[Deprecated]** Deprecated due to changes in the Threat Intelligence Platform. Use the new IndicatorImport playbooks that is provided in this Solution. This playbook leverages the Recorded Future API... |
| RecordedFuture-ImportToSentinel | Playbook | 📦 Solution | Recorded Future | **[Deprecated]** Deprecated due to changes in the Threat Intelligence Platform. Use the new IndicatorImport playbooks that is provided in this Solution. This playbook is purposed to listen (via batchi... |
| RecordedFuture-IP-Actively_Comm_C2_Server-TIProcessor | Playbook | 📦 Solution | Recorded Future | **[Deprecated]** Deprecated due to changes in the Threat Intelligence Platform. Use the new IndicatorImport playbooks that is provided in this Solution. This playbook leverages the Recorded Future API... |
| RecordedFuture-Ukraine-IndicatorProcessor | Playbook | 📦 Solution | Recorded Future | **[Deprecated]** Deprecated due to changes in the Threat Intelligence Platform. Use the new IndicatorImport playbooks that is provided in this Solution. This playbook leverages the Recorded Future API... |
| RecordedFuture-URL-Recent_Rep_by_Insikt-TIProcessor | Playbook | 📦 Solution | Recorded Future | **[Deprecated]** Deprecated due to changes in the Threat Intelligence Platform. Use the new IndicatorImport playbooks that is provided in this Solution. This playbook leverages the Recorded Future API... |
| RecordedFuture-Alert-Importer | Playbook | 📦 Solution | Recorded Future | This playbook imports alerts from Recorded Future and stores them in a custom log in the log analytics workspace. It can create alerts dependant on the parameter: create_incident. |
| RecordedFuture-Playbook-Alert-Importer | Playbook | 📦 Solution | Recorded Future | This playbook imports alerts from Recorded Future and stores them in a custom log in the log analytics workspace. |
| Recorded Future Identity - Credential Exposure Detected | Analytic Rule | 📦 Solution | Recorded Future Identity | Creates incidents when Recorded Future Identity detects compromised credentials for users in your organization |
| RFI-Playbook-Alert-Importer | Playbook | 📦 Solution | Recorded Future Identity | This playbook fetches identity compromises from Recorded Future, places users in a security group and confirms them as 'risky users' in Entra ID. |
| RFI-Playbook-Alert-Importer-LAW | Playbook | 📦 Solution | Recorded Future Identity | This playbook fetches identity compromises from Recorded Future, places users in a security group and confirms them as 'risky users' in Entra ID. |
| RFI-Playbook-Alert-Importer-LAW-Sentinel (DEPRECATED) | Playbook | 📦 Solution | Recorded Future Identity | DEPRECATED: This playbook creates incidents via the Azure Microsoft Sentinel Logic Apps connector, which do not appear in the unified Microsoft Defender portal. Use RFI-Playbook-Alert-Importer-LAW ins... |
| RFI-add-EntraID-security-group-user | Playbook | 📦 Solution | Recorded Future Identity | This playbook adds a compromised user to an EntraID security group. Triage and remediation should be handled in follow up playbooks or actions. |
| RFI-confirm-EntraID-risky-user | Playbook | 📦 Solution | Recorded Future Identity | This playbook confirms compromise of users deemed 'high risk' by EntraID. |
| RFI-lookup-and-save-user | Playbook | 📦 Solution | Recorded Future Identity | This playbook gets compromise identity details from Recorded Future Identity Intelligence and saves the data for further review and analysis. |
| RFI-search-external-user | Playbook | 📦 Solution | Recorded Future Identity | This playbook searches the Recorded Future Identity Intelligence Module for compromised external (customer) users. This playbook depends on: - RFI-add-EntraID-security-group-user - RFI-confirm-EntraID... |
| RFI-search-workforce-user | Playbook | 📦 Solution | Recorded Future Identity | This playbook searches the Recorded Future Identity Intelligence Module for compromised workforce users. This playbook depends on: - RFI-add-EntraID-security-group-user - RFI-confirm-EntraID-risky-use... |
| Red Canary Threat Detection 🔍 | Analytic Rule | 📦 Solution | Red Canary | Triggers Incidents using detection data assembled by Red Canary. |
| ReversingLabs-CapabilitiesOverview | Workbook | 📦 Solution | ReversingLabs | |
| ReversingLabs-CheckQuota | Playbook | 📦 Solution | ReversingLabs | This playbook will check your ReversingLabs TitaniumCloud API quota and provide usage details. To be used in conjunction with the ReversingLabs-CapabilitiesOverview workbook. |
| SpectraAnalyze-EnrichFileHash | Playbook | 📦 Solution | ReversingLabs | This playbook will enrich a Microsoft Sentinel incident with file hash information from a Spectra Analyze appliance. A comment will be added to the incident with details about the file. |
| SpectraAnalyze-EnrichNetworkEntities | Playbook | 📦 Solution | ReversingLabs | This playbook will enrich a network entities (IP addresses, URLs, and domain names) with information from a Spectra Analyze appliance. A comment will be added to the incident with details about the en... |
| SpectraIntelligence-EnrichFileHash | Playbook | 📦 Solution | ReversingLabs | This playbook will enrich a Microsoft Sentinel Incident with file hash information from ReversingLabs Spectra Intelligence (formerly TitaniumCloud). A comment will be added to the incident with detail... |
| SpectraIntelligence-EnrichNetworkEntities | Playbook | 📦 Solution | ReversingLabs | This playbook will enrich a Microsoft Sentinel Incident with information about network entities (IP addresses, URLs, and domain names) from ReversingLabs Spectra Intelligence (formerly TitaniumCloud).... |
| Critical Risks | Analytic Rule | 📦 Solution | RidgeSecurity | This query searches for all the exploited risks that RidgeBot identified |
| Vulerabilities | Analytic Rule | 📦 Solution | RidgeSecurity | This query searches for all the vulerabilities that RidgeBot identified |
| RiskIQ-Base | Playbook | 📦 Solution | RiskIQ | This playbook creates a shared API Connection for all RiskIQ playbooks to leverage. This eases the configuration process for a user during deployment of the RiskIQ solution. In time, this base playboo... |
| RiskIQ-Data-PassiveDns | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Passive DNS provides analysts with a means to see DNS data in a historic manner.... |
| RiskIQ-Data-PassiveDns-Domain | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Passive DNS provides analysts with a means to see DNS data in a historic manner.... |
| RiskIQ-Data-PassiveDns-Ip | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Passive DNS provides analysts with a means to see DNS data in a historic manner.... |
| RiskIQ-Data-Whois | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. WHOIS is akin to a phone book for the Internet; it reveals the owners behind dom... |
| RiskIQ-Data-Whois-Domain | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. WHOIS is akin to a phone book for the Internet; it reveals the owners behind dom... |
| RiskIQ-Data-Whois-Ip | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. WHOIS is akin to a phone book for the Internet; it reveals the owners behind dom... |
| RiskIQ-Intel-Summary-Ip-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. RiskIQ intelligence provides analyst with deeper context around vulnerabilities,... |
| RiskIQ-Intel-Summary-Ip-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. RiskIQ intelligence provides analyst with deeper context around vulnerabilities,... |
| RiskIQ-Intel-Summary-Domain-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. RiskIQ intelligence provides analyst with deeper context around vulnerabilities,... |
| RiskIQ-Intel-Summary-Domain-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. RiskIQ intelligence provides analyst with deeper context around vulnerabilities,... |
| RiskIQ-Intel-Summary-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. RiskIQ intelligence provides analyst with deeper context around vulnerabilities,... |
| RiskIQ-Intel-Summary-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. RiskIQ intelligence provides analyst with deeper context around vulnerabilities,... |
| RiskIQ-Intel-Reputation-Ip-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Reputation information provides analyst with a decision as to whether an indicat... |
| RiskIQ-Intel-Reputation-Ip-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Reputation information provides analyst with a decision as to whether an indicat... |
| RiskIQ-Intel-Reputation-Domain-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Reputation information provides analyst with a decision as to whether an indicat... |
| RiskIQ-Intel-Reputation-Domain-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Reputation information provides analyst with a decision as to whether an indicat... |
| RiskIQ-Intel-Reputation-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Reputation information provides analyst with a decision as to whether an indicat... |
| RiskIQ-Intel-Reputation-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Reputation information provides analyst with a decision as to whether an indicat... |
| RiskIQ-Data-Summary-Ip-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. The RiskIQ summary data will provide analysts with an understanding of what Risk... |
| RiskIQ-Data-Summary-Ip-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. The RiskIQ summary data will provide analysts with an understanding of what Risk... |
| RiskIQ-Data-Summary-Domain-alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. The RiskIQ summary data will provide analysts with an understanding of what Risk... |
| RiskIQ-Data-Summary-Domain-incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. The RiskIQ summary data will provide analysts with an understanding of what Risk... |
| RiskIQ Data Summary Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. The RiskIQ summary data will provide analysts with an understanding of what Risk... |
| RiskIQ Data Summary Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. The RiskIQ summary data will provide analysts with an understanding of what Risk... |
| RiskIQ-Automated-Triage-Alert | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Indicators from an incident will be evaluated with RiskIQ reputation data. If an... |
| RiskIQ-Automated-Triage-Incident | Playbook | 📦 Solution | RiskIQ | This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Microsoft Sentinel. Indicators from an incident will be evaluated with RiskIQ reputation data. If an... |
| RSASecurIDAMEvent | Parser | 📦 Solution | RSA SecurID | |
| RSA ID Plus - Locked Administrator Account Detected | Analytic Rule | 📦 Solution | RSAIDPlus_AdminLogs_Connector | Raises an alert when an admin account is locked out of the Admin console (RSAIDPlus Admin Events). |
| SendEmailonRSAIDPlusAlert | Playbook | 📦 Solution | RSAIDPlus_AdminLogs_Connector | Sends an email notification when an RSA ID Plus analytic rule triggers. This playbook can be linked via automation rules. |
| Rubrik Critical Anomaly | Analytic Rule | 📦 Solution | RubrikSecurityCloud | Rubrik Critical Anomaly rule matches Severity and if Critical severity found then generate the incident for each object. |
| Rubrik Threat Monitoring | Analytic Rule | 📦 Solution | RubrikSecurityCloud | Rubrik Threat Monitoring matches Event Name and if match found then generate the incident for each object. |
| Rubrik Advanced Threat Hunt | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook fetches the object mapped with incident and starts advance threat hunt. |
| Rubrik Anomaly Analysis | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook queries Rubrik Security Cloud to enrich the Anomaly event with additional information regarding the Ransomware analysis, results from sensitive data scans, (to aid in incident prioritiza... |
| Rubrik Anomaly Generate Downloadable Link | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook will generate downloadable links according to objectType (VMware, Fileset or VolumeGroup) and add suspiciousFiles and downloadable links as an incident comment to enrich the anomaly. |
| Rubrik Anomaly Incident Response | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook provides an end to end example of the collection of Ransomware Anomaly information from Rubrik, its enrichment with Data Classification insights (to aid in incident prioritization), and ... |
| Rubrik Data Object Discovery | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook queries Rubrik Security Cloud to enrich the incoming event with additional information from Rubrik about the object and it's snapshots that the event refers to. |
| Rubrik File Object Context Analysis | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook will retrieve policy hits from Rubrik Security Cloud for a given object, for a particular file, folder, or file share. |
| Rubrik Fileset Ransomware Discovery | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook queries Rubrik Security Cloud to enrich the incoming event with additional information from Rubrik about the fileset object and perform an IOC scan against the fileset. |
| Rubrik IOC Scan | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook interacts with Rubrik Security Cloud to scan backups for specified IOCs. This playbook is used by other playbooks that leverage this capability. |
| Rubrik Poll Async Result | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook is used by other playbooks to poll for results from some of the asynchronous API calls that are invoked by other playbooks. |
| Rubrik Ransomware Discovery and File Recovery | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook interacts with Rubrik Security Cloud to (1) optionally preserve evidence by creating an on-demand snapshot of the object, (2) identify a potential recovery point by scanning backups for ... |
| Rubrik Ransomware Discovery and VM Recovery | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook interacts with Rubrik Security Cloud to (1) optionally preserve evidence by creating an on-demand snapshot of the object, (2) identify a potential recovery point by scanning backups for ... |
| Rubrik Retrieve User Intelligence Information | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook queries Rubrik Security Cloud to get risk detail and policy hits details for a username or email address, and enriches the incident by adding incident comment |
| Rubrik Turbo Threat Hunt | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook fetches the object mapped with incident and starts turbo threat hunt. |
| Rubrik Update Anomaly Status | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook will resolve or report false positive to unresolved anomaly and update status as resolved. |
| Rubrik Update Anomaly Status Via Incident | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook queries Rubrik Security Cloud to enrich the Anomaly event with additional information and internally calls RubrikUpdateAnomalyStatus playbook with additional anomaly information to resol... |
| Rubrik User Intelligence Analysis | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook queries Rubrik Security Cloud to get user sensitive data and update severity of incident accordingly. This playbook calls the RubrikRetrieveUserIntelligenceInformation playbook internall... |
| RubrikWorkloadAnalysis | Playbook | 📦 Solution | RubrikSecurityCloud | This playbook retrieves sensitive IP and Host data to enrich the incident details, and adjusts the incident's severity level based on the gathered information. |
| SailPointIdentityNowAlertForTriggers | Analytic Rule | 📦 Solution | SailPointIdentityNow | Create alerts for SailPoint IdentityNow Event Trigger Service. |
| SailPointIdentityNowEventType | Analytic Rule | 📦 Solution | SailPointIdentityNow | Created to detect failed events of particular type from SailPointIDN_Events. |
| SailPointIdentityNowEventTypeTechnicalName | Analytic Rule | 📦 Solution | SailPointIdentityNow | Created to detect new threat events from the data in SailPointIDN_Events. |
| SailPointIdentityNowFailedEvents | Analytic Rule | 📦 Solution | SailPointIdentityNow | Detects all events with status failed. |
| SailPointIdentityNowFailedEventsBasedOnTime | Analytic Rule | 📦 Solution | SailPointIdentityNow | Detects failed events based on created time. |
| SailPointIdentityNowUserWithFailedEvent | Analytic Rule | 📦 Solution | SailPointIdentityNow | Detects any failed event for a particular user. |
| SalemDashboard | Workbook | 📦 Solution | SalemCyber | |
| Send-Sentinel-Alerts-to-Salem | Playbook | 📦 Solution | SalemCyber | Use this playbook to send Microsoft Sentinel alerts to Salem Virtual Cyber Analyst |
| Brute force attack against user credentials | Analytic Rule | 📦 Solution | Salesforce Service Cloud | Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresse... |
| Potential Password Spray Attack | Analytic Rule | 📦 Solution | Salesforce Service Cloud | This query searches for failed attempts to log in from more than 15 various users within a 5 minutes timeframe from the same source. This is a potential indication of a password spray attack. |
| User Sign in from different countries | Analytic Rule | 📦 Solution | Salesforce Service Cloud | This query searches for successful user logins from different countries within 30 mins. |
| SalesforceServiceCloud | Workbook | 📦 Solution | Salesforce Service Cloud | |
| SalesforceServiceCloud | Parser | 📦 Solution | Salesforce Service Cloud | |
| Samsung Knox - Application Privilege Escalation or Change Events | Analytic Rule | 📦 Solution | Samsung Knox Asset Intelligence | When a Knox mobile app has transitioned from an acceptable uid/esuid/fsuid to a different, non-App id. |
| Samsung Knox - Mobile Device Boot Compromise Events | Analytic Rule | 📦 Solution | Samsung Knox Asset Intelligence | When a Knox device boot binary is at risk of compromise. |
| Samsung Knox - Password Lockout Events | Analytic Rule | 📦 Solution | Samsung Knox Asset Intelligence | When maximum password attempts have been reached, and the Knox device is locked out. This is based on a threshold set in the MDM device policy |
| Samsung Knox - Peripheral Access Detection with Camera Events | Analytic Rule | 📦 Solution | Samsung Knox Asset Intelligence | When camera access has been detected on a Knox device, even though such access is disabled through an MDM device policy. |
| Samsung Knox - Peripheral Access Detection with Mic Events | Analytic Rule | 📦 Solution | Samsung Knox Asset Intelligence | When microphone access has been detected on a Knox device, even though such access is disabled through an MDM device policy. |
| Samsung Knox - Security Log Full Events | Analytic Rule | 📦 Solution | Samsung Knox Asset Intelligence | When the Knox Security Log is full on a device. |
| Samsung Knox - Suspicious URL Accessed Events | Analytic Rule | 📦 Solution | Samsung Knox Asset Intelligence | When a Knox device user clicks on URLs or links detected as suspicious (potentially phishing or malicious) with a high degree of confidence. |
| SamsungKnoxAssetIntelligence | Workbook | 📦 Solution | Samsung Knox Asset Intelligence | |
| SAP - Lock User (Agentless Basic) 🔍 | Playbook | 📦 Solution | SAP | This playbook locks an SAP user when triggered by a Microsoft Sentinel incident. It dynamically finds SAP-specific alert details across all alerts in the incident, supporting complex multi-alert incid... |
| workflow 🔍 | Playbook | 📦 Solution | SAP | < 🏡home |
| workflow 🔍 | Playbook | 📦 Solution | SAP | < 🏡home |
| BTP - Audit log service unavailable | Analytic Rule | 📦 Solution | SAP BTP | Identifies SAP BTP subaccounts that have not reported audit logs for an unusual period. This could indicate that the audit log service has been disabled or tampered with, potentially by an attacker at... |
| BTP - Build Work Zone unauthorized access and role tampering | Analytic Rule | 📦 Solution | SAP BTP | Identifies unauthorized OData access attempts and mass role/user deletions in SAP Build Work Zone Standard Edition. These events may indicate an attacker accessing restricted resources or removing a... |
| BTP - Cloud Identity Service application configuration monitor | Analytic Rule | 📦 Solution | SAP BTP | Identifies CRUD operations on Application (SSO Domain/Service Provider) configurations within SAP Cloud Identity Service. This includes both SAML 2.0 and OpenID Connect applications. Unauthorized appl... |
| BTP - Cloud Integration access policy tampering | Analytic Rule | 📦 Solution | SAP BTP | Identifies changes to access policies in SAP Cloud Integration. Access policies control authorization for integration artifacts, defining which users and roles can access specific integration flows an... |
| BTP - Cloud Integration artifact deployment | Analytic Rule | 📦 Solution | SAP BTP | Identifies deployment and undeployment of integration artifacts in SAP Cloud Integration. Integration flows are executable code that can process, transform, and route data between systems. Unauthoriz... |
| BTP - Cloud Integration JDBC data source changes | Analytic Rule | 📦 Solution | SAP BTP | Identifies deployment and undeployment of JDBC data source configurations in SAP Cloud Integration. JDBC data sources contain database connection credentials and configuration that enable integration ... |
| BTP - Cloud Integration package import or transport | Analytic Rule | 📦 Solution | SAP BTP | Identifies import and transport operations for integration packages and artifacts in SAP Cloud Integration. Packages contain integration flows, mappings, scripts, and other artifacts that can be impor... |
| BTP - Cloud Integration tampering with security material | Analytic Rule | 📦 Solution | SAP BTP | Identifies operations on security material (credentials, certificates, and keys) within SAP Cloud Integration. This includes credentials (passwords/secrets), X.509 certificates and key pairs, and PGP ... |
| BTP - Failed access attempts across multiple BAS subaccounts | Analytic Rule | 📦 Solution | SAP BTP | Identifies failed Business Application Studio access attempts over a predefined number of subaccounts. |
| BTP - Malware detected in BAS dev space | Analytic Rule | 📦 Solution | SAP BTP | Identifies instances of malware detected using SAP internal malware agent within Business Application Studio dev spaces. |
| BTP - Mass user deletion in a sub account | Analytic Rule | 📦 Solution | SAP BTP | Identifies user account deletion activity where the amount of deleted users exceeds a predefined threshold. |
| BTP - Mass user deletion in SAP Cloud Identity Service | Analytic Rule | 📦 Solution | SAP BTP | Identifies mass user deletion activity in SAP Cloud Identity Service where the amount of deleted users exceeds a predefined threshold. |
| BTP - Trust and authorization Identity Provider monitor | Analytic Rule | 📦 Solution | SAP BTP | Identifies CRUD operations on Identity Provider settings within a sub account. |
| BTP - User added to Cloud Identity Service privileged Administrators list | Analytic Rule | 📦 Solution | SAP BTP | Identifies when a user is granted privileged administrator permissions in SAP Cloud Identity Service. These permissions include managing Identity Providers, Service Providers, Users, Groups, and Acces... |
| BTP - User added to sensitive privileged role collection | Analytic Rule | 📦 Solution | SAP BTP | Identifies identity management actions whereby a user is added to a set of monitored privileged role collections. |
| SAPBTPActivity | Workbook | 📦 Solution | SAP BTP | |
| SAP ETD - Execution of Sensitive Function Module | Analytic Rule | 📦 Solution | SAP ETD Cloud | Identifies execution of a sensitive ABAP Function Module using the watchlists provided by the Microsoft Sentinel Solution for SAP Source Action: Execute a sensitive function module directly using SE3... |
| SAP ETD - Login from unexpected network | Analytic Rule | 📦 Solution | SAP ETD Cloud | Identifies logons from an unexpected network. Source Action: Logon to the backend system from an IP address which is not assigned to one of the networks. networks can be maintained in the "SAP - Netwo... |
| SAP ETD - Synch alerts | Analytic Rule | 📦 Solution | SAP ETD Cloud | Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way) |
| SAP ETD - Synch investigations | Analytic Rule | 📦 Solution | SAP ETD Cloud | Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way) |
| SAP LogServ - HANA DB - Assign Admin Authorizations | Analytic Rule | 📦 Solution | SAP LogServ | Identifies admin privileges/roles assignment. Source Action: Assign a user with any Admin role / privileges. *Data Sources: SAP LogServ - HANA DB (Syslog)* |
| SAP LogServ - HANA DB - Audit Trail Policy Changes | Analytic Rule | 📦 Solution | SAP LogServ | Identifies changes for HANA DB audit trail policies. Source Action: Create / update existing audit policy in security definitions. *Data Sources: SAP LogServ - HANA DB (Syslog)* |
| SAP LogServ - HANA DB - Deactivation of Audit Trail | Analytic Rule | 📦 Solution | SAP LogServ | Identifies deactivation of HANA DB audit log. Source Action: Deactivate Audit Log in HANA DB security defnitions. *Data Sources: SAP LogServ - HANA DB (Syslog)* |
| SAP LogServ - HANA DB - User Admin actions | Analytic Rule | 📦 Solution | SAP LogServ | Identifies user administration actions. Souirce Action: Create/Update/Delete a DB User. *Data Sources: SAP LogServ - HANA DB (Syslog)* |
| SAPLogServObserve | Workbook | 📦 Solution | SAP LogServ | |
| SecurityBridge: A critical event occured | Analytic Rule | 📦 Solution | SecurityBridge App | This rule alerts if there is any critical event occured in the SAP system |
| SecurityBridgeThreatDetectionforSAP | Workbook | 📦 Solution | SecurityBridge App | |
| SecurityScorecardWorkbook | Workbook | 📦 Solution | SecurityScorecard Cybersecurity Ratings | |
| Possible AiTM Phishing Attempt Against Microsoft Entra ID | Analytic Rule | 📦 Solution | SecurityThreatEssentialSolution | Threat actors may attempt to phish users in order to hijack a users sign-in session, and skip the authentication process even if the user had enabled multifactor authentication (MFA) by stealing and r... |
| Threat Essentials - Mail redirect via ExO transport rule | Analytic Rule | 📦 Solution | SecurityThreatEssentialSolution | Identifies when Exchange Online transport rule configured to forward emails. This could be an adversary mailbox configured to collect mail from multiple user accounts. |
| Threat Essentials - Multiple admin membership removals from newly created admin. | Analytic Rule | 📦 Solution | SecurityThreatEssentialSolution | This query detects when newly created Global admin removes multiple existing global admins which can be an attempt by adversaries to lock down organization and retain sole access. Investigate reason... |
| Threat Essentials - NRT User added to Microsoft Entra ID Privileged Groups | Analytic Rule | 📦 Solution | SecurityThreatEssentialSolution | This will alert when a user is added to any of the Privileged Groups. For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-aud... |
| Threat Essentials - Time series anomaly for data size transferred to public internet | Analytic Rule | 📦 Solution | SecurityThreatEssentialSolution | Identifies anomalous data transfer to public networks. The query leverages built-in KQL anomaly detection algorithms that detects large deviations from a baseline pattern. A sudden increase in data tr... |
| Threat Essentials - Mass Cloud resource deletions Time Series Anomaly | Analytic Rule | 📦 Solution | SecurityThreatEssentialSolution | This query generates baseline pattern of cloud resource deletions by an user and generated anomaly when any unusual spike is detected. These anomalies from unusual or privileged users could be an indi... |
| Threat Essentials - User Assigned Privileged Role | Analytic Rule | 📦 Solution | SecurityThreatEssentialSolution | Identifies when a new privileged role is assigned to a user. Any account eligible for a role is now being given privileged access. If the assignment is unexpected or into a role that isn't the respon... |
| Threat Essentials - Signins from Nord VPN Providers | Hunting Query | 📦 Solution | SecurityThreatEssentialSolution | This query looks for sign-in activity from NordVPN providers using the public feed leveraging the NordVPN API. Investigation of any unknown sign-in attempts from VPN providers such as Nord VPN unless ... |
| Threat Essentials - Signins From VPS Providers | Hunting Query | 📦 Solution | SecurityThreatEssentialSolution | Look for successful logons from known VPS provider network ranges with suspicious token-based logon patterns. This is not an exhaustive list of VPS provider ranges, but it covers some of the most prev... |
| Semperis DSP Mimikatz's DCShadow Alert | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | Mimikatz's DCShadow switch allows a user who has compromised an AD domain, to inject arbitrary changes into AD using a "fake" domain controller. These changes bypass the security event log and can't b... |
| Semperis DSP Kerberos krbtgt account with old password | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | The krbtgt user account is a special (disabled) user account in every Active Directory domain that has a special role in Kerberos function. If this account's password is compromised, Golden Ticket att... |
| Semperis DSP Recent sIDHistory changes on AD objects | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | This indicator detects any recent changes to sIDHistory on AD objects, including changes to non-privileged accounts where privileged SIDs are added. |
| Semperis DSP Well-known privileged SIDs in sIDHistory | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | This indicator looks for security principals that contain specific SIDs of accounts from built-in privileged groups within their sIDHistory attribute. This would allow those security principals to hav... |
| Semperis DSP Zerologon vulnerability | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | This indicator looks for security vulnerability to CVE-2020-1472, which was patched by Microsoft in August 2020. Without this patch, an unauthenticated attacker can exploit CVE-2020-1472 to elevate th... |
| Semperis DSP Failed Logons | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | Alerts when there are failed logons in the DSP system. |
| Semperis DSP Operations Critical Notifications | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | Alerts when there are critical notifications fired in the DSP system. |
| Semperis DSP RBAC Changes | Analytic Rule | 📦 Solution | Semperis Directory Services Protector | Alerts when there are RBAC changes in the DSP system. |
| SemperisDSPADChanges | Workbook | 📦 Solution | Semperis Directory Services Protector | |
| SemperisDSPNotifications | Workbook | 📦 Solution | Semperis Directory Services Protector | |
| SemperisDSPQuickviewDashboard | Workbook | 📦 Solution | Semperis Directory Services Protector | |
| SemperisDSPSecurityIndicators | Workbook | 📦 Solution | Semperis Directory Services Protector | |
| SemperisDSPWorkbook 🔍 | Workbook | 📦 Solution | Semperis Directory Services Protector | |
| workbooksMetadata 🔍 | Workbook | 📦 Solution | Semperis Directory Services Protector | |
| dsp_parser | Parser | 📦 Solution | Semperis Directory Services Protector | |
| Azure secure score admin MFA | Analytic Rule | 📦 Solution | SenservaPro | This query searches for requiring multi-factor authentication (MFA) for all administrative roles makes it harder for attackers to access accounts. Administrative roles have higher permissions than typ... |
| SenservaPro AD Applications Not Using Client Credentials | Analytic Rule | 📦 Solution | SenservaPro | Searches for logs of AD Applications without Client Credentials (Key or Secret) |
| Azure secure score block legacy authentication | Analytic Rule | 📦 Solution | SenservaPro | This query searches for most compromising sign-in attempts come from legacy authentication. Older office clients such as Office 2010 do not support modern authentication and use legacy protocols suc... |
| Azure secure score role overlap | Analytic Rule | 📦 Solution | SenservaPro | This query searches for accounts that have been assigned Global Administrator do not need other roles assigned. Global Administrators have access to all aspects of Azure |
| Azure secure score MFA registration V2 | Analytic Rule | 📦 Solution | SenservaPro | This query searches for multi-factor authentication (MFA) helps protect devices and data that are accessible to these users. Adding more authentication methods, such as the Microsoft Authenticator app... |
| Non-admin guest | Analytic Rule | 📦 Solution | SenservaPro | This query searches for guest is not an admin in Azure |
| Service principal not using client credentials | Analytic Rule | 📦 Solution | SenservaPro | This query searches for an service principal is not using a client certificate or secret is not secure. It is recommended that you review your needs and use an Authentication method for sign-in. |
| Azure secure score one admin | Analytic Rule | 📦 Solution | SenservaPro | This query searches for having 1 Global Administrator reduces the surface area of attack for your Azure tenant, but sets up a single point of failure for the whole tenant. Global Administrators have a... |
| Azure secure score PW age policy new | Analytic Rule | 📦 Solution | SenservaPro | This query searches for having found that when periodic password resets are enforced, passwords become less secure. Users tend to pick a weaker password and vary it slightly for each reset. If a use... |
| Stale last password change | Analytic Rule | 📦 Solution | SenservaPro | This query searches for stale last password change |
| Azure Secure Score Self Service Password Reset | Analytic Rule | 📦 Solution | SenservaPro | This query searches for requires you to setup Microsoft Entra ID Connect. Microsoft Entra ID Connect is free with all Azure Subscriptions |
| Azure secure score sign in risk policy | Analytic Rule | 📦 Solution | SenservaPro | This query searches for an active Azure Premium P2 license is required to use and edit this policy. You will be required to have setup the MFA Policy before activating this policy |
| Third party integrated apps | Analytic Rule | 📦 Solution | SenservaPro | This query searches for your services by regulating the access of third-party integrated apps. Only allow access to necessary apps that support robust security controls. Third-party applications a... |
| UserAccountDisabled | Analytic Rule | 📦 Solution | SenservaPro | This query searches for account is Disabled. Does not effect score as its easily enabled. |
| Azure secure score user risk policy | Analytic Rule | 📦 Solution | SenservaPro | This query searches for an active Azure Premium P2 license is required to use and edit this policy. You will be required to have setup the MFA Policy before activating this policy |
| Application not using client credentials | Hunting Query | 📦 Solution | SenservaPro | This query searches for application not using a client certificate or secret is not secure. |
| Azure secure score admin MFA V2 | Hunting Query | 📦 Solution | SenservaPro | This query searches for requiring multi-factor authentication (MFA) for all administrative roles makes it harder for attackers to access accounts. Administrative roles have higher permissions than ty... |
| Azure secure score block legacy authentication | Hunting Query | 📦 Solution | SenservaPro | This query searches for most compromising sign-in attempts come from legacy authentication. Older office clients such as Office 2010 do not support modern authentication and use legacy protocols s... |
| Azure secure score integrated apps | Hunting Query | 📦 Solution | SenservaPro | This query searches for your services by regulating the access of third-party integrated apps. Only allow access to necessary apps that support robust security controls. |
| Azure secure score MFA registration V2 | Hunting Query | 📦 Solution | SenservaPro | This query searches for multi-factor authentication (MFA) helps protect devices and data that are accessible to these users. Adding more authentication methods, increases the level of protection i... |
| Azure secure score one admin | Hunting Query | 📦 Solution | SenservaPro | This query searches for having 1 Global Administrator reduces the surface area of attack for your Azure tenant, but sets up a single point of failure for the whole tenant. Global Administrators have... |
| Azure secure score PW age policy new | Hunting Query | 📦 Solution | SenservaPro | This query searches for having found that when periodic password resets are enforced, passwords become less secure. Users tend to pick a weaker password and vary it slightly for each reset. |
| Azure secure score role overlap | Hunting Query | 📦 Solution | SenservaPro | This query searches for accounts that have been assigned Global Administrator do not need other roles assigned. Global Administrators have access to all aspects of Azure |
| Azure Secure Score Self Service Password Reset | Hunting Query | 📦 Solution | SenservaPro | This query searches for requires you to setup Microsoft Entra ID Connect. Microsoft Entra ID Connect is free with all Azure Subscriptions |
| Azure secure score sign in risk policy | Hunting Query | 📦 Solution | SenservaPro | This query searches for an active Azure Premium P2 license is required to use and edit this policy. You will be required to have setup the MFA Policy before activating this policy |
| Azure secure score user risk policy | Hunting Query | 📦 Solution | SenservaPro | This query searches for an active Azure Premium P2 license is required to use and edit this policy. You will be required to have setup the MFA Policy before activating this policy |
| Non-admin guest | Hunting Query | 📦 Solution | SenservaPro | This query searches for guest is not an admin in Azure |
| Service principal not using client credentials | Hunting Query | 📦 Solution | SenservaPro | This query searches for an service principal is not using a client certificate or secret is not secure. It is recommended that you review your needs and use an Authentication method for sign-in. |
| Stale last password change | Hunting Query | 📦 Solution | SenservaPro | This query searches for stale last password change |
| UserAccountDisabled | Hunting Query | 📦 Solution | SenservaPro | This query searches for account is Disabled. Does not effect score as its easily enabled. |
| SenservaProAnalyticsWorkbook | Workbook | 📦 Solution | SenservaPro | |
| SenservaProMultipleWorkspaceWorkbook | Workbook | 📦 Solution | SenservaPro | |
| SenservaProSecureScoreMultiTenantWorkbook | Workbook | 📦 Solution | SenservaPro | |
| Sentinel One - Admin login from new location | Analytic Rule | 📦 Solution | SentinelOne | Detects admin user login from new location (IP address). |
| Sentinel One - Agent uninstalled from multiple hosts | Analytic Rule | 📦 Solution | SentinelOne | Detects when agent was uninstalled from multiple hosts. |
| Sentinel One - Alert from custom rule | Analytic Rule | 📦 Solution | SentinelOne | Detects when alert from custom rule received. |
| Sentinel One - Blacklist hash deleted | Analytic Rule | 📦 Solution | SentinelOne | Detects when blacklist hash was deleted. |
| Sentinel One - Exclusion added | Analytic Rule | 📦 Solution | SentinelOne | Detects when new exclusion added. |
| Sentinel One - Multiple alerts on host | Analytic Rule | 📦 Solution | SentinelOne | Detects when multiple alerts received from same host. |
| Sentinel One - New admin created | Analytic Rule | 📦 Solution | SentinelOne | Detects when new admin user is created. |
| Sentinel One - Rule deleted | Analytic Rule | 📦 Solution | SentinelOne | Detects when a rule was deleted. |
| Sentinel One - Rule disabled | Analytic Rule | 📦 Solution | SentinelOne | Detects when a rule was disabled. |
| Sentinel One - Same custom rule triggered on different hosts | Analytic Rule | 📦 Solution | SentinelOne | Detects when same custom rule was triggered on different hosts. |
| Sentinel One - User viewed agent's passphrase | Analytic Rule | 📦 Solution | SentinelOne | Detects when a user viewed agent's passphrase. |
| Sentinel One - Agent not updated | Hunting Query | 📦 Solution | SentinelOne | Query shows agent which are not updated to the latest version. |
| Sentinel One - Agent status | Hunting Query | 📦 Solution | SentinelOne | Query shows agent properties. |
| Sentinel One - Alert triggers (files, processes, strings) | Hunting Query | 📦 Solution | SentinelOne | Query shows alert triggers (e.g. files, processes, etc.). |
| Sentinel One - Hosts not scanned recently | Hunting Query | 📦 Solution | SentinelOne | Query searches for hosts wich were not scanned recently. |
| Sentinel One - New rules | Hunting Query | 📦 Solution | SentinelOne | Query shows new rules. |
| Sentinel One - Deleted rules | Hunting Query | 📦 Solution | SentinelOne | Query shows deleted rules. |
| Sentinel One - Scanned hosts | Hunting Query | 📦 Solution | SentinelOne | Query searches for hosts with completed full scan. |
| Sentinel One - Sources by alert count | Hunting Query | 📦 Solution | SentinelOne | Query shows sources (hosts) by alert count. |
| Sentinel One - Uninstalled agents | Hunting Query | 📦 Solution | SentinelOne | Query shows uninstalled agents. |
| Sentinel One - Users by alert count | Hunting Query | 📦 Solution | SentinelOne | Query shows users by alert count. |
| SentinelOne | Workbook | 📦 Solution | SentinelOne | |
| SentinelOne | Parser | 📦 Solution | SentinelOne | |
| AutomationHealth | Workbook | 📦 Solution | SentinelSOARessentials | |
| IncidentOverview 🔍 | Workbook | 📦 Solution | SentinelSOARessentials | |
| IncidentTasksWorkbook | Workbook | 📦 Solution | SentinelSOARessentials | |
| SecurityOperationsEfficiency | Workbook | 📦 Solution | SentinelSOARessentials | |
| Create Incident From Microsoft Forms Response | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will create a new Microsoft Sentinel incident when Microsoft Forms response is submitted. |
| Create Incident From Shared Mailbox | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will create a new Microsoft Sentinel incident when new email arrives to shared mailbox with 'incident' keyword in the subject. |
| Incident tasks - Microsoft Defender XDR BEC Playbook for SecOps | Playbook | 📦 Solution | SentinelSOARessentials | This playbook add Incident Tasks based on Microsoft Defender XDR BEC Playbook for SecOps. This playbook will walk the analyst through four stages of responding to a BEC incident: containment, investig... |
| Incident tasks - Microsoft Defender XDR Phishing Playbook for SecOps | Playbook | 📦 Solution | SentinelSOARessentials | This playbook add Incident Tasks based on Microsoft Defender XDR Phishing Playbook for SecOps. This playbook will walk the analyst through four stages of responding to a phishing incident: containment... |
| Incident tasks - Microsoft Defender XDR Ransomware Playbook for SecOps | Playbook | 📦 Solution | SentinelSOARessentials | This playbook add Incident Tasks based on Microsoft Defender XDR Ransomware Playbook for SecOps. This playbook will walk the analyst through four stages of responding to a ransomware incident: contain... |
| HTTP Trigger Entity Analyzer | Playbook | 📦 Solution | SentinelSOARessentials | This playbook is triggered by HTTP POST requests with entity information and performs automated investigation and enrichment of URL and User entities with asynchronous processing. |
| Incident Assignment Shifts | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will assign an Incident to an owner based on the Shifts schedule in Microsoft Teams. When an incident is assigned, the incident owner will be notified via email. Incidents are assigned t... |
| Incident Trigger Entity Analyzer | Playbook | 📦 Solution | SentinelSOARessentials | This playbook is triggered by Microsoft Sentinel incidents and performs automated investigation and enrichment of URL and User entities associated with the incident. It includes intelligent user ident... |
| Notify When Incident Is Closed | Playbook | 📦 Solution | SentinelSOARessentials | This playbook is utilizing new update trigger to notify person/group on Microsoft Teams/Outlook when incident is closed. |
| Notify When Incident Is Reopened | Playbook | 📦 Solution | SentinelSOARessentials | This playbook is utilizing new update trigger to notify person/group on Microsoft Teams/Outlook when incident is reopened. |
| Notify When Incident Severity Changed | Playbook | 📦 Solution | SentinelSOARessentials | This playbook is utilizing new update trigger to notify person/group on Microsoft Teams/Outlook when incident severity change. |
| Notify Incident Owner in Microsoft Teams | Playbook | 📦 Solution | SentinelSOARessentials | This playbook sends a Teams message to the new incident owner. |
| Post-Message-Slack | Playbook | 📦 Solution | SentinelSOARessentials | Author: Yaniv Shasha |
| Post-Message-Teams | Playbook | 📦 Solution | SentinelSOARessentials | Author: Yaniv Shasha |
| Relate alerts to incident by IP | Playbook | 📦 Solution | SentinelSOARessentials | This playbook looks for other alerts with the same IP as the triggered incident. When such an alert is found, this playbook will add the alert to the incident (only if it isn't related to another inci... |
| Send basic email | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will be sending email with basic incidents details (Incident title, severity, tactics, link,…) when incident is created in Microsoft Sentinel. |
| Send email with formatted incident report | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will be sending email with formated incidents report (Incident title, severity, tactics, link,…) when incident is created in Microsoft Sentinel. Email notification is made in HTML. |
| Send incident email with XDR Portal links | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will send an email with incident and entity information with all links pointing to the security.microsoft.com portal |
| Send incident Teams Adaptive Card with XDR Portal links | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will send a Teams adaptive card with incident and entity information with all links pointing to the security.microsoft.com portal |
| Send Teams Adaptive Card on incident creation | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will send Microsoft Teams Adaptive Card on incident creation, with the option to change the incident's severity and/or status. |
| URL Trigger Entity Analyzer | Playbook | 📦 Solution | SentinelSOARessentials | This playbook is triggered manually when a URL entity is selected in a Microsoft Sentinel incident and provides detailed security insights including classification, analysis results, and recommendatio... |
| Post Message Teams | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will post a message in a Microsoft Teams channel when an Alert is created in Microsoft Sentinel. |
| Post Message Teams | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will post a message in a Microsoft Teams channel when an Incident is created in Microsoft Sentinel. |
| Post Message Slack | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will post a message in a Slack channel when an alert is created in Microsoft Sentinel |
| Post Message Slack | Playbook | 📦 Solution | SentinelSOARessentials | This playbook will post a message in a Slack channel when an Incident is created in Microsoft Sentinel |
| Create And Update ServiceNow Record | Playbook | 📦 Solution | Servicenow | This playbook will create or update incident in ServiceNow. When incident is created, playbook will run and create incident in ServiceNow. When incident is updated, playbook will run and add update to... |
| Create ServiceNow record - Alert trigger | Playbook | 📦 Solution | Servicenow | This playbook will open a Service Now incident when a new incident is opened in Microsoft Sentinel. |
| Create ServiceNow record - Incident trigger | Playbook | 📦 Solution | Servicenow | This playbook will open a Service Now incident when a new incident is opened in Microsoft Sentinel. |
| ServiceNow TISC Batch Indicator Uploader | Playbook | 📦 Solution | ServiceNow TISC | This playbook will write indicators in batch to ThreatIntelligenceIndicator log analytics table. This playbook referenced by **ServiceNowTISC-Import_Observables_Batch** playbook -- which calls the Ser... |
| ServiceNow TISC Import Observables from TISC | Playbook | 📦 Solution | ServiceNow TISC | This playbook leverages the ServiceNow TISC API to import IP, Domain, URL, and Hash observables from TISC Workspace to Microsoft ThreatIntelligenceIndicator log analytics table. The imported observabl... |
| Export Domain Entity to TISC | Playbook | 📦 Solution | ServiceNow TISC | This playbook leverages the ServiceNow TISC API to export Domain indicators found in Microsoft Sentinel incidents to TISC Workspace. |
| Export Hash Entity to TISC | Playbook | 📦 Solution | ServiceNow TISC | This playbook leverages the ServiceNow TISC API to export Hash indicators found in Microsoft Sentinel incidents to TISC Workspace. |
| Export all Incident Entities to TISC | Playbook | 📦 Solution | ServiceNow TISC | This playbook leverages the ServiceNow TISC API to export IP, Domain, URL, and Hash indicators found in Microsoft Sentinel incidents to TISC Workspace. |
| Export IP Entity to TISC | Playbook | 📦 Solution | ServiceNow TISC | This playbook leverages the ServiceNow TISC API to export IP indicators found in Microsoft Sentinel incidents to TISC Workspace. |
| Export URL Entity to TISC | Playbook | 📦 Solution | ServiceNow TISC | This playbook leverages the ServiceNow TISC API to export URL indicators found in Microsoft Sentinel incidents to TISC Workspace |
| ServiceNow TISC Incident Enrichment | Playbook | 📦 Solution | ServiceNow TISC | This playbook leverages the ServiceNow TISC API to enrich IP, Domain, URL, and Hash indicators found in Microsoft Sentinel incidents. The enrichment content will be posted as a comment in the Microsof... |
| Enrich Incidents - ShadowByte Aria | Playbook | 📦 Solution | ShadowByte Aria | This playbook updates the Incident with the brach details if an account has been compromised. |
| Search for Breaches - ShadowByte Aria | Playbook | 📦 Solution | ShadowByte Aria | This playbook updates the Incident with the brach details if an account has been compromised. |
| Shodan - Enrich Domain Name | Playbook | 📦 Solution | Shodan | This playbook can be triggered manually from a Domain Entity context to fetch geo location and running services details from Shodan.io. |
| Shodan - Enrich IP Address | Playbook | 📦 Solution | Shodan | This playbook can be triggered manually from an IP Address Entity context to fetch geo location and running services details from Shodan.io. |
| Shodan - Enrich Incident IPs and Domain Names | Playbook | 📦 Solution | Shodan | When a new sentinel incident is created, this playbook gets triggered and fetches geo location and running services details for IP addresses and domain names from Shodan.io. |
| SIGNL4 Alerting and Response | Playbook | 📦 Solution | SIGNL4 | This playbook will be sending alerts with basic incidents to SIGNL4 teams when an incident is created in Microsoft Sentinel. |
| Silverfort - Certifried Incident | Analytic Rule | 📦 Solution | Silverfort | An Active Directory domain privilege escalation vulnerability that enables a privileged user to access the Domain Controller by abusing Active Directory Certificate Service |
| Silverfort - Log4Shell Incident | Analytic Rule | 📦 Solution | Silverfort | Vulnerability allows attackers to execute arbitrary code on affected systems by exploiting a flaw in the way Log4j handles log messages containing specially crafted strings |
| Silverfort - NoPacBreach Incident | Analytic Rule | 📦 Solution | Silverfort | The NoPac vulnerability involves privilege escalation, allowing attackers to gain unauthorized access and potentially take control of an entire Active Directory domain |
| Silverfort - UserBruteForce Incident | Analytic Rule | 📦 Solution | Silverfort | A security weakness that allows attackers to gain unauthorized access to user accounts by systematically guessing the username and password combinations. |
| SilverfortWorkbook | Workbook | 📦 Solution | Silverfort | |
| SSG_Security_Incidents | Analytic Rule | 📦 Solution | SINEC Security Guard | The security analytic rule is designed to scrutinize network activity involving private IP addresses within an organization's internal network. By filtering log entries to include only those where eit... |
| SlackAudit - Empty User Agent | Analytic Rule | 📦 Solution | SlackAudit | This query shows connections to the Slack Workspace with empty User Agent. |
| SlackAudit - Multiple archived files uploaded in short period of time | Analytic Rule | 📦 Solution | SlackAudit | This query helps to detect when a user uploads multiple archived files in short period of time. |
| SlackAudit - Multiple failed logins for user | Analytic Rule | 📦 Solution | SlackAudit | This query helps to detect bruteforce of a user account. |
| SlackAudit - Public link created for file which can contain sensitive information. | Analytic Rule | 📦 Solution | SlackAudit | Detects public links for files which potentialy may contain sensitive data such as passwords, authentication tokens, secret keys. |
| SlackAudit - Suspicious file downloaded. | Analytic Rule | 📦 Solution | SlackAudit | Detects potentialy suspicious downloads. |
| SlackAudit - Unknown User Agent | Analytic Rule | 📦 Solution | SlackAudit | This query helps to detect who trying to connect to the Slack Workspace with unknown User Agent. |
| SlackAudit - User role changed to admin or owner | Analytic Rule | 📦 Solution | SlackAudit | This query helps to detect a change in the users role to admin or owner. |
| SlackAudit - User email linked to account changed. | Analytic Rule | 📦 Solution | SlackAudit | Detects when user email linked to account changes. |
| SlackAudit - User login after deactivated. | Analytic Rule | 📦 Solution | SlackAudit | Detects when user email linked to account changes. |
| SlackAudit - Applications installed | Hunting Query | 📦 Solution | SlackAudit | This query searches for application installation events. |
| SlackAudit - Deactivated users | Hunting Query | 📦 Solution | SlackAudit | This query searches for deactivated user accounts. |
| SlackAudit - Downloaded files stats | Hunting Query | 📦 Solution | SlackAudit | This query shows top users by downloads over time. |
| SlackAudit - Failed logins with unknown username | Hunting Query | 📦 Solution | SlackAudit | This query shows failed login attempts where username is unknown. |
| SlackAudit - New User created | Hunting Query | 📦 Solution | SlackAudit | This query shows new user created. |
| SlackAudit - Suspicious files downloaded | Hunting Query | 📦 Solution | SlackAudit | This query searches for potentialy suspicious files downloads. |
| SlackAudit - Uploaded files stats | Hunting Query | 📦 Solution | SlackAudit | This query shows top users by uploads over time. |
| SlackAudit - User logins by IP | Hunting Query | 📦 Solution | SlackAudit | This query shows user IP table statistics for login events. |
| SlackAudit - User Permission Changed | Hunting Query | 📦 Solution | SlackAudit | Query searches for user permissions changes events. |
| SlackAudit - Users joined channels without invites | Hunting Query | 📦 Solution | SlackAudit | Query searches for users which joined channels without invites. |
| SlackAudit | Workbook | 📦 Solution | SlackAudit | |
| SlackAudit | Parser | 📦 Solution | SlackAudit | |
| SlashNext Phishing Incident Investigation Playbook | Playbook | 📦 Solution | SlashNext | Enhance your security with threat hunting and incident investigation using this playbook. Scan with world’s largest, real-time phishing intelligence database for accurate, definitive binary verdicts o... |
| SlashNext Web Access Log Assessment | Playbook | 📦 Solution | SlashNext | Designed to analyze Web Access logs from Web Gateways and Firewalls. Scan your logs for continuous detection of phishing and malicious threat URLs clicked by end users. Identify threats missed by curr... |
| SlashNext Security Events for Microsoft Sentinel - Get customer incidents and log | Playbook | 📦 Solution | SlashNext SIEM | The playbook will run after every 3 mintues to get list of events occured to a customer in that time and log them in Log Analytic Workspace. |
| Snowflake - Possible discovery activity | Analytic Rule | 📦 Solution | Snowflake | Detects possible discovery activity. |
| Snowflake - Abnormal query process time | Analytic Rule | 📦 Solution | Snowflake | Detects query with abnormal proccess time. |
| Snowflake - Multiple failed queries | Analytic Rule | 📦 Solution | Snowflake | Detects multiple failed queries in short timeframe. |
| Snowflake - Multiple login failures by user | Analytic Rule | 📦 Solution | Snowflake | Detects multiple login failures by user. |
| Snowflake - Multiple login failures from single IP | Analytic Rule | 📦 Solution | Snowflake | Detects Mmltiple login failures from single IP. |
| Snowflake - Possible data destraction | Analytic Rule | 📦 Solution | Snowflake | Detects possible data destruction. |
| Snowflake - Possible privileges discovery activity | Analytic Rule | 📦 Solution | Snowflake | Detects possible privileges discovery activity. |
| Snowflake - Query on sensitive or restricted table | Analytic Rule | 📦 Solution | Snowflake | Detects query on sensitive or restricted table. |
| Snowflake - Unusual query | Analytic Rule | 📦 Solution | Snowflake | Detects unusual query. |
| Snowflake - User granted admin privileges | Analytic Rule | 📦 Solution | Snowflake | Detects when user asigned admin privileges. |
| Snowflake - Privileged users' source IP addresses | Hunting Query | 📦 Solution | Snowflake | Query searches for privileged users' source IP addresses. |
| Snowflake - Deleted databases | Hunting Query | 📦 Solution | Snowflake | Query searches for deleted databases. |
| Snowflake - Deleted tables | Hunting Query | 📦 Solution | Snowflake | Query searches for deleted tables. |
| Snowflake - Rarely used account | Hunting Query | 📦 Solution | Snowflake | Query searches for rarely used accounts. |
| Snowflake - Failed logins | Hunting Query | 📦 Solution | Snowflake | Query searches for failed logins. |
| Snowflake - Credit consuming queries | Hunting Query | 📦 Solution | Snowflake | Query searches for queries which consume abnormal amount of credits. |
| Snowflake - Time consuming queries | Hunting Query | 📦 Solution | Snowflake | Query searches for time consuming queries. |
| Snowflake - Unknown query type | Hunting Query | 📦 Solution | Snowflake | Query searches for queries of type UNKNOWN. |
| Snowflake - Rarely used privileged users | Hunting Query | 📦 Solution | Snowflake | Query searches for rarely used privileged users. |
| Snowflake - Users' source IP addresses | Hunting Query | 📦 Solution | Snowflake | Query searches for users' source IP addresses. |
| Snowflake | Workbook | 📦 Solution | Snowflake | |
| Snowflake | Parser | 📦 Solution | Snowflake | |
| AnalyticsEfficiency | Workbook | 📦 Solution | SOC Handbook | |
| AnomaliesVisualization | Workbook | 📦 Solution | SOC Handbook | |
| AnomalyData | Workbook | 📦 Solution | SOC Handbook | |
| AttackSurfaceReduction | Workbook | 📦 Solution | SOC Handbook | |
| AzureSentinelCost | Workbook | 📦 Solution | SOC Handbook | |
| AzureSentinelSecurityAlerts | Workbook | 📦 Solution | SOC Handbook | |
| IncidentOverview | Workbook | 📦 Solution | SOC Handbook | |
| IntsightsIOCWorkbook | Workbook | 📦 Solution | SOC Handbook | |
| InvestigationInsights | Workbook | 📦 Solution | SOC Handbook | |
| MITREAttack | Workbook | 📦 Solution | SOC Handbook | |
| SecurityOperationsEfficiency | Workbook | 📦 Solution | SOC Handbook | |
| SecurityStatus | Workbook | 📦 Solution | SOC Handbook | |
| SentinelCentral | Workbook | 📦 Solution | SOC Handbook | |
| Deleted a Custom Field Mapping profile | Analytic Rule | 📦 Solution | SOC Prime CCF | Deleted a Custom Field Mapping profile from SOC Prime platform |
| Deleted a Tenant | Analytic Rule | 📦 Solution | SOC Prime CCF | Deleted a Tenant from SOC Prime platform |
| Successful logins to SOC Prime platform from bad IP addresses | Analytic Rule | 📦 Solution | SOC Prime CCF | This rule identifies successful logins from IP addresses previously flagged as malicious (e.g., botnets, TOR exit nodes, or known malicious IPs) |
| Building_a_SOCLargeStaff | Workbook | 📦 Solution | SOC-Process-Framework | |
| Building_a_SOCMediumStaff | Workbook | 📦 Solution | SOC-Process-Framework | |
| Building_a_SOCPartTimeStaff | Workbook | 📦 Solution | SOC-Process-Framework | |
| Building_a_SOCSmallStaff | Workbook | 📦 Solution | SOC-Process-Framework | |
| SOCIRPlanning | Workbook | 📦 Solution | SOC-Process-Framework | |
| SOCProcessFramework | Workbook | 📦 Solution | SOC-Process-Framework | |
| UpdateSOCMaturityScore | Workbook | 📦 Solution | SOC-Process-Framework | |
| Get-SOC-Actions | Playbook | 📦 Solution | SOC-Process-Framework | This playbook uses the SOC Recommended Actions Watchlist to automatically enrich incidents generated by Microsoft Sentinel with Actions to review and take. Actions will be evaluated per Customer Organ... |
| SOCcontacts | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCDepartmental | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCEmailDistribution | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCExternalContacts | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCgeneralIT | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCIRP | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCInternalContacts | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCMA | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCPager | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SocRA | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCUseCase | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCworkstations | Watchlist | 📦 Solution | SOC-Process-Framework | |
| SOCRadar Alarm Volume Spike | Analytic Rule | 📦 Solution | SOCRadar | Detects unusual spikes in SOCRadar alarm volume that may indicate an active campaign, coordinated attack, or data breach. Triggers when alarm count in the last hour exceeds the 7-day hourly average by... |
| SOCRadar High or Critical Severity Alarm | Analytic Rule | 📦 Solution | SOCRadar | Detects SOCRadar alarms with High or Critical severity levels that require immediate attention. These alarms typically indicate active threats such as credential exposure, ransomware mentions, or targ... |
| SOCRadar Unsynced Closed Incident | Analytic Rule | 📦 Solution | SOCRadar | Detects Microsoft Sentinel incidents tagged as SOCRadar that were closed more than 30 minutes ago but do not have the Synced tag. This may indicate the SOCRadar-Alarm-Sync playbook has failed to updat... |
| SOCRadar Alarm Overview | Hunting Query | 📦 Solution | SOCRadar | Overview of SOCRadar alarms imported into Microsoft Sentinel, grouped by type and severity. |
| SOCRadar Alarm Trends | Hunting Query | 📦 Solution | SOCRadar | Analyze SOCRadar alarm trends over the past 7 days to identify patterns and spikes. |
| SOCRadar Audit Analysis | Hunting Query | 📦 Solution | SOCRadar | Analyze SOCRadar audit logs to monitor import and sync operations. |
| SOCRadar Critical Alarms | Hunting Query | 📦 Solution | SOCRadar | Hunt for high and critical severity SOCRadar alarms that may require immediate attention. |
| SOCRadar Incident Correlation | Hunting Query | 📦 Solution | SOCRadar | Correlate SOCRadar alarms with Microsoft Sentinel incidents to track import status and identify gaps. |
| SOCRadar-Dashboard | Workbook | 📦 Solution | SOCRadar | |
| SOCRadar-Alarm-Import | Playbook | 📦 Solution | SOCRadar | Imports alarms from SOCRadar with optional audit logging and custom table storage. Supports all statuses or OPEN only. |
| SOCRadar-Alarm-Sync | Playbook | 📦 Solution | SOCRadar | Syncs closed incidents from Microsoft Sentinel back to SOCRadar platform. Uses Synced tag to prevent duplicate syncs. Filters by: SOCRadar tag + Closed status + lastModified. Now with pagination for 1... |
| SonicWall - Allowed SSH, Telnet, and RDP Connections | Analytic Rule | 📦 Solution | SonicWall Firewall | This rule identifies allowed inbound SSH, Telnet, and RDP connections. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall). |
| SonicWall - Capture ATP Malicious File Detection | Analytic Rule | 📦 Solution | SonicWall Firewall | This rule identifies malicious file verdicts from the SonicWall Capture ATP service. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewal... |
| Outbound SSH/SCP Connections | Hunting Query | 📦 Solution | SonicWall Firewall | This query looks for outbound SSH/SCP connections identified by the expected port number (22) or by the SonicWall Deep Packet Inspection services. This query leverages the SonicWall Firewall ASIM Netw... |
| SonicWallFirewall | Workbook | 📦 Solution | SonicWall Firewall | |
| New Sonrai Ticket | Analytic Rule | 📦 Solution | SonraiSecurity | Checks for new Sonrai tickets. It uses the action type to check if a ticket has been created |
| Sonrai Ticket Assigned | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have been assigned. It uses the action type to check if a ticket has been assigned |
| Sonrai Ticket Closed | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have been closed. It uses the action type to check if a ticket has been closed |
| Sonrai Ticket Escalation Executed | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have had a comment added. It uses the action type to check if a ticket has had a comment added |
| Sonrai Ticket Escalation Executed | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have had an escalation executed. It uses the action type to check if a ticket has had an escalation executed |
| Sonrai Ticket Reopened | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have been reopened. It uses the action type to check if a ticket has been reopened |
| Sonrai Ticket Risk Accepted | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have had their risk accepted. It uses the action type to check if a ticket has had it's risk accepted |
| Sonrai Ticket Snoozed | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have been snoozed. It uses the action type to check if a ticket has been snoozed |
| Sonrai Ticket Updated | Analytic Rule | 📦 Solution | SonraiSecurity | Checks if Sonrai tickets have been updated. It uses the action type to check if a ticket has been updated |
| Sonrai | Workbook | 📦 Solution | SonraiSecurity | |
| SophosEPEvent | Parser | 📦 Solution | Sophos Endpoint Protection | |
| Excessive Amount of Denied Connections from a Single Source | Analytic Rule | 📦 Solution | Sophos XG Firewall | This creates an incident in the event that a single source IP address generates a excessive amount of denied connections. |
| Port Scan Detected | Analytic Rule | 📦 Solution | Sophos XG Firewall | This alert creates an incident when a source IP addresses attempt to communicate with a large amount of distinct ports within a short period. |
| SophosXGFirewall | Workbook | 📦 Solution | Sophos XG Firewall | |
| SophosXGFirewall | Parser | 📦 Solution | Sophos XG Firewall | |
| SOXITCompliance | Workbook | 📦 Solution | SOX IT Compliance | |
| SpyCloud Enterprise Breach Detection | Analytic Rule | 📦 Solution | SpyCloud Enterprise Protection | This alert creates an incident when an malware record is detected in the SpyCloud watchlist data |
| SpyCloud Enterprise Malware Detection | Analytic Rule | 📦 Solution | SpyCloud Enterprise Protection | This alert creates an incident when an malware record is detected in the SpyCloud watchlist data |
| SpyCloud Breach Information - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | This Playbook will be triggered when an spycloud breach incident is created. |
| Domain Breach Data - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | The SpyCloud Enterprise API is able to provide breach data for a domain or set of domains associated with an incident. |
| Email Address Breach Data - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | The SpyCloud Enterprise API is able to provide breach data for a Email address or set of Email addresses associated with an incident. |
| IP Address Breach Data - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | The SpyCloud Enterprise API is able to provide breach data for a IP address or set of IP addresses associated with an incident. |
| Password Breach Data - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | The SpyCloud Enterprise API is able to provide breach data for a provided password. |
| Username Breach Data - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | The SpyCloud Enterprise API is able to provide breach data for a username or set of usernames associated with an incident. |
| SpyCloud Malware Information - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | This Playbook will be triggered when an spycloud malware incident is created. |
| SpyCloud Watachlist data - SpyCloud Enterprise | Playbook | 📦 Solution | SpyCloud Enterprise Protection | This Playbook will run daily, gets the watchlist data from SpyCloud API and saved it into the custom logs. |
| Removable storage ONLINE event from secRMM | Analytic Rule | 📦 Solution | Squadra Technologies SecRmm | Detect when a removable storage device is plugged in by the end-user. |
| AzureSentinelWorkbookForRemovableStorageSecurityEvents | Workbook | 📦 Solution | Squadra Technologies SecRmm | |
| SquidProxy | Parser | 📦 Solution | SquidProxy | |
| Anomaly Sign In Event from an IP | Analytic Rule | 📄 Standalone | Standalone Content | Identifies sign-in anomalies from an IP in the last hour, targeting multiple users where the password is correct after multiple attempts |
| Brute force attack against user credentials (Uses Authentication Normalization) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. Note that the query does not... |
| Potential Password Spray Attack (Uses Authentication Normalization) | Analytic Rule | 📄 Standalone | Standalone Content | This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack To use th... |
| User login from different countries within 3 hours (Uses Authentication Normalization) | Analytic Rule | 📄 Standalone | Standalone Content | This query searches for successful user logins from different countries within 3 hours. To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAut... |
| Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account. To use this analytics rule, make sure you have deployed the [ASIM normalizati... |
| Excessive NXDOMAIN DNS Queries (ASIM DNS Schema) | Analytic Rule | 📄 Standalone | Standalone Content | This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in ... |
| Potential DGA detected (ASIM DNS Schema) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies clients with a high NXDomain count which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). Alert is generated when a new IP address is seen (ba... |
| DNS events related to mining pools (ASIM DNS Schema) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom so... |
| DNS events related to ToR proxies (ASIM DNS Schema) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies IP addresses performing DNS lookups associated with common ToR proxies. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the... |
| SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in File Events To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimFileEven... |
| Dev-0228 File Path Hashes November 2021 (ASIM Version) | Analytic Rule | 📄 Standalone | Standalone Content | This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity. The... |
| Probable AdFind Recon Tool Usage (Normalized Process Events) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies the host and account that executed AdFind by hash and filename in addition to common and unique flags that are used by many threat actors in discovery. To use this analytics rule, make sure... |
| Base64 encoded Windows process command-lines (Normalized Process Events) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies instances of a base64 encoded PE file header seen in the process command line parameter. To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka... |
| Malware in the recycle bin (Normalized Process Events) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies malware that has been hidden in the recycle bin. To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent) |
| Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) | Analytic Rule | 📄 Standalone | Standalone Content | This query idenifies when rundll32.exe executes a specific set of inline VBScript commands References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-ma... |
| SUNBURST suspicious SolarWinds child processes (Normalized Process Events) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor References: - https://www.fireeye.com/blog/threat-research/2020/12/evasiv... |
| New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) | Analytic Rule | 📄 Standalone | Standalone Content | This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice i... |
| Potential re-named sdelete usage (ASIM Version) | Analytic Rule | 📄 Standalone | Standalone Content | This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C driv... |
| Sdelete deployed via GPO and run recursively (ASIM Version) | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for the Sdelete process being run recursively after being deployed to a host via GPO. Attackers could use this technique to deploy Sdelete to multiple host and delete data on them. ... |
| Discord CDN Risky File Download (ASIM Web Session Schema) | Analytic Rule | 📄 Standalone | Standalone Content | Identifies callouts to Discord CDN addresses for risky file extensions. This detection will trigger when a callout for a risky file is made to a discord server that has only been seen once in your env... |
| Excessive number of HTTP authentication failures from a source (ASIM Web Session schema) | Analytic Rule | 📄 Standalone | Standalone Content | This rule identifies a source that repeatedly fails to authenticate to a web service (HTTP response code 403). This may indicate a [brute force](https://en.wikipedia.org/wiki/Brute-force_attack) or [c... |
| Potential communication with a Domain Generation Algorithm (DGA) based hostname (ASIM Web Session schema) | Analytic Rule | 📄 Standalone | Standalone Content | This rule identifies communication with hosts that have a domain name that might have been generated by a Domain Generation Algorithm (DGA). DGAs are used by malware to generate rendezvous points that... |
| A client made a web request to a potentially harmful file (ASIM Web Session schema) | Analytic Rule | 📄 Standalone | Standalone Content | This rule identifies a web request to a URL that holds a file type, including .ps1, .bat, .vbs, and .scr that can be harmful if downloaded. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and... |
| A host is potentially running a crypto miner (ASIM Web Session schema) | Analytic Rule | 📄 Standalone | Standalone Content | This rule identifies a web request with a user agent header known to belong to a crypto miner. This indicates a crypto miner may have infected the client machine.<br>You can add custom crypto mining i... |
| A host is potentially running a hacking tool (ASIM Web Session schema) | Analytic Rule | 📄 Standalone | Standalone Content | This rule identifies a web request with a user agent header known to belong to a hacking tool. This indicates a hacking tool is used on the host.<br>You can add custom hacking tool indicating User-Age... |
| A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) | Analytic Rule | 📄 Standalone | Standalone Content | This rule identifies a web request with a user agent header known to belong PowerShell. <br>You can add custom Powershell indicating User-Agent headers using a watchlist, for more information refer to... |
| Addition of a Temporary Access Pass to a Privileged Account | Analytic Rule | 📄 Standalone | Standalone Content | Detects when a Temporary Access Pass (TAP) is created for a Privileged Account. A Temporary Access Pass is a time-limited passcode issued by an admin that satisfies strong authentication requirement... |
| Application ID URI Changed | Analytic Rule | 📄 Standalone | Standalone Content | Detects changes to an Application ID URI. Monitor these changes to make sure that they were authorized. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-appl... |
| Application Redirect URL Update | Analytic Rule | 📄 Standalone | Standalone Content | Detects the redirect URL of an app being changed. Applications associated with URLs not controlled by the organization can pose a security risk. Ref: https://docs.microsoft.com/azure/active-direct... |
| Changes to Application Logout URL | Analytic Rule | 📄 Standalone | Standalone Content | Detects changes to an applications sign out URL. Look for any modifications to a sign out URL. Blank entries or entries to non-existent locations would stop a user from terminating a session. Ref:... |
| Changes to Application Ownership | Analytic Rule | 📄 Standalone | Standalone Content | Detects changes to the ownership of an appplicaiton. Monitor these changes to make sure that they were authorized. Ref: https://learn.microsoft.com/en-gb/entra/architecture/security-operations-app... |
| Changes to PIM Settings | Analytic Rule | 📄 Standalone | Standalone Content | PIM provides a key mechanism for assigning privileges to accounts, this query detects changes to PIM role settings. Monitor these changes to ensure they are being made legitimately and don't confer ... |
| Conditional Access Policy Modified by New User | Analytic Rule | 📄 Standalone | Standalone Content | Detects a Conditional Access Policy being modified by a user who has not modified a policy in the last 14 days. A threat actor may try to modify policies to weaken the security controls in place. ... |
| End-user consent stopped due to risk-based consent | Analytic Rule | 📄 Standalone | Standalone Content | Detects a user's consent to an OAuth application being blocked due to it being too risky. These events should be investigated to understand why the user attempted to consent to the applicaiton and w... |
| Guest Users Invited to Tenant by New Inviters | Analytic Rule | 📄 Standalone | Standalone Content | Detects when a Guest User is added by a user account that has not been seen adding a guest in the previous 14 days. Monitoring guest accounts and the access they are provided is important to detect ... |
| Service Principal Assigned App Role With Sensitive Access | Analytic Rule | 📄 Standalone | Standalone Content | Detects a Service Principal being assigned an app role that has sensitive access such as Mail.Read. A threat actor who compromises a Service Principal may assign it an app role to allow it to access... |
| Service Principal Assigned Privileged Role | Analytic Rule | 📄 Standalone | Standalone Content | Detects a privileged role being added to a Service Principal. Ensure that any assignment to a Service Principal is valid and appropriate - Service Principals should not be assigned to very highly pr... |
| Suspicious linking of existing user to external User | Analytic Rule | 📄 Standalone | Standalone Content | This query will detect when an attempt is made to update an existing user and link it to an guest or external identity. These activities are unusual and such linking of external identities should be... |
| URL Added to Application from Unknown Domain | Analytic Rule | 📄 Standalone | Standalone Content | Detects a URL being added to an application where the domain is not one that is associated with the tenant. The query uses domains seen in sign in logs to determine if the domain is associated with ... |
| User Account Created Using Incorrect Naming Format | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for accounts being created where the name does not match a defined pattern. Attackers may attempt to add accounts as a means of establishing persistant access to an environment, loo... |
| User account created without expected attributes defined | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for accounts being created that do not have attributes populated that are commonly populated in the tenant. Attackers may attempt to add accounts as a means of establishing persista... |
| User State changed from Guest to Member | Analytic Rule | 📄 Standalone | Standalone Content | Detects when a guest account in a tenant is converted to a member of the tenant. Monitoring guest accounts and the access they are provided is important to detect potential account abuse. Accounts... |
| Azure Diagnostic settings removed from a resource | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for diagnostic settings that are removed from a resource. This could indicate an attacker or malicious internal trying to evade detection before malicious act is performed. If the dia... |
| Azure VM Run Command operations executing a unique PowerShell script | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when Azure Run command is used to execute a PowerShell script on a VM that is unique. The uniqueness of the PowerShell script is determined by taking a combined hash of the cmdLets it impor... |
| AppServices AV Scan Failure | Analytic Rule | 📄 Standalone | Standalone Content | Identifies if an AV scan fails in Azure App Services. |
| AppServices AV Scan with Infected Files | Analytic Rule | 📄 Standalone | Standalone Content | Identifies if an AV scan finds infected files in Azure App Services. |
| Application Gateway WAF - SQLi Detection | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement. References: https://owasp.or... |
| Application Gateway WAF - XSS Detection | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a match for XSS attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement. References: https://owasp.org/www-proj... |
| Suspicious Sign In by Entra ID Connect Sync Account | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for sign ins by the Microsoft Entra ID Connect Sync account to Azure where properties about the logon are anomalous. This query uses Microsoft Sentinel's UEBA features to detect these... |
| CreepyDrive request URL sequence | Analytic Rule | 📄 Standalone | Standalone Content | CreepyDrive uses OneDrive for command and control, however, it makes regular requests to predicatable paths. This detecton will alert when over 20 sequences are observed in a single day. |
| CreepyDrive URLs | Analytic Rule | 📄 Standalone | Standalone Content | CreepyDrive uses OneDrive for command and control. This detection identifies URLs specific to CreepyDrive. |
| RunningRAT request parameters | Analytic Rule | 📄 Standalone | Standalone Content | This detection will alert when RunningRAT URI parameters or paths are detect in an HTTP request. Id the device blocked this communication presence of this alert means the RunningRAT implant is likely ... |
| Fortinet - Beacon pattern detected | Analytic Rule | 📄 Standalone | Standalone Content | Identifies patterns in the time deltas of contacts between internal and external IPs in Fortinet network data that are consistent with beaconing. Accounts for randomness (jitter) and seasonality such... |
| Possible contact with a domain generated by a DGA | Analytic Rule | 📄 Standalone | Standalone Content | Identifies contacts with domains names in CommonSecurityLog that might have been generated by a Domain Generation Algorithm (DGA). DGAs can be used by malware to generate rendezvous points that are di... |
| Time series anomaly detection for total volume of traffic | Analytic Rule | 📄 Standalone | Standalone Content | Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical patterns. The query leverages a KQL built-in anomaly detection algorithm to find large deviations from ... |
| Wazuh - Large Number of Web errors from an IP | Analytic Rule | 📄 Standalone | Standalone Content | Identifies instances where Wazuh logged over 400 '403' Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://documentation.wazuh.com/current/cloud-security/azure/ind... |
| PE file dropped in Color Profile Folder | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color\. This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the fo... |
| SUNBURST suspicious SolarWinds child processes | Analytic Rule | 📄 Standalone | Standalone Content | Identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor References: - https://www.fireeye.com/blog/threat-research/2020/12/evasiv... |
| Trust Monitor Event | Analytic Rule | 📄 Standalone | Standalone Content | This query identifies when a new trust monitor event is detected. |
| Missing Domain Controller Heartbeat | Analytic Rule | 📄 Standalone | Standalone Content | This detection will go over the heartbeats received from the agents of Domain Controllers over the last hour, and will create alerts if the last heartbeats were received an hour ago. |
| OMI Vulnerability Exploitation | Analytic Rule | 📄 Standalone | Standalone Content | Following the September 14th, 2021 release of three Elevation of Privilege (EoP) vulnerabilities (CVE-2021-38645, CVE-2021-38649, CVE-2021-38648) and one unauthenticated Remote Code Execution (RCE) vu... |
| Exchange Server Suspicious File Downloads. | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for messages related to file downloads of suspicious file types on an Exchange Server. This could indicate attempted deployment of webshells. This query uses the Exchange HttpProxy A... |
| Silk Typhoon Suspicious File Downloads. | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for messages related to file downloads of suspicious file types. This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the ta... |
| Users searching for VIP user activity | Analytic Rule | 📄 Standalone | Standalone Content | This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template. Use this detection to alert for users specif... |
| Failed AzureAD logons but success logon to AWS Console | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a list of IP addresses with a minimum number (defualt of 5) of failed logon attempts to Microsoft Entra ID. Uses that list to identify any successful AWS Console logons from these IPs withi... |
| Failed AzureAD logons but success logon to host | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to Microsoft Entra ID. Uses that list to identify any successful remote logons to hosts from these IPs w... |
| IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN | Analytic Rule | 📄 Standalone | Standalone Content | This query creates a list of IP addresses with the number of failed login attempts to Entra ID above a set threshold ( default of 5 ). It then looks for any successful Palo Alto VPN logins from any ... |
| Account created from non-approved sources | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for an account being created from a domain that is not regularly seen in a tenant. Attackers may attempt to add accounts from these sources as a means of establishing persistant acc... |
| ADFS DKM Master Key Export | Analytic Rule | 📄 Standalone | Standalone Content | Identifies an export of the ADFS DKM Master Key from Active Directory. References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/, https://cloud.goo... |
| Anomalous login followed by Teams action | Analytic Rule | 📄 Standalone | Standalone Content | Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed. Query calculates IP usage Delta for each user account and selects accounts where a... |
| Audit policy manipulation using auditpol utility | Analytic Rule | 📄 Standalone | Standalone Content | This detects attempts to manipulate audit policies using auditpol command. This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in di... |
| Failed AWS Console logons but success logon to AzureAD | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to AWS Console. Uses that list to identify any successful Microsoft Entra ID logons from these IPs withi... |
| IP address of Windows host encoded in web request | Analytic Rule | 📄 Standalone | Standalone Content | This detection will identify network requests in HTTP proxy data that contains Base64 encoded IP addresses. After identifying candidates the query joins with DeviceNetworkEvents to idnetify any machin... |
| Windows host username encoded in base64 web request | Analytic Rule | 📄 Standalone | Standalone Content | This detection will identify network requests in HTTP proxy data that contains Base64 encoded usernames from machines in the DeviceEvents table. This technique was seen usee by POLONIUM in their Runni... |
| COM Registry Key Modified to Point to File in Color Profile Folder | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color\. This can be used to enable COM hijacking for persistence. Ref: https://www.microsof... |
| Dev-0228 File Path Hashes November 2021 | Analytic Rule | 📄 Standalone | Standalone Content | This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity. The... |
| Dev-0530 File Extension Rename | Analytic Rule | 📄 Standalone | Standalone Content | Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ranso... |
| High risk Office operation conducted by IP Address that recently attempted to log into a disabled account | Analytic Rule | 📄 Standalone | Standalone Content | It is possible that a disabled user account is compromised and another account on the same IP is used to perform operations that are not typical for that user. The query filters the SigninLogs for en... |
| Email access via active sync | Analytic Rule | 📄 Standalone | Standalone Content | This query detects attempts to add attacker devices as allowed IDs for active sync using the Set-CASMailbox command. This technique was seen in relation to Solorigate attack but the results can indica... |
| Europium - Hash and IP IOCs - September 2022 | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a match across various data feeds for hashes and IP IOC related to Europium Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-th... |
| Unusual identity creation using exchange powershell | Analytic Rule | 📄 Standalone | Standalone Content | The query below identifies creation of unusual identity by the Europium actor to mimic Microsoft Exchange Health Manager Service account using Exchange PowerShell commands Reference: https://www.mi... |
| Exchange Worker Process Making Remote Call | Analytic Rule | 📄 Standalone | Standalone Content | This query dynamically identifies Exchange servers and then looks for instances where the IIS worker process initiates a call out to a remote URL using either cmd.exe or powershell.exe. This behaviour... |
| Known Forest Blizzard group domains - July 2019 | Analytic Rule | 📄 Standalone | Standalone Content | Matches domain name IOCs related to Forest Blizzard group activity published July 2019 with CommonSecurityLog, DnsEvents and VMConnection dataTypes. References: https://blogs.microsoft.com/on-the-issu... |
| Gain Code Execution on ADFS Server via Remote WMI Execution | Analytic Rule | 📄 Standalone | Standalone Content | This query detects instances where an attacker has gained the ability to execute code on an ADFS Server through remote WMI Execution. In order to use this query you need to be collecting Sysmon EventI... |
| Failed host logons but success logon to AzureAD | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a list of IP addresses with a minimum number(default of 5) of failed logon attempts to remote hosts. Uses that list to identify any successful logons to Microsoft Entra ID from these IPs wi... |
| Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt | Analytic Rule | 📄 Standalone | Standalone Content | This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group. Ensure this impossib... |
| Malformed user agent | Analytic Rule | 📄 Standalone | Standalone Content | Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware. |
| Mercury - Domain, Hash and IP IOCs - August 2022 | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilitie... |
| Multiple Password Reset by user | Analytic Rule | 📄 Standalone | Standalone Content | This query will determine multiple password resets by user across multiple data sources. Account manipulation including password reset may aid adversaries in maintaining access to credentials and cert... |
| Phishing link click observed in Network Traffic | Analytic Rule | 📄 Standalone | Standalone Content | The purpose of this content is to identify successful phishing links accessed by users. Once a user clicks on a phishing link, we observe successful network activity originating from non-Microsoft net... |
| Potential Fodhelper UAC Bypass (ASIM Version) | Analytic Rule | 📄 Standalone | Standalone Content | This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process w... |
| Identify Mango Sandstorm powershell commands | Analytic Rule | 📄 Standalone | Standalone Content | The query below identifies powershell commands used by the threat actor Mango Sandstorm. Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-un... |
| Prestige ransomware IOCs Oct 2022 | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for file hashes and AV signatures associated with Prestige ransomware payload. |
| Risky user signin observed in non-Microsoft network device | Analytic Rule | 📄 Standalone | Standalone Content | This content is utilized to identify instances of successful login by risky users, who have been observed engaging in potentially suspicious network activity on non-Microsoft network devices. |
| Azure VM Run Command operation executed during suspicious login window | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when the Azure Run Command operation is executed by a UserPrincipalName and IP Address that has resulted in a recent user entity behaviour alert. |
| Security Service Registry ACL Modification | Analytic Rule | 📄 Standalone | Standalone Content | Identifies attempts to modify registry ACL to evade security solutions. In the Solorigate attack, the attackers were found modifying registry permissions so services.exe cannot access the relevant reg... |
| Cisco - firewall block but success logon to Microsoft Entra ID | Analytic Rule | 📄 Standalone | Standalone Content | Correlate IPs blocked by a Cisco firewall appliance with successful Microsoft Entra ID signins. Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentia... |
| Star Blizzard C2 Domains August 2022 | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a match across various data feeds for domains related to an actor tracked by Microsoft as Star Blizzard. |
| M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity | Analytic Rule | 📄 Standalone | Standalone Content | This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network dev... |
| Suspicious Login from deleted guest account | Analytic Rule | 📄 Standalone | Standalone Content | This query will detect logins from guest account which was recently deleted. For any successful logins from deleted identities should be investigated further if any existing user accounts have been ... |
| Suspicious modification of Global Administrator user properties | Analytic Rule | 📄 Standalone | Standalone Content | This query will detect if user properties of Global Administrator are updated by an existing user. Usually only user administrator or other global administrator can update such properties. Investigate... |
| Time series anomaly for data size transferred to public internet | Analytic Rule | 📄 Standalone | Standalone Content | Identifies anomalous data transfer to public networks. The query leverages built-in KQL anomaly detection algorithms that detects large deviations from a baseline pattern. A sudden increase in data tr... |
| NRT Malicious Inbox Rule | Analytic Rule | 📄 Standalone | Standalone Content | Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords. This is done so as to limit ability to warn compromised users that they've be... |
| NRT Multiple users email forwarded to same destination | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when multiple (more than one) users mailboxes are configured to forward to the same destination. This could be an attacker-controlled destination mailbox configured to collect mail from mul... |
| PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack | Analytic Rule | 📄 Standalone | Standalone Content | This query identifies exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893) to the VPN server |
| Detect PIM Alert Disabling activity | Analytic Rule | 📄 Standalone | Standalone Content | Privileged Identity Management (PIM) generates alerts when there is suspicious or unsafe activity in Microsoft Entra ID (Azure AD) organization. This query will help detect attackers attempts to disa... |
| AV detections related to Dev-0530 actors | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for Microsoft Defender AV detections related to Dev-0530 actors. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins... |
| AV detections related to Europium actors | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for Microsoft Defender AV detections related to Europium actor. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins... |
| AV detections related to Hive Ransomware | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for Microsoft Defender AV detections related to Hive Ransomware. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins ... |
| Mass Download & copy to USB device by single user | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for any mass download by a single user with possible file copy activity to a new USB drive. Malicious insiders may perform such activities that may cause harm to the organization. Th... |
| Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for Microsoft Defender for Endpoint detections related to the remote command execution attempts on Azure IR with Managed VNet or SHIR. In Microsoft Sentinel, the SecurityAlerts table... |
| Solorigate Defender Detections | Analytic Rule | 📄 Standalone | Standalone Content | Surfaces any Defender Alert for Solorigate Events. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly... |
| Workspace deletion activity from an infected device | Analytic Rule | 📄 Standalone | Standalone Content | This query will alert on any sign-ins from devices infected with malware in correlation with workspace deletion activity. Attackers may attempt to delete workspaces containing compute instances after... |
| Microsoft Entra ID Health Monitoring Agent Registry Keys Access | Analytic Rule | 📄 Standalone | Standalone Content | This detection uses Windows security events to detect suspicious access attempts to the registry key of Microsoft Entra ID Health monitoring agent. This detection requires an access control entry (ACE... |
| Microsoft Entra ID Health Service Agents Registry Keys Access | Analytic Rule | 📄 Standalone | Standalone Content | This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Microsoft Entra ID Health service agents (e.g AD FS). Information from AD He... |
| Modification of Accessibility Features | Analytic Rule | 📄 Standalone | Standalone Content | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a ... |
| AD FS Abnormal EKU object identifier attribute | Analytic Rule | 📄 Standalone | Standalone Content | This detection uses Security events from the "AD FS Auditing" provider to detect suspicious object identifiers (OIDs) as part EventID 501 and specifically part of the Enhanced Key Usage attributes. Th... |
| AdminSDHolder Modifications | Analytic Rule | 📄 Standalone | Standalone Content | This query detects modification in the AdminSDHolder in the Active Directory which could indicate an attempt for persistence. AdminSDHolder Modification is a persistence technique in which an attack... |
| COM Event System Loading New DLL | Analytic Rule | 📄 Standalone | Standalone Content | This query uses Sysmon Image Load (Event ID 7) and Process Create (Event ID 1) data to look for COM Event System being used to load a newly seen DLL. |
| DSRM Account Abuse | Analytic Rule | 📄 Standalone | Standalone Content | This query detects an abuse of the DSRM account in order to maintain persistence and access to the organization's Active Directory. Ref: https://adsecurity.org/?p=1785 |
| Fake computer account created | Analytic Rule | 📄 Standalone | Standalone Content | This query detects domain user accounts creation (event ID 4720) where the username ends with $. Accounts that end with $ are normally domain computer accounts and when they are created the event ID ... |
| Group created then added to built in domain local or global group | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when a recently created Group was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is a... |
| Failed logon attempts by valid accounts within 10 mins | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when failed logon attempts are 20 or higher during a 10 minute period (2 failed logons per minute minimum) from valid account. |
| Midnight Blizzard - suspicious rundll32.exe execution of vbscript | Analytic Rule | 📄 Standalone | Standalone Content | This query idenifies when rundll32.exe executes a specific set of inline VBScript commands References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-m... |
| Midnight Blizzard - Script payload stored in Registry | Analytic Rule | 📄 Standalone | Standalone Content | This query identifies when a process execution command-line indicates that a registry value is written to allow for later execution a malicious script References: https://www.microsoft.com/security/b... |
| AD account with Don't Expire Password | Analytic Rule | 📄 Standalone | Standalone Content | Identifies whenever a user account has the setting "Password Never Expires" in the user account properties selected. This is indicated in Security event 4738 in the EventData item labeled UserAccountC... |
| Possible Resource-Based Constrained Delegation Abuse | Analytic Rule | 📄 Standalone | Standalone Content | This query identifies Active Directory computer objects modifications that allow an adversary to abuse the Resource-based constrained delegation. This query checks for event id 5136 that the Object C... |
| Potential Build Process Compromise | Analytic Rule | 📄 Standalone | Standalone Content | The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process. More details: h... |
| Potential Kerberoasting | Analytic Rule | 📄 Standalone | Standalone Content | A service principal name (SPN) is used to uniquely identify a service instance in a Windows environment. Each SPN is usually associated with a service account. Organizations may have used service acco... |
| Multiple RDP connections from Single System | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when an RDP connection is made to multiple systems and above the normal connection count for the previous 7 days. Connections from the same system with the same account within the same day.... |
| RDP Nesting | Analytic Rule | 📄 Standalone | Standalone Content | Query detects potential lateral movement within a network by identifying when an RDP connection (EventID 4624, LogonType 10) is made to an initial system, followed by a subsequent RDP connection from ... |
| Rare RDP Connections | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when an RDP connection is new or rare related to any logon type by a given account today compared with the previous 14 days. RDP connections are indicated by the EventID 4624 with LogonType... |
| Silk Typhoon New UM Service Child Process | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for new processes being spawned by the Exchange UM service where that process has not previously been observed before. Reference: https://www.microsoft.com/security/blog/2021/03/02/h... |
| Silk Typhoon Suspicious UM Service Error | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for errors that may indicate that an attacker is attempting to exploit a vulnerability in the service. Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting... |
| Solorigate Named Pipe | Analytic Rule | 📄 Standalone | Standalone Content | Identifies a match across various data feeds for named pipe IOCs related to the Solorigate incident. For the sysmon events required for this detection, logging for Named Pipe Events needs to be confi... |
| Account added and removed from privileged groups | Analytic Rule | 📄 Standalone | Standalone Content | Identifies accounts that are added to a privileged group and then quickly removed, which could be a sign of compromise. |
| User account added to built in domain local or global group | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when a user account has been added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expe... |
| User account created and deleted within 10 mins | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when a user account is created and then deleted within 10 minutes. This can be an indication of compromise and an adversary attempting to hide in the noise. |
| User account enabled and disabled within 10 mins | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when a user account is enabled and then disabled within 10 minutes. This can be an indication of compromise and an adversary attempting to hide in the noise. |
| New user created and added to the built-in administrators group | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when a user account was created and then added to the builtin Administrators group in the same day. This should be monitored closely and all additions reviewed. |
| Service Principal Name (SPN) Assigned to User Account | Analytic Rule | 📄 Standalone | Standalone Content | This query identifies whether an Active Directory user object was assigned a service principal name which could indicate that an adversary is preparing for performing Kerberoasting. This query checks... |
| Vulnerable Machines related to OMIGOD CVE-2021-38647 | Analytic Rule | 📄 Standalone | Standalone Content | This query uses the Azure Defender Security Nested Recommendations data to find machines vulnerable to OMIGOD CVE-2021-38647. OMI is the Linux equivalent of Windows WMI and helps users manage configur... |
| Anomalous Single Factor Signin | Analytic Rule | 📄 Standalone | Standalone Content | Detects successful signins using single factor authentication where the device, location, and ASN are abnormal. Single factor authentications pose an opportunity to access compromised accounts, inves... |
| Authentication Attempt from New Country | Analytic Rule | 📄 Standalone | Standalone Content | Detects when there is a login attempt from a country that has not seen a successful login in the previous 14 days. Threat actors may attempt to authenticate with credentials from compromised accounts ... |
| Authentications of Privileged Accounts Outside of Expected Controls | Analytic Rule | 📄 Standalone | Standalone Content | Detects when a privileged user account successfully authenticates from a location, device or ASN that another admin has not logged in from in the last 7 days. Privileged accounts are a key target fo... |
| New country signIn with correct password | Analytic Rule | 📄 Standalone | Standalone Content | Identifies an interrupted sign-in session from a country the user has not sign-in before in the last 7 days, where the password was correct. Although the session is interrupted by other controls such ... |
| Privileged User Logon from new ASN | Analytic Rule | 📄 Standalone | Standalone Content | Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days. Monitor these logons to ensure they are legitimate and identify if there are any similar sign i... |
| Service Principal Authentication Attempt from New Country | Analytic Rule | 📄 Standalone | Standalone Content | Detects when there is a Service Principal login attempt from a country that has not seen a successful login in the previous 14 days. Threat actors may attempt to authenticate with credentials from c... |
| Anomalous User Agent connection attempt | Analytic Rule | 📄 Standalone | Standalone Content | Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts. |
| High count of failed attempts from same client IP | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when 20 or more failed attempts from a given client IP in 1 minute occur on the IIS server. This could be indicative of an attempted brute force. This could also simply indicate a misconfig... |
| High count of failed logons by a user | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when 100 or more failed attempts by a given user in 10 minutes occur on the IIS Server. This could be indicative of attempted brute force based on known account information. This could also... |
| High count of connections by client IP on many ports | Analytic Rule | 📄 Standalone | Standalone Content | Identifies when 30 or more ports are used for a given client IP in 10 minutes occurring on the IIS server. This could be indicative of attempted port scanning or exploit attempt at internet facing web... |
| Exchange SSRF Autodiscover ProxyShell - Detection | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for suspicious request patterns to Exchange servers that fit patterns recently blogged about by PeterJson. This exploitation chain utilises an SSRF vulnerability in Exchange which eve... |
| Silk Typhoon Suspicious Exchange Request | Analytic Rule | 📄 Standalone | Standalone Content | This query looks for suspicious request patterns to Exchange servers that fit a pattern observed by Silk Typhoon actors. The same query can be run on HTTPProxy logs from on-premise hosted Exchange ser... |
| Zoom E2E Encryption Disabled | Analytic Rule | 📄 Standalone | Standalone Content | This alerts when end to end encryption is disabled for Zoom meetings. |
| External User Access Enabled | Analytic Rule | 📄 Standalone | Standalone Content | This alerts when the account setting is changed to allow either external domain access or anonymous access to meetings. |
| User joining Zoom meeting from suspicious timezone | Analytic Rule | 📄 Standalone | Standalone Content | The alert shows users that join a Zoom meeting from a time zone other than the one the meeting was created in. You can also whitelist known good time zones in the tz_whitelist value using the tz datab... |
| Suspicious link sharing pattern | Analytic Rule | 📄 Standalone | Standalone Content | Alerts in links that have been shared across multiple Zoom chat channels by the same user in a short space if time. Adjust the threshold figure to change the number of channels a message needs to be p... |
| Discord download invoked from cmd line (ASIM Version) | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware del... |
| Crash dump disabled on host (ASIM Version) | Hunting Query | 📄 Standalone | Standalone Content | This detection looks the prevention of crash dumps being created. This can be used to limit reporting by malware, look for suspicious processes setting this registry key. |
| Consent to Application discovery | Hunting Query | 📄 Standalone | Standalone Content | This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on Corrleat... |
| Rare Audit activity initiated by App | Hunting Query | 📄 Standalone | Standalone Content | Compares the current day to last 14 days of audits to identify new audit activities. Useful for tracking malicious activity related to user/group additions/removals by Azure Apps and automated approva... |
| Rare Audit activity initiated by User | Hunting Query | 📄 Standalone | Standalone Content | Compares current day to last 14 days of audits to identify new audit activities. Useful for tracking malicious activity related to user/group additions/removals by specific users. |
| User Granted Access and associated audit activity | Hunting Query | 📄 Standalone | Standalone Content | Identifies when a new user is granted access and any subsequent audit related activity. This can help you identify rogue or malicious user behavior. |
| Azure CloudShell Usage | Hunting Query | 📄 Standalone | Standalone Content | This query look for users starting an Azure CloudShell session and summarizes the Azure Activity from that user account during that timeframe (by default 1 hour). This can be used to help identify abu... |
| Check critical ports opened to the entire internet | Hunting Query | 📄 Standalone | Standalone Content | Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered. |
| List all the VScode Extensions which are installed on a user system | Hunting Query | 📄 Standalone | Standalone Content | Detects observed Visual Studio Code (VS Code) extension installation activity on a user's system within the query time range. Note: This query does not return a complete per-user inventory of install... |
| GitHub OAuth App Restrictions Disabled | Hunting Query | 📄 Standalone | Standalone Content | This hunting query identifies a fork activity against a repository done by a user who is not the owner of the repo nor a contributes. |
| GitHub Repo Clone - Time Series Anomly | Hunting Query | 📄 Standalone | Standalone Content | Attacker can exfiltrate data from your GitHub repository by cloning it. This hunting query tracks clone activities for each repository, allowing quick identification of anomalies/excessive clones to i... |
| Cross workspace query anomolies | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for increases in the number of workspaces queried by a user. |
| Multiple large queries made by user | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for users who are running multiple queries that return either a very large amount of data or the maximum amount allowed by the query method. |
| New client running queries | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for clients running queries that have not previously been seen running queries. |
| New ServicePrincipal running queries | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for new Service Principals running queries that have not previously been seen running queries. |
| New users running queries | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for users who have run queries that have not previously been seen running queries. |
| Query data volume anomolies | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for anomalously large LA queries by users. |
| Query looking for secrets | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for queries that appear to be looking for secrets or passwords in tables. |
| User returning more data than daily average | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for users whose total returned data that is significantly above their average. |
| User running multiple queries that fail | Hunting Query | 📄 Standalone | Standalone Content | This hunting query looks for users who have multiple failed queries in a short space of time. |
| Anomalous Resource Creation and related Network Activity | Hunting Query | 📄 Standalone | Standalone Content | Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation. |
| Failed service logon attempt by user account with available AuditData | Hunting Query | 📄 Standalone | Standalone Content | User account failed to logon in current period. Excludes Windows Sign in attempts and limits to only more than 10 failed logons or 3 different IPs used. Results may indicate a potential malicious use ... |
| Failed Login Attempt by Expired account | Hunting Query | 📄 Standalone | Standalone Content | This query looks at Account Logon events found through Windows Event Id's as well as SigninLogs to discover login attempts by accounts that have expired. |
| Permutations on logon attempts by UserPrincipalNames indicating potential brute force | Hunting Query | 📄 Standalone | Standalone Content | This identifies failed logon attempts using permutations based on known first and last names within 10m time windows. Iteration through separators or order changes in the logon name may indicate poten... |
| RareDNSLookupWithDataTransfer | Hunting Query | 📄 Standalone | Standalone Content | This query helps identify rare DNS connections and resulting data transfer to/from the associated domain. It can help identify unexpected large data transfers to or from internal systems which may ind... |
| Rare domains seen in Cloud Logs | Hunting Query | 📄 Standalone | Standalone Content | This script identifies rare domain accounts accessing cloud resources by examining logs. You can lower the domainLimit value to see domains with fewer access attempts. For example, set domainLimit = 2... |
| Tracking Password Changes | Hunting Query | 📄 Standalone | Standalone Content | This script identifies password changes or resets across multiple host and cloud sources. Account manipulation, including password changes and resets, may help adversaries maintain access to credentia... |
| Tracking Privileged Account Rare Activity | Hunting Query | 📄 Standalone | Standalone Content | This query determines rare activity by a high-value account on a system or service. If any account with rare activity is found, the query retrieves related activity from that account on the same day a... |
| User Granted Access and created resources | Hunting Query | 📄 Standalone | Standalone Content | Identifies when a new user is granted access and starts creating resources in Azure. This can help you identify rogue or malicious user behavior. |
| Alerts related to IP | Hunting Query | 📄 Standalone | Standalone Content | Any Alerts that fired related to a given IpAddress during the range of +6h and -3d |
| Alerts On Host | Hunting Query | 📄 Standalone | Standalone Content | Any Alerts that fired on a given host during the range of +6h and -3d |
| Alerts related to File | Hunting Query | 📄 Standalone | Standalone Content | Any Alerts that fired related to a given File during the range of +6h and -3d |
| Web shell command alert enrichment | Hunting Query | 📄 Standalone | Standalone Content | Extracts MDATP Alerts that indicate a command was executed by a web shell. Uses time window based querying to idneitfy the potential web shell location on the server, then enriches with Attacker IP an... |
| Web shell file alert enrichment | Hunting Query | 📄 Standalone | Standalone Content | Extracts MDATP Alert for a web shell being placed on the server and then enriches this event with information from W3CIISLog to idnetigy the Attacker that placed the shell |
| External IP address in Command Line | Hunting Query | 📄 Standalone | Standalone Content | This query looks for command lines that contain a public IP address. Attackers may use a hard coded IP for C2 or exfiltration. This query can be filtered to exclude network prefixes that are known t... |
| Anomalous sign-in location by user account and authenticating application | Hunting Query | 📄 Standalone | Standalone Content | This query examines Microsoft Entra ID sign-ins for each application and identifies the most anomalous change in a user's location profile. The goal is to detect user account compromise, possibly via ... |
| Anomalous sign-in location by user account and authenticating application - with sign-in details | Hunting Query | 📄 Standalone | Standalone Content | This query examines Microsoft Entra ID sign-ins and identifies anomalous changes in a user's location profile. A variation joins results back onto the original sign-in data to review the location set ... |
| Anomalous Microsoft Entra ID apps based on authentication location | Hunting Query | 📄 Standalone | Standalone Content | This query over Microsoft Entra ID sign-in activity highlights Microsoft Entra ID apps with an unusually high ratio of distinct geolocations versus total number of authentications |
| Inactive or new account signins | Hunting Query | 📄 Standalone | Standalone Content | Query for new sign-ins from stale/inactive accounts. UEBA filters based on ActivityInsights. Results for accounts created in the last 7 days are filtered out. |
| Login spike with increase failure rate | Hunting Query | 📄 Standalone | Standalone Content | Query over SigninLogs summarizes login attempts per hour on weekdays. Kusto anomaly detection finds login spikes. Calculates percentage change between anomalous period and average logins. Determines s... |
| MFA Spamming | Hunting Query | 📄 Standalone | Standalone Content | Identifies list of user impacted by MFA Spamming within a given time window,Default Failure count is 10 with default Time Window is 5 minutes |
| Login attempt by Blocked MFA user | Hunting Query | 📄 Standalone | Standalone Content | An account could be blocked if there are too many failed authentication attempts in a row. This hunting query identifies if a MFA user account that is set to blocked tries to login to Microsoft Entra ... |
| Microsoft Entra ID sign-in burst from multiple locations | Hunting Query | 📄 Standalone | Standalone Content | Highlights accounts associated with multiple authentications from different geographical locations in a short period of time. |
| Signin Logs with expanded Conditional Access Policies | Hunting Query | 📄 Standalone | Standalone Content | Example query for SigninLogs showing how to break out packed fields. In this case extending conditional access Policies |
| Same User - Successful logon for a given App and failure on another App within 1m and low distribution | Hunting Query | 📄 Standalone | Standalone Content | This identifies when a user account successfully logs onto a given App and within 1 minute fails to logon to a different App. This may indicate a malicious attempt at accessing disallowed Apps for dis... |
| Failed attempt to access Azure Portal | Hunting Query | 📄 Standalone | Standalone Content | Access attempts to Azure Portal from an unauthorized user. Either invalid password or the user account does not exist. |
| Disabled accounts using Squid proxy | Hunting Query | 📄 Standalone | Standalone Content | Query finds accounts recorded as disabled by AD in previous time period but still using proxy in current time period. Presumes default squid log format is used. http://www.squid-cache.org/Doc/config/a... |
| Same IP address with multiple csUserAgent | Hunting Query | 📄 Standalone | Standalone Content | This alerts when a client IP connects with 1-15 different useragents in less than 1 hour. Limited to 50 or less connections to avoid high traffic. May indicate malicious activity as a probing method. |
| Potential IIS brute force | Hunting Query | 📄 Standalone | Standalone Content | Query shows 1200+ failed attempts by cIP per hour on server, then successful logon. Only includes > 1 user agent string or port. Could indicate successful probing and brute force success on IIS server... |
| Potential IIS code injection attempt | Hunting Query | 📄 Standalone | Standalone Content | Potential code injection into web server roles via IIS logs scan. Represents attempt to gain initial access using drive-by compromise technique. Detection flags events for review and filtering of auth... |
| URI requests from single client | Hunting Query | 📄 Standalone | Standalone Content | This finds connections to server files requested by only one client. Effective when actor uses static operational IP addresses. Threshold can be modified. Larger execution window increases reliability... |
| Rare User Agent strings | Hunting Query | 📄 Standalone | Standalone Content | This will check for Rare User Agent strings over the last 3 days. This can indicate potential probing of your IIS servers. |
| Suspect Mailbox Export on IIS/OWA | Hunting Query | 📄 Standalone | Standalone Content | The hunting query looks for suspicious files accessed on a IIS server that might indicate exfiltration hosting. This technique has been observed when exporting mailbox files from OWA servers. |
| Detect beacon like pattern based on repetitive time intervals in Wire Data Traffic | Hunting Query | 📄 Standalone | Standalone Content | Query identifies beaconing patterns from Wire Data logs. Uses KQL functions to calculate time delta and find beaconing percentage. Results of beaconing to untrusted public networks can be investigated... |
| Zoom room high CPU alerts | Hunting Query | 📄 Standalone | Standalone Content | This hunting query identifies Zoom room systems with high CPU alerts that may be a sign of device compromise. |
| User denied multiple registration events successfully registering | Hunting Query | 📄 Standalone | Standalone Content | Query identifies users denied registration for multiple webinars or recordings but successfully registered for at least one event. Threshold variable adjusts number of events user needs to be rejected... |
| New domain added to Whitelist | Hunting Query | 📄 Standalone | Standalone Content | This hunting query identifies new domains added to the domain login whitelist in Zoom. |
| New time zone observed | Hunting Query | 📄 Standalone | Standalone Content | This hunting query identifies users joining a meeting from a time zone that a user has not been observed from in the last 30 days. |
| Kerberos AS authentications | Hunting Query | 📄 Standalone | Standalone Content | This query shows attempts to request Kerberos service ticket using the AS service, to monitor Kerberos AS authentications. |
| MDE_Find_Out_of_date_clients | Hunting Query | 📄 Standalone | Standalone Content | Find endpoints with out of date Defender clients |
| MDE_AVScanTimesAndType | Hunting Query | 📄 Standalone | Standalone Content | List all the scan types and device name of those scansg |
| MDE_BlockingASRRules | Hunting Query | 📄 Standalone | Standalone Content | Find endpoints ASR Rules blocking |
| MDE_BrowserExtensionInstalled | Hunting Query | 📄 Standalone | Standalone Content | Endpoint's that downloaded browser extensions |
| MDE_DeviceHealth | Hunting Query | 📄 Standalone | Standalone Content | Endpoint Health with AV information |
| MDE_DeviceInventory-LastUserLoggedIn | Hunting Query | 📄 Standalone | Standalone Content | Endpoint Inventory |
| MDE_Evidenceforasingledevice | Hunting Query | 📄 Standalone | Standalone Content | Find all alert evidence for a single endpoint. This is handy for exporting to a third-party SIEM. |
| MDE_FindDefenderSettingsOnEndpoints | Hunting Query | 📄 Standalone | Standalone Content | Find Endpoints policies settings via compliance settings in the registry |
| MDE_FindLNKFilesOnEndpoints | Hunting Query | 📄 Standalone | Standalone Content | Find LNK files on certain devices |
| MDE_FindMountedISOandDriveLetters | Hunting Query | 📄 Standalone | Standalone Content | Find Mounted ISO files and drive letters |
| MDE_FindsPowerShellExecutionEvents | Hunting Query | 📄 Standalone | Standalone Content | Finds PowerShell execution events that could involve a download. |
| MDE_FindstatuschangefromExposurelevel | Hunting Query | 📄 Standalone | Standalone Content | Find status change from Exposurelevel |
| MDE_ListAllNotOnboardedEnpoints | Hunting Query | 📄 Standalone | Standalone Content | List all devices that are not onboarded |
| MDE_ListAlPnPDevicesAllowedorBlocked | Hunting Query | 📄 Standalone | Standalone Content | List all PnP Devices that have been allowed or blocked |
| MDE_Networktrafficgoingtoport-DNS | Hunting Query | 📄 Standalone | Standalone Content | Find web Traffic going to port 53 |
| MDE_Networktrafficgoingtoport | Hunting Query | 📄 Standalone | Standalone Content | Find web Traffic going to port 80 or 443 |
| MDE_ProxyChangesViaRegistry | Hunting Query | 📄 Standalone | Standalone Content | Count of sender's email addresses by subject |
| MDE_ShowUSBMountedandfilescopied | Hunting Query | 📄 Standalone | Standalone Content | Show usb mounted and files copied |
| MDE_ShowUSBMountedDevicesAndDriveLetter | Hunting Query | 📄 Standalone | Standalone Content | Show usb mounted devices and drive letters |
| MDE_SmartScreenCheck | Hunting Query | 📄 Standalone | Standalone Content | Check to see if Smart screen is working. This can also be used to track users going to websites. |
| MDE_SoftwareInventorybyOS | Hunting Query | 📄 Standalone | Standalone Content | Software Inventory by OS |
| Find_deleted_accounts_and_by_whom | Hunting Query | 📄 Standalone | Standalone Content | Find accounts that have been deleted and by whom |
| MDI_Group_Memebership_Changes | Hunting Query | 📄 Standalone | Standalone Content | Find accounts that have been added/removed from groups in AD. |
| MDI_Objects_Moving_OUs | Hunting Query | 📄 Standalone | Standalone Content | Find objects that have been added/removed to different OUs in AD. |
| Active Directory Account lockout and unlocks | Hunting Query | 📄 Standalone | Standalone Content | This query lists Active Directory accounts lockout and unlock events |
| 2S-MISP-Forwarder | Playbook | 📄 Standalone | Standalone Content | This Playbook will forward selected Threat Intelligence from your Sentinel Workspace to an orchestrator playbook. By default it supports sending filehashes and filenames from Defender 365 'Malware was... |
| 2S-MISP-Orchestrator | Playbook | 📄 Standalone | Standalone Content | This Playbook is designed to ingest Threat Intelligence Indicators of Compromise (IOCs) from the MISP-Forwarder Playbooks and send it in the correct form to your MISP-server. It will create a new MISP... |
| Add IP Entity To Named Location | Playbook | 📄 Standalone | Standalone Content | This playbook will execute using an incident based trigger and add the IP entities to a Conditional Access Named Location |
| Add IP Entity To Network Security Group | Playbook | 📄 Standalone | Standalone Content | This playbook will execute using an incident based trigger and add the IP entities to a Network Security Group |
| Affected-Key-Credentials-Scanner | Playbook | 📄 Standalone | Standalone Content | This Playbook scans all key credentials in all apps/serviceprincipals in the specified tenant for credentials with property hasExtendedValue == true by calling Microsoft Graph and adds to Azure Sentin... |
| aggregate-ServiceNow-tickets | Playbook | 📄 Standalone | Standalone Content | |
| AS-Add-Azure-AD-User-Job-Title-to-Incident | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. It will pull the Azure AD user accounts associated with the entities from Microsoft Sentinel incidents and add the Azure AD job ... |
| AS-Add-Machine-Logon-Users-to-Incident | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. It will match the hosts from a Microsoft Sentinel incident with Microsoft Defender machines and add the logon users for each mac... |
| AS-Azure-AD-Disable-User | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. It will disable the Azure AD user accounts associated with the entities from Microsoft Sentinel incidents. |
| AS-Azure-AD-Enable-User | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. It will enable the Azure AD user accounts associated with the entities from Microsoft Sentinel incidents. |
| AS-Azure-AD-Group | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. It will add the users associated with the accounts from Microsoft Sentinel incidents to an Azure Active Directory Group of your ... |
| AS-Blob-Storage-Add-Domains-to-Zscaler-URL-Category | Playbook | 📄 Standalone | Standalone Content | This playbook will use Azure blob storage to maintain a Zscaler custom URL category of your choice. If the azure blob storage is modified, the Zscaler URL category values will be updated to match. |
| AS-Block-GitHub-User | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will look up the GitHub users associated with the Incident Account Entities and block them from your GitHub organization. If ... |
| AS-Block-Hash-in-Defender | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will take the File Hashes from the Incident entities list and block them in Defender. A comment noting the affected File Hash... |
| AS-Checkmarx-Audit-Ingestion | Playbook | 📄 Standalone | Standalone Content | This playbook ingests Checkmarx audit log events into a custom Microsoft Sentinel table on a daily schedule. |
| AS-Checkmarx-SAST-Ingestion | Playbook | 📄 Standalone | Standalone Content | This playbook ingests Checkmarx SAST scan findings into a custom Microsoft Sentinel table on a daily schedule. |
| AS-Clear-Okta-Network-Zone-List | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run on a schedule. It will clear out all but one of the IPs from an Okta Network Zone list (leaving at least one entry is required by API). This will prevent the list f... |
| AS-Compromised-Machine-Tagging | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. It will match the hosts from an incident with machines in Microsoft Defender and tag those machines as compromised. |
| AS-Create-Opsgenie-Incident | Playbook | 📄 Standalone | Standalone Content | This playbook will create an incident in Opsgenie with the information from a Microsoft Sentinel incident. |
| AS-CrowdstrikeAlerts-Integration | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run on a timmed trigger. It will poll Crowdstrike for new alerts and replicate them in Sentinel |
| AS-Datadog-Events-Integration | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run on a timmed trigger. It will poll Datadog for new events and replicate them in Sentinel |
| AS-Delete-App-Registration | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. If any app registration entities are found (i.e., any entities where kind == CloudApplication), they will be deleted. This playb... |
| AS-Disable-Microsoft-Entra-ID-User-From-Entity | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel account entity. It will disable the Entra ID user account associated with the Microsoft Sentinel account entity. |
| AS-Edgescan-Integration-Assets | Playbook | 📄 Standalone | Standalone Content | This playbook will run daily and ingest asset records created in Edgescan in the last two days. If these records are not in the Microsoft Sentinel Edgescan_Assets_CL custom log, they will be added. |
| AS-Edgescan-Integration-Hosts | Playbook | 📄 Standalone | Standalone Content | This playbook will run daily and ingest host records created in Edgescan in the last two days. If these records are not in the Microsoft Sentinel Edgescan_Hosts_CL custom log, they will be added. |
| AS-Edgescan-Integration-Vulnerabilities | Playbook | 📄 Standalone | Standalone Content | This playbook will run daily and ingest vulnerability records created in Edgescan in the last two days. If these records are not in the Microsoft Sentinel Edgescan_Vulnerabilities_CL custom log, they ... |
| AS-Enable-Microsoft-Entra-ID-User-From-Entity | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel account entity. It will enable the Microsoft Entra ID user account associated with the Microsoft Sentinel account entity. |
| AS-IAM-Entra-ID-Master-Playbook | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident with account and/or IP entities. It will run two playbooks, revoking the sessions of the related Microsoft Entra Id user account ... |
| AS-IP-Blocklist-HTTP | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be triggered from an Azure Logic App master playbook. It will add the IP address from Microsoft Sentinel Incidents to a Microsoft Azure Conditional Access Named Locations ... |
| AS-Microsoft-Entra-ID-Revoke-User-Sessions-HTTP | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will look up Microsoft Entra ID users associated with the incident account entities and revoke their sessions. A comment noti... |
| AS-IAM-Master-Playbook | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident with account and/or IP entities. It will take the IP and account entities and run four separate playbooks to indicate compromise ... |
| AS-IP-Blocklist-HTTP | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be triggered from an Azure Logic App master playbook. It will add the IP address from Microsoft Sentinel Incidents to a Microsoft Azure Conditional Access Named Locations ... |
| AS-Microsoft-Entra-ID-Revoke-User-Sessions-HTTP | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will look up Microsoft Entra ID users associated with the incident account entities and revoke their sessions. A comment noti... |
| AS-Okta-NetworkZoneUpdate-HTTP | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be triggered from an Azure Logic App master playbook. It will add the IP address from Microsoft Sentinel Incidents to an Okta Network Zone of your choosing. |
| AS-Okta-Terminate-User-Sessions-HTTP | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be triggered from an Azure Logic App master playbook. It will match Okta users against the account entities on the incident and then terminate all sessions of the matched ... |
| AS-Import-Azure-AD-Group-Users-to-MS-Watchlist | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run on a schedule. It will add the users from a specified Azure Active Directory group to a Microsoft Sentinel watchlist. |
| AS-Get-HostExposureLevel-From-MDE | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will match the Hosts from a Microsoft Sentinel Incident with Microsoft Defender Machines and add each Machine's exposure leve... |
| AS-Incident-IP-Matched-on-Watchlist | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. If any IP entities are found to match those in a specified watchlist containing a list of subnets, a comment noting this match w... |
| AS-Incident-Response-Approval-Email | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel incident. It will facilitate incident response by sending an approval email to the manager(s) of the user(s) associated with the incident. |
| AS-Incident-Spiderfoot-Scan | Playbook | 📄 Standalone | Standalone Content | This playbook will pull email addresses from the account entities in a Microsoft Sentinel incident and use them as targets in a Spiderfoot scan. By default, the scan is created using the HaveIBeenPwne... |
| AS-IP-Blocklist | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will add the IP address from Microsoft Sentinel Incidents to a Microsoft Azure Conditional Access Named Locations list, signi... |
| AS-IP-Blocklist-Remove-IPs | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will remove the IP address from Microsoft Sentinel Incidents from a Microsoft Azure Conditional Access Named Locations list. |
| AS-Make-GitHub-Repository-Private | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will look up the GitHub repositories associated with the Incident Account Entities and make them private. A comment noting th... |
| AS-MDE-Isolate-Machine | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will match Microsoft Defender for Endpoint machines with the host entities on the incident and then isolate them. |
| AS-MDE-Unisolate-Machine | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will match Microsoft Defender for Endpoint isolated machines with the host entities on the incident and then reslease them fr... |
| AS-Microsoft-DCR-Log-Ingestion | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run |
| AS-MuleSoft-Integration | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to run on a schedule and pull MuleSoft Audit Logs into Microsoft Sentinel custom logs where they can be tracked and queried. |
| AS-Okta-NetworkZoneUpdate | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will add the IP address from Microsoft Sentinel Incidents to an Okta Network Zone of your choosing. |
| AS-PagerDuty-Integration | Playbook | 📄 Standalone | Standalone Content | Author: Accelerynt |
| AS-Recurring-Host-Entity | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will take the Hosts from the Incident entities list and search the Microsoft Sentinel SecurityAlert logs for other entities c... |
| AS-Remove-Domains-from-Zscaler-URL-Category | Playbook | 📄 Standalone | Standalone Content | This playbook will extract domains from Microsoft Sentinel incidents and remove them from a Zscaler Custom URL Category of your choice. |
| AS-Revoke-Entra-ID-User-Session-From-Entity | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Entity. It will look up Entra ID users associated with the account entities and revoke their sessions. |
| AS-Revoke-Entra-ID-User-Session-From-Incident | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will look up Entra ID users associated with the incident account entities and revoke their sessions. A comment noting the aff... |
| AS-Sign-Out-Google-User | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Incident. It will look up the Google Users associated with the Incident Account Entities and sign them out of all Google web and device se... |
| AS-Slack-Integration | Playbook | 📄 Standalone | Standalone Content | Author: Accelerynt |
| AS-Terminate-Okta-User-Sessions-From-Entity | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Entity. It will match Okta users against the account entities on the entity and then terminate all sessions of the matched users in Okta. |
| AS-Update-Okta-Network-Zone-From-Entity | Playbook | 📄 Standalone | Standalone Content | This playbook is intended to be run from a Microsoft Sentinel Entity. It will add the IP address from Microsoft Sentinel Entities to an Okta Network Zone of your choosing. |
| AutoConnect-ASCSubscriptions | Playbook | 📄 Standalone | Standalone Content | author: Lior Tamir modifiedby: Nathan Swift |
| Query Azure Monitor with managed identity | Playbook | 📄 Standalone | Standalone Content | This playbook will query Azure Monitor with managed identity. alternative to regular AzureMonitor block which does not support managed identity. |
| Block AAD user or admin - Alert | Playbook | 📄 Standalone | Standalone Content | For each account entity included in the alert, this playbook will disable the user in Azure Active Directoy, add a comment to the incident that contains this alert and notify manager if available. Not... |
| Block AAD user or admin - incident | Playbook | 📄 Standalone | Standalone Content | For each account entity included in the incident, this playbook will disable the user in Azure Active Directoy, add a comment to the incident that contains this alert and notify manager if available. ... |
| Block IP in Exchange On-Prem | Playbook | 📄 Standalone | Standalone Content | This Playbook will block the IP in on-premises Exchange Server. |
| Block_IPs_on_MDATP_Using_GraphSecurity | Playbook | 📄 Standalone | Standalone Content | author: Chi Nguyen |
| BlockADOnPremUser | Playbook | 📄 Standalone | Standalone Content | Many organizations have an on-premises Active Directory infrastructure that is synced to Azure AD in the cloud. However, given that the on-prem side is the authoritative source of truth, any changes, ... |
| Change-Incident-Severity | Playbook | 📄 Standalone | Standalone Content | |
| Change Incident Severity | Playbook | 📄 Standalone | Standalone Content | This playbook will change Incident Severity based on specific username that is part of the Incident user entity. |
| Block IP - Cisco ASA | Playbook | 📄 Standalone | Standalone Content | This playbook allows blocking/allowing of IPs in Cisco ASA, using a Network Object Group. The Network Object Group itself should be part of an Access Control Entry. |
| Cisco ASA - Create or remove access rules on an interface for IP Addresses | Playbook | 📄 Standalone | Standalone Content | This playbook allows blocking/unblocking of IPs in Cisco ASA, using **Access Control Entries** which will be created in an access control list. |
| Cisco ASA - Create or Inbound Access Rule On Interface | Playbook | 📄 Standalone | Standalone Content | This playbook allows blocking/unblocking of IPs in Cisco ASA, using **Access Rules** which will be created on an interface. |
| Close-Incident-MCAS | Playbook | 📄 Standalone | Standalone Content | Author: Benjamin Kovacevic |
| Close-SentinelIncident-from-ServiceNow | Playbook | 📄 Standalone | Standalone Content | Author: Yaniv Shasha This Logic App act as listener for a incident close event in ServiceNow and will close the incident in Sentinel. |
| Generate-Incident-Logic-App | Playbook | 📄 Standalone | Standalone Content | This playbook will help to create an incident in Microsoft Sentinle when an email is sent to the configured email address. |
| Create-Incident-Logic-App | Playbook | 📄 Standalone | Standalone Content | This playbook will help to create an incident in Microsoft Sentinle when an email is sent to the configured email address. |
| Create-AzureDevOpsTask-alert-trigger | Playbook | 📄 Standalone | Standalone Content | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| Create-AzureDevOpsTask-incident-trigger | Playbook | 📄 Standalone | Standalone Content | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| IBMResilient-Incidents | Playbook | 📄 Standalone | Standalone Content | |
| Create-IBMResilientIncident | Playbook | 📄 Standalone | Standalone Content | This playbook will create an IBM Resilient incident from an Azure Sentinel incident. It will also add the Azure Sentinel Incident Entities as IBM Resilient Incident Artifacts. |
| Create-incident-on-missing-Data-Source | Playbook | 📄 Standalone | Standalone Content | Author: John Joyner |
| Create Zendesk ticket | Playbook | 📄 Standalone | Standalone Content | This playbook will create a Zendesk ticket when a new incident is created in Microsoft Sentinel. |
| Crowdstrike-ResponsefromTeams | Playbook | 📄 Standalone | Standalone Content | When a new Azure Sentinel incident is created, this playbook gets triggered and performs below actions: 1. Fetches the device information from Crowdstrike 1. Contain the device or run a script based o... |
| Cyble-Threat-Intel-Playbook | Playbook | 📄 Standalone | Standalone Content | The Cyble Threat Intel Playbook facilitates the retrieval of logs from the Cyble Alerts API into Microsoft Sentinel. |
| CDC_Dismiss_Upstream_Events | Playbook | 📄 Standalone | Standalone Content | author: Bridewell Consulting - Robert Kitching |
| Dynamic-Summaries-API-Upsert | Playbook | 📄 Standalone | Standalone Content | This playbook shows how to query Log Analytics data and upload the query result to Sentinel Dynamic Summaries table through Dynamic Summaries REST API. |
| Query Azure Resource Graph with HTTP input and output | Playbook | 📄 Standalone | Standalone Content | This playbook queries Azure Resource Graph and returns azure information related to the resource like Subscription, Resourcegroups, Tags and Management groups. |
| Query Azure Resource Graph and enrich sentinel incident | Playbook | 📄 Standalone | Standalone Content | This playbook will enrich a Sentinel Incident with information from AzureResourceGraph. |
| Enrich MD5 and SHA1 entities - CIRCL hashlookup | Playbook | 📄 Standalone | Standalone Content | This playbook will enrich a Sentinel Incident with hash information from CIRCL hashlookup. |
| Enrich file hash entities - Intezer Analyze | Playbook | 📄 Standalone | Standalone Content | This playbook will enrich a Sentinel Incident with hash information from Intezer Analyze. |
| Enrich file hashes entities - MalwareBazaar | Playbook | 📄 Standalone | Standalone Content | This playbook will enrich a Sentinel Incident with hash information from MalwareBazaar. |
| Enrich multiple entities - AlienVault-OTX | Playbook | 📄 Standalone | Standalone Content | This playbook will enrich a Sentinel Incident with pulse information from AlienVault OTX. If any pulses are found the Incident will also be tagged and the severity raised to High. |
| GreyNoise-IP-Enrichment | Playbook | 📄 Standalone | Standalone Content | author: Nathan Swift |
| GreyNoise-IP-CommunityEnrichment | Playbook | 📄 Standalone | Standalone Content | author: Nathan Swift |
| Enrich-SentinelIncident-MDATPTVM | Playbook | 📄 Standalone | Standalone Content | author: Yaniv Shasha |
| Export-Incidents-With-Comments-Report | Playbook | 📄 Standalone | Standalone Content | author: Bridewell Consulting - Robert Kitching |
| Four Playbook templates - F5BigIP | Playbook | 📄 Standalone | Standalone Content | This is a consolidated json file for deploying 4 playbooks. |
| Base playbook - F5 BIG-IP | Playbook | 📄 Standalone | Standalone Content | This playbook generates access token for F5 BIG-IP Main playbooks. |
| Block IP - F5 BIG-IP | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious IP address is part of IP Address List of F5 BIG-IP firewall. |
| Block URL - F5 BIG-IP | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious URL is part of URL Blocklist Category of F5 BIG-IP firewall. |
| Enrichment IP - F5 BIG-IP | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious IP address is part of IP Address List of F5 BIG-IP firewall. |
| Logic Apps Custom Connectors and Playbook templates - ForcepointNGFW | Playbook | 📄 Standalone | Standalone Content | This is a consolidated json file for deploying ForcepointSMC custom connector + ForcepointFUID custom connector + 6 playbooks. |
| Block IP addresses - ForcepointNGFW | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious IP address is blocked or unblocked by SMC firewall. |
| Block IP addresses by Username - ForcepointNGFW | Playbook | 📄 Standalone | Standalone Content | This is forcepoint FUID playbook for blocking IP addresses by username ForcepointNGFW. |
| Block URLs - ForcepointNGFW | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious URL is blocked or unblocked by SMC firewall. |
| Enrichment IP - Forcepoint | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious IP address is blocked or unblocked by SMC firewall. |
| Enrichment URL - Forcepoint | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious URL is blocked or unblocked by SMC firewall. |
| Block or Unblock IP addresses - ForcepointNGFW | Playbook | 📄 Standalone | Standalone Content | This playbook checks if malicious IP address is blocked or unblocked by SMC firewall. |
| Get-AD4IoTDeviceCVEs - Alert | Playbook | 📄 Standalone | Standalone Content | For each IoT device entity included in the alert, this playbook will get CVEs from the Azure Defender for IoT Sensor. |
| Get-AD4IoTDeviceCVEs - Incident | Playbook | 📄 Standalone | Standalone Content | For each IoT device entity included in the alert, this playbook will get CVEs from the Azure Defender for IoT Sensor. |
| Get-ASCRecommendations | Playbook | 📄 Standalone | Standalone Content | |
| Get-ASCRecommendations | Playbook | 📄 Standalone | Standalone Content | This playbook will take each Host entity and If its an Azure Resource, query ASC API to get any ASC recommendations. It will add a tag and comment if any unhealthy recommendations are found for the re... |
| Get-GeoFromIpAndTagIncident | Playbook | 📄 Standalone | Standalone Content | |
| Get-GeoFromIpAndTagIncident | Playbook | 📄 Standalone | Standalone Content | |
| Get-MDEInvestigationPackage | Playbook | 📄 Standalone | Standalone Content | |
| Get-MDEInvestigationPackage-Entity-Trigger | Playbook | 📄 Standalone | Standalone Content | This playbook will call the collect invesitgation package in MDE based on Host entity. It will then loop until thats complete, once complete it will add a comment to the incident (in case we invoke th... |
| Get-MDEInvestigationPackage | Playbook | 📄 Standalone | Standalone Content | This playbook will call the collect invesitgation package in MDE. It will then loop until thats complete, once complete it will add a comment to the incident and post a message in teams with the URL t... |
| Get-MDEStatistics | Playbook | 📄 Standalone | Standalone Content | |
| Get-MDEStatistics | Playbook | 📄 Standalone | Standalone Content | This playbook will get IP, File and Domain statistics from Microsoft Defender for Endpoint and them to a comment on the Incident in Azure Sentinel. |
| Get-MerakiData-configurationChanges | Playbook | 📄 Standalone | Standalone Content | author: Rich Lilly |
| Get-MerakiData-OrgSecurityEvents | Playbook | 📄 Standalone | Standalone Content | author: Rich Lilly |
| Get-O365Data | Playbook | 📄 Standalone | Standalone Content | Author: Pete Bryan |
| Get-SentinelAlertsEvidence | Playbook | 📄 Standalone | Standalone Content | |
| Get Sentinel Alerts Evidence - incident trigger | Playbook | 📄 Standalone | Standalone Content | This playbook will automatically attach alert evidence from Azure Sentinel alerts and send them to an Event Hub that can be consumed by a 3rd party SIEM solution. |
| Get-SOCActions | Playbook | 📄 Standalone | Standalone Content | author: Rin Ure |
| Get-SOCTasks | Playbook | 📄 Standalone | Standalone Content | This playbook uses the SOCRA Watchlist to automatically enrich incidents generated by Microsoft Sentinel with Tasks to review and take. Tasks will be evaluated per Customer Organization and edited/mod... |
| Get-TenableVlun | Playbook | 📄 Standalone | Standalone Content | Author: Younes Khaldi |
| Guardicore-Import-Assets | Playbook | 📄 Standalone | Standalone Content | Author: Accelerynt |
| Guardicore-Import-Incidents | Playbook | 📄 Standalone | Standalone Content | Author: Accelerynt |
| Guardicore-ThreatIntel | Playbook | 📄 Standalone | Standalone Content | Author: Accelerynt |
| Logic Apps Custom Connector and Playbook templates - HaveIBeenPwned | Playbook | 📄 Standalone | Standalone Content | This is a consolidated json file for deploying Have I Been Pwned custom connector + 4 playbooks. |
| Get Account Breaches - HaveIBeenPwned | Playbook | 📄 Standalone | Standalone Content | This playbook updates the Incident if the user accounts are breached. |
| Get Site Breaches - HaveIBeenPwned | Playbook | 📄 Standalone | Standalone Content | This playbook update the Incident if the sites are breached. |
| Response on Teams - HaveIBeenPwned | Playbook | 📄 Standalone | Standalone Content | This playbook checks if user accounts are breached, sends email to breached user account and closes incident based on action taken by SOC. |
| Send Email - HaveIBeenPwned | Playbook | 📄 Standalone | Standalone Content | This playbook checks if user accounts are breached and sends breach details to user account that have been breached. |
| HaveIBeenPwnedEmail | Playbook | 📄 Standalone | Standalone Content | This Playbook for Azure Sentinel uses the API for haveibeenpwned.com and checks to see if an email address entity in an Incident has been compromised online and returns a quick note to the Comments ta... |
| IdentityProtection-EmailResponse | Playbook | 📄 Standalone | Standalone Content | author: Lior Tamir |
| Identity Protection response from Teams | Playbook | 📄 Standalone | Standalone Content | Run this playbook on incidents which contains suspiciouse AAD identities. For each account, this playbook posts an adaptive card in the SOC Microsoft Teams channel, including the potential risky user ... |
| new-inc-notification | Playbook | 📄 Standalone | Standalone Content | author: Ali Yazdani |
| IncidentUpdate-GetSentinelAlertsEvidence | Playbook | 📄 Standalone | Standalone Content | This playbook will run on a time schedule base (every hour) and it will check for any incident that was updated (in the last hour) in your Sentinel workspace by Sentinel Alerts. <br> It will then auto... |
| Put CanaryTokens webhook alerts to Custom Logs table | Playbook | 📄 Standalone | Standalone Content | This Logic App connector will act as a Webhook listener, CanaryTokens can then send data upon an incident when the canary token has been opened. This will send the data to Azure Sentinel - CanaryToken... |
| Ingest-Prisma | Playbook | 📄 Standalone | Standalone Content | author: Nathan Swift |
| Isolate-AzureStorageAccount | Playbook | 📄 Standalone | Standalone Content | author: Ryan Graham |
| Isolate-AzureVMtoNSG | Playbook | 📄 Standalone | Standalone Content | author: Nathan Swift |
| Isolate-AzVM | Playbook | 📄 Standalone | Standalone Content | <img src="https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg" width="75px" height="75px"> **Note:** Please refer to the following before installing the playbook: • ... |
| MTI Threat Actor Lookup | Playbook | 📄 Standalone | Standalone Content | To be deployed with the bundled function app to automate infrastructure chaining with the MTI API |
| Add URL - Netskope | Playbook | 📄 Standalone | Standalone Content | This playbook add URLs in Netskope URL list to be used in policy definitions etc. |
| Notify-ASCAlertAzureResource | Playbook | 📄 Standalone | Standalone Content | author: Nathan Swift |
| OktaEvents-to-Sentinel | Playbook | 📄 Standalone | Standalone Content | Author: Yaniv Shasha |
| Open-ServiceDeskPlusOnDemand-Ticket | Playbook | 📄 Standalone | Standalone Content | author: Robert Kitching |
| Block IP - Palo Alto PAN-OS | Playbook | 📄 Standalone | Standalone Content | This playbook allows blocking/allowing of IPs in PAN-OS, using a address object group. The address object group itself should be attached to a pre-defined security policy rule. |
| Block URL - Palo Alto PAN-OS | Playbook | 📄 Standalone | Standalone Content | This playbook allows blocking/allowing of URLs in PAN-OS, using an address object group. The address object group itself should be attached to a pre-defined security policy rule. |
| Get System Info - Palo Alto PAN-OS XML API | Playbook | 📄 Standalone | Standalone Content | This playbook gets a threat PCAP from the Panorama machine for a particular threat. |
| Get Threat PCAP - Palo Alto PAN-OS XML API | Playbook | 📄 Standalone | Standalone Content | This playbook gets a threat PCAP from the Panorama machine for a particular threat. |
| PaloAlto-PAN-OS-GetURLCategoryInfo | Playbook | 📄 Standalone | Standalone Content | When a new sentinal incident is created, this playbook gets triggered and performs below actions: 1. Fetches the address group details and URL filtering category information from PAN-OS 2. Updates all... |
| Logic Apps Custom Connector and Playbook templates - Palo Alto Wildfire and PAN-OS | Playbook | 📄 Standalone | Standalone Content | This is a consolidated json file for deploying WildFire custom connector + 3 Playbooks |
| Block URL - Palo Alto Wildfire and PAN-OS | Playbook | 📄 Standalone | Standalone Content | This playbook used to add verdict URL security policy rules |
| Block URL From Teams - Palo Alto Wildfire and PAN-OS | Playbook | 📄 Standalone | Standalone Content | This playbook is used to add Malicious URL to security policy rules of PAN-OS VM on teams response |
| FileHash Enrichment - Palo Alto Wildfire | Playbook | 📄 Standalone | Standalone Content | This playbook used to enrich sentinel incident with filehash information |
| Post-Tags-And-Comments-To-Your-IntSights-Account | Playbook | 📄 Standalone | Standalone Content | author: Shir Sabag - IntSights |
| Put Defender for Endpoint Alert as Hunting ARM Template in GitHub Rep | Playbook | 📄 Standalone | Standalone Content | This Playbook Provides the automation to Push Defender for Endpoint Alerts including Alert Names, MITRE Tactics, Techniques and Sub-Techniques as Hunting ARM Templates into a Sentinel Github Repositor... |
| Alert trigger empty playbook | Playbook | 📄 Standalone | Standalone Content | Use this template to quickly create a new playbook which starts with an Azure Sentinel alert. The playbook is deployed with Managed Identity enabled. |
| Incident trigger empty playbook | Playbook | 📄 Standalone | Standalone Content | Use this template to quickly create a new playbook which starts with an Azure Sentinel incident. The playbook is deployed with Managed Identity enabled. |
| RecordedFuture-ImportToDefenderEndpoint (DEPRECATED) | Playbook | 📄 Standalone | Standalone Content | DEPRECATED: This playbook is no longer functional. Microsoft has deprecated the Graph Security tiIndicators API that this playbook relies on. Do not deploy this playbook. This playbook previously leve... |
| RecordedFuture-TIforDefenderEndpoint (DEPRECATED) | Playbook | 📄 Standalone | Standalone Content | DEPRECATED: This playbook is no longer functional. Microsoft has deprecated the Graph Security tiIndicators API that this playbook relies on. Do not deploy this playbook. This playbook previously leve... |
| RecordedFuture_IP_SCF_ImportToDefenderEndpoint (DEPRECATED) | Playbook | 📄 Standalone | Standalone Content | DEPRECATED: This playbook is no longer functional. Microsoft has deprecated the Graph Security tiIndicators API that this playbook relies on. Do not deploy this playbook. This playbook previously leve... |
| RecordedFuture_IP_SCF_IndicatorProcessor (DEPRECATED) | Playbook | 📄 Standalone | Standalone Content | DEPRECATED: This playbook is no longer functional. Microsoft has deprecated the Graph Security tiIndicators API that this playbook relies on. Do not deploy this playbook. This playbook previously leve... |
| Remove-MDEAppExecution | Playbook | 📄 Standalone | Standalone Content | |
| Remove-MDEAppExecution | Playbook | 📄 Standalone | Standalone Content | This playbook will remove restrict app execution on the machine in Microsoft Defender for Endpoint. |
| Reopen-Incident-With-Incomplete-Tasks | Playbook | 📄 Standalone | Standalone Content | This playbook will reopen a closed Sentinel incident if there are any incident tasks attached which have not been completed. In addition, a tag and comment will be added to the incident to call attent... |
| Run-AzureVMPacketCapture | Playbook | 📄 Standalone | Standalone Content | author: Nathan Swift |
| Run-Notebook-After-Incident-Creation | Playbook | 📄 Standalone | Standalone Content | This playbook will trigger a Microsoft Sentinel notebook to process newly created incident. It will pass incident ID and entities if any to the notebook. |
| Send-AnalyticalRulesHealthNotifications | Playbook | 📄 Standalone | Standalone Content | Send notifications on Azure Sentinel Analytical Rules - auto-disabled rules |
| Send-AzCommunicationsSMSMessage | Playbook | 📄 Standalone | Standalone Content | |
| Send-AzCommunicationsSMSMessage | Playbook | 📄 Standalone | Standalone Content | This playbook will send an SMS Message using Azure Communications Services to alert of new incidents. |
| Ingestion Cost Alert Playbook | Playbook | 📄 Standalone | Standalone Content | This playbook sends you an e-mail or Microsoft Teams message alert if a user-defined budget threshold is exceeded |
| Send Ingestion Cost Anomaly Alert | Playbook | 📄 Standalone | Standalone Content | This playbook sends you an alert should there be an ingestion spike into your workspace. The playbook uses the series_decompose_anomalies KQL function to determine anomalous ingestion. |
| Post Message Slack Via Webhook | Playbook | 📄 Standalone | Standalone Content | This playbook will be sending Slack with basic incidents details (Incident title, severity, tactics, link,…) when incident is created in Microsoft Sentinel. The playbook includes functionality to:<br>... |
| Send Unhealthy Azure Arc Resource Alert | Playbook | 📄 Standalone | Standalone Content | Sentinel logic app designed to send an email alert when an unhealthy Azure Arc resource is detected. The logic app is implemented using Azure Logic Apps and utilizes Azure Monitor Logs and Office 365 ... |
| Send-UrlReport | Playbook | 📄 Standalone | Standalone Content | author: yaniv Shasha and Yehuda Tognder |
| spur_alert | Playbook | 📄 Standalone | Standalone Content | |
| spur_alert | Playbook | 📄 Standalone | Standalone Content | |
| Start-MDEAutomatedInvestigation | Playbook | 📄 Standalone | Standalone Content | |
| Start-MDEAutomatedInvestigation | Playbook | 📄 Standalone | Standalone Content | This playbook will call the start automated investigation in MDE. It will then add a comment to the incident and post a message in Teams. |
| Sync - Incident Comment To M365D On Update | Playbook | 📄 Standalone | Standalone Content | This playbook will sync incident comments from Microsoft Sentinel to Microsoft 365 Defender when comment is added. |
| Thinkst Canary Microsoft Sentinel Alert Integration | Playbook | 📄 Standalone | Standalone Content | This Playbook Integrate Thinkst Canary cloud console alerts with Microsoft Sentinel |
| Update-BulkIncidents | Playbook | 📄 Standalone | Standalone Content | authors: Priscila Viana, Nathan Swift |
| Update Watchlist - CVE IPs by GreyNoise | Playbook | 📄 Standalone | Standalone Content | This playbook uses the GreyNoise API to search for interesting IPs discovered in the last day tagged per each CVE found in the mode you setup. |
| Update-VIPUsers-Watchlist-from-AzureAD-Group | Playbook | 📄 Standalone | Standalone Content | author: Benjamin Kovacevic |
| Watchlist-SendSQLData-Watchlist | Playbook | 📄 Standalone | Standalone Content | author: Yaniv Shasha |
| Block IP - Zscaler | Playbook | 📄 Standalone | Standalone Content | This playbook allows blocks IPs in Zscaler by adding them to categories |
| Zscaler URL category lookup | Playbook | 📄 Standalone | Standalone Content | This playbook posts Zscaler category information for the Url included in the incident. |
| AS-Add-Domains-to-Zscaler-URL-Category | Playbook | 📄 Standalone | Standalone Content | This playbook will extract domains from Microsoft Sentinel incidents and add them to a Zscaler Custom URL Category of your choice. |
| ZscalarDNSEventsIPSummary | Summary Rule | 📄 Standalone | Standalone Content | This summary rule aggregates DNS events from Zscaler Internet Access devices, providing hourly insights into event count by event result details, dns query, source username, source and destination IP ... |
| FortinetFortigateNetworkSessionIPSummary | Summary Rule | 📄 Standalone | Standalone Content | This summary rule aggregates network session logs from Fortinet Fortigate devices, providing hourly insights into session count, data sent and data received by device actions, destination port, protoc... |
| PaloAltoPANOSNetworkSessionIPSummary | Summary Rule | 📄 Standalone | Standalone Content | This summary rule aggregates network session logs from Palo Alto PAN-OS devices, providing hourly insights into session count, data sent, data received by device actions, destination port, source and ... |
| ZscalarNetworkSessionIPSummary | Summary Rule | 📄 Standalone | Standalone Content | This summary rule aggregates network session logs from Zscaler Internet Access devices, providing hourly insights into session count, data sent, data received by device actions, destination port, prot... |
| FortinetFortigateWebSessionIPSummary | Summary Rule | 📄 Standalone | Standalone Content | This summary rule aggregates web session logs from Fortinet Fortigate devices, providing hourly insights into session count, data sent and data received by device actions, destination hostname, source... |
| PaloAltoPANOSWebSessionIPSummary | Summary Rule | 📄 Standalone | Standalone Content | This summary rule aggregates web session logs from Palo Alto PAN-OS devices, providing hourly insights into session count, data sent, data received by device actions, sourceUserName, destination hostn... |
| ZscalarWebSessionIPSummary | Summary Rule | 📄 Standalone | Standalone Content | This summary rule aggregates web session logs from Zscaler Internet Access devices, providing hourly insights into session count, data sent and data received by device action, destination hostname, so... |
| Excessive Blocked Traffic Events Generated by User | Analytic Rule | 📦 Solution | Symantec Endpoint Protection | Creates an incident when a Symantec Endpoint Proection agent detects excessive amounts of blocked traffic generated by a single user. |
| Malware Detected | Analytic Rule | 📦 Solution | Symantec Endpoint Protection | Creates an incident when a Symantec Endpoint Proection agent detects malware and the malware was not cleaned. |
| SymantecEndpointProtection | Workbook | 📦 Solution | Symantec Endpoint Protection | |
| SymantecEndpointProtection | Parser | 📦 Solution | Symantec Endpoint Protection | |
| ClientDeniedAccess | Analytic Rule | 📦 Solution | Symantec VIP | Creates an incident in the event a Client has an excessive amounts of denied access requests. |
| Excessive Failed Authentication from Invalid Inputs | Analytic Rule | 📦 Solution | Symantec VIP | Creates an incident in the event that a user generates an excessive amount of failed authentications due to invalid inputs, indications of a potential brute force. |
| SymantecVIP | Workbook | 📦 Solution | Symantec VIP | |
| SymantecVIP | Parser | 📦 Solution | Symantec VIP | |
| Excessive Denied Proxy Traffic | Analytic Rule | 📦 Solution | SymantecProxySG | This alert creates an incident when a client generates an excessive amounts of denied proxy traffic. |
| User Accessed Suspicious URL Categories | Analytic Rule | 📦 Solution | SymantecProxySG | Creates an incident in the event the requested URL accessed by the user has been identified as Suspicious, Phishing, or Hacking. |
| SymantecProxySG | Workbook | 📦 Solution | SymantecProxySG | |
| SymantecProxySG | Parser | 📦 Solution | SymantecProxySG | |
| Failed logon attempts in authpriv | Analytic Rule | 📦 Solution | Syslog | Identifies failed logon attempts from unknown users in Syslog authpriv logs. The unknown user means the account that tried to log in isn't provisioned on the machine. A few hits could indicate someone... |
| NRT Squid proxy events related to mining pools | Analytic Rule | 📦 Solution | Syslog | Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/ |
| SFTP File transfer above threshold | Analytic Rule | 📦 Solution | Syslog | Identifies SFTP File Transfers above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when th... |
| SFTP File transfer folder count above threshold | Analytic Rule | 📦 Solution | Syslog | Identifies SFTP File Transfers with distinct folder count above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays ... |
| Squid proxy events related to mining pools | Analytic Rule | 📦 Solution | Syslog | Checks for Squid proxy events in Syslog associated with common mining pools. This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/ |
| Squid proxy events for ToR proxies | Analytic Rule | 📦 Solution | Syslog | Check for Squid proxy events associated with common ToR proxies. This query presumes the default squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/ |
| SSH - Potential Brute Force | Analytic Rule | 📦 Solution | Syslog | Identifies an IP address that had 15 failed attempts to sign in via SSH in a 4 hour block during a 24 hour time period. Please note that entity mapping for arrays is not supported, so when there is a... |
| Crypto currency miners EXECVE | Hunting Query | 📦 Solution | Syslog | This query hunts through EXECVE syslog data generated by AUOMS to find instances of crypto currency miners being downloaded.It returns a table of suspicious command lines. |
| Suspicious crytocurrency mining related threat activity detected | Hunting Query | 📦 Solution | Syslog | This query detects terminated suspicious crypto mining payloads/processes. Attackers often halt other mining processes to gain more resources on compromised systems for their payload. |
| Rare process running on a Linux host | Hunting Query | 📦 Solution | Syslog | Looks for rare processes that are running on Linux hosts. Looks for process seen less than 14 times in last 7 days, or observed rate is less than 1% of of the average for the environment and fewer th... |
| Linux scheduled task Aggregation | Hunting Query | 📦 Solution | Syslog | This query aggregates and charts cron job data based on unique user-command pairs. It shows the frequency of commands, the number of computers they've run on, and their percentage of total tenant comp... |
| Editing Linux scheduled tasks through Crontab | Hunting Query | 📦 Solution | Syslog | This query displays user edits to scheduled tasks via crontab, bucketed into 10-min intervals. It collects all actions by a user over seven days. |
| SCX Execute RunAs Providers | Hunting Query | 📦 Solution | Syslog | This query uses AUOMS security events to examine SCX Execute RunAs providers. These providers execute UNIX/Linux commands/scripts from /var/opt/microsoft/scx/tmp. SCXcore is used in various Microsoft ... |
| Squid commonly abused TLDs | Hunting Query | 📦 Solution | Syslog | Some TLDs, often linked to malware due to ease of obtaining, may be undesirable for enterprises. The 'clientCount' column shows domain usage across the estate. Assumes default squid log format. |
| Squid malformed requests | Hunting Query | 📦 Solution | Syslog | Malformed web requests are sometimes used for reconnaissance to detect the presence of network security devices. A large number of requests from a single source may indicate compromised hosts. Assumes... |
| Squid data volume timeseries anomalies | Hunting Query | 📦 Solution | Syslog | Malware or data exfiltration can cause network data volume anomalies. This query detects such anomalies in volume of bytes traversing a squid proxy. Anomalies require further investigation. Assumes de... |
| LinuxMachines | Workbook | 📦 Solution | Syslog | |
| SyslogConnectorsOverviewWorkbook | Workbook | 📦 Solution | Syslog | |
| TacitRed to Defender TI | Playbook | 📦 Solution | TacitRed-Defender-ThreatIntelligence | This playbook ingests TacitRed threat intelligence into Microsoft Defender Threat Intelligence via an Azure Function. It runs on a recurring schedule, retrieves compromised credentials from TacitRed, ... |
| TacitRed to CrowdStrike IOC Automation | Playbook | 📦 Solution | TacitRed-IOC-CrowdStrike | This playbook fetches compromised credential findings from TacitRed threat intelligence and creates corresponding IOC indicators in CrowdStrike Falcon for automated threat response. |
| TacitRed to SentinelOne IOC Automation | Playbook | 📦 Solution | TacitRed-SentinelOne | This playbook fetches compromised credential findings from TacitRed threat intelligence and creates corresponding IOC indicators in SentinelOne for automated threat response. |
| TacitRed - High Confidence Compromise | Analytic Rule | 📦 Solution | TacitRedThreatIntelligence | Detects compromised credentials with high confidence scores. High confidence findings indicate verified credential compromises that require immediate attention. Ref: https://data443.com/tacitred-atta... |
| TacitRed - Repeat Compromise Detection | Analytic Rule | 📦 Solution | TacitRedThreatIntelligence | Detects users who have been compromised multiple times within a 7-day window. This may indicate a persistent threat or inadequate remediation. Ref: https://data443.com/tacitred-attack-surface-intelli... |
| TacitRedSecOpsWorkbook | Workbook | 📦 Solution | TacitRedThreatIntelligence | |
| TalonInsights | Workbook | 📦 Solution | Talon | |
| Tanium Threat Response Alerts | Analytic Rule | 📦 Solution | Tanium | Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook |
| TaniumWorkbook | Workbook | 📦 Solution | Tanium | |
| Tanium-ComplyFindings | Playbook | 📦 Solution | Tanium | Tanium's real-time data can speed up investigations by providing important context for analysts, such as whether or not there are compliance findings on the endpoints in question. This playbook starts... |
| Tanium-GeneralHostInfo | Playbook | 📦 Solution | Tanium | Tanium's real-time data can speed up investigations by providing important context for analysts, such as basic information about the computer's name, IP, and storage information. This playbook starts ... |
| Tanium-MSDefenderHealth | Playbook | 📦 Solution | Tanium | Tanium's real-time data can speed up investigations by providing important context for analysts, such as whether or not Defender is healthy on the endpoint. This playbook starts with a Microsoft Senti... |
| Tanium-QuarantineHosts | Playbook | 📦 Solution | Tanium | During an investigation, it may be critical to isolate endpoints quickly if a compromise is detected. It's also important to track quarantine actions for auditing purposes. This playbook starts with a... |
| Tanium-ResolveThreatResponseAlert | Playbook | 📦 Solution | Tanium | Maintaining alert hygiene in multiple consoles can be overwhelming. This playbook helps teams keep Tanium Threat Response up-to-date when using Microsoft Sentinel to centrally manage alerts. This play... |
| Tanium-SCCMClientHealth | Playbook | 📦 Solution | Tanium | Tanium's real-time data can speed up investigations by providing important context for analysts, such as pulling back Microsoft Configuration Manager (formerly SCCM) Health. This playbook starts with ... |
| Tanium-ListSecurityPatches | Playbook | 📦 Solution | Tanium | Tanium's real-time data can speed up investigations by providing important context for analysts, such as which security patches are missing on the endpoints in question. This playbook starts with a Mi... |
| Tanium-UnquarantineHosts | Playbook | 📦 Solution | Tanium | This playbook starts with a Microsoft Sentinel incident, gets the hosts associated with that incident, then directs Tanium to un-quarantine those hosts. The status of the un-quarantine operation is co... |
| TeamCymruScout | Workbook | 📦 Solution | Team Cymru Scout | |
| Team Cymru Scout Create Incident And Notify | Playbook | 📦 Solution | Team Cymru Scout | This playbook will create an incident for suspicious or malicious ip and notify to pre-defined or user customizable email id. |
| Team Cymru Scout Enrich Incident | Playbook | 📦 Solution | Team Cymru Scout | This playbook will fetch and ingest IP or Domain Indicator data based on Entity mapped in Microsoft Sentinel Incident and notify to pre-defined or user customizable email id. |
| Team Cymru Scout Live Investigation | Playbook | 📦 Solution | Team Cymru Scout | This playbook will fetch and ingest IP or Domain Indicator data based on input parameters given in the live investigation dashboard. |
| CymruScoutAccountUsage | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutCommunicationsData | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutCorrelate | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutDomain | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutDomainData | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutFingerprintsData | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutIdentity | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutIP | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutOpenPortsData | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutPdnsData | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutProtoByIP | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutSummary | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutSummaryTopCerts | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutSummaryTopFingerprints | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutSummaryTopOpenPorts | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutSummaryTopPdns | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutTopAsnsByIP | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutTopCountryCodesByIP | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutTopServicesByIP | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutTopTagsByIP | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutWhois | Parser | 📦 Solution | Team Cymru Scout | |
| CymruScoutX509Data | Parser | 📦 Solution | Team Cymru Scout | |
| TeamCymruScoutDomainData | Watchlist | 📦 Solution | Team Cymru Scout | |
| TeamCymruScoutIPData | Watchlist | 📦 Solution | Team Cymru Scout | |
| MicrosoftTeams | Workbook | 📦 Solution | Teams | |
| Advanced ServiceNow Teams Integration Playbook | Playbook | 📦 Solution | Teams | This playbook showcases an example of triggering an incident within a targeted Teams channel and opening up a ticket within Service Now. Additionally The playbook will also list playbooks that can be ... |
| Send Teams Adaptive Card on incident creation | Playbook | 📦 Solution | Teams | This playbook will send Microsoft Teams Adaptive Card on incident creation, with the option to change the incident's severity and/or status. |
| TIE Active Directory attacks pathways | Analytic Rule | 📦 Solution | Tenable App | Searches for triggered Indicators of Exposures related to Active Directory attacks pathways. |
| TIE DCShadow | Analytic Rule | 📦 Solution | Tenable App | Searches for DCShadow attacks. |
| TIE DCSync | Analytic Rule | 📦 Solution | Tenable App | Searches for DCSync attacks. |
| TIE Golden Ticket | Analytic Rule | 📦 Solution | Tenable App | Searches for Golden Ticket attacks. |
| TIE Indicators of Attack | Analytic Rule | 📦 Solution | Tenable App | Searches for triggered Indicators of Attack. |
| TIE Indicators of Exposures | Analytic Rule | 📦 Solution | Tenable App | Searches for triggered Indicators of Exposures. |
| TIE LSASS Memory | Analytic Rule | 📦 Solution | Tenable App | Searches for OS Credentials dumping attacks. |
| TIE Password Guessing | Analytic Rule | 📦 Solution | Tenable App | Searches for bruteforce Password Guessing attacks. |
| TIE Password issues | Analytic Rule | 📦 Solution | Tenable App | Searches for triggered Indicators of Exposures related to password issues. |
| TIE Password Spraying | Analytic Rule | 📦 Solution | Tenable App | Searches for Password spraying attacks. |
| TIE privileged accounts issues | Analytic Rule | 📦 Solution | Tenable App | Searches for triggered Indicators of Exposures related to privileged accounts issues. |
| TIE user accounts issues | Analytic Rule | 📦 Solution | Tenable App | Searches for triggered Indicators of Exposures related to user accounts issues. |
| TenableIEIoA | Workbook | 📦 Solution | Tenable App | |
| TenableIEIoE | Workbook | 📦 Solution | Tenable App | |
| Tenable VM - Enrich incident with asset info | Playbook | 📦 Solution | Tenable App | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Obtains IPs from the incident. 2. Searches asset information by the IPs in Micros... |
| Tenable VM - Enrich incident with vulnerability info | Playbook | 📦 Solution | Tenable App | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Obtains IPs from the incident. 2. Searches asset IDs by the IPs in Microsoft Sent... |
| Tenable VM - Launch Scan | Playbook | 📦 Solution | Tenable App | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Launches scan by scan id provided during the playbook deployment. 2. Adds informa... |
| afad_parser | Parser | 📦 Solution | Tenable App | |
| TenableVMAssets | Parser | 📦 Solution | Tenable App | |
| TenableVMVulnerabilities | Parser | 📦 Solution | Tenable App | |
| Tenable.ad Active Directory attacks pathways 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for triggered Indicators of Exposures related to Active Directory attacks pathways. |
| Tenable.ad DCShadow 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for DCShadow attacks. |
| Tenable.ad DCSync 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for DCSync attacks. |
| Tenable.ad Golden Ticket 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for Golden Ticket attacks. |
| Tenable.ad Indicators of Attack 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for triggered Indicators of Attack. |
| Tenable.ad Indicators of Exposures 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for triggered Indicators of Exposures. |
| Tenable.ad LSASS Memory 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for OS Credentials dumping attacks. |
| Tenable.ad Password Guessing 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for bruteforce Password Guessing attacks. |
| Tenable.ad Password issues 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for triggered Indicators of Exposures related to password issues. |
| Tenable.ad Password Spraying 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for Password spraying attacks. |
| Tenable.ad privileged accounts issues 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for triggered Indicators of Exposures related to privileged accounts issues. |
| Tenable.ad user accounts issues 🔍 | Analytic Rule | 📦 Solution | TenableAD | Searches for triggered Indicators of Exposures related to user accounts issues. |
| TenableAdIoA 🔍 | Workbook | 📦 Solution | TenableAD | |
| TenableAdIoE 🔍 | Workbook | 📦 Solution | TenableAD | |
| afad_parser 🔍 | Parser | 📦 Solution | TenableAD | |
| Tenable.io - Enrich incident with asset info | Playbook | 📦 Solution | TenableIO | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Obtains IPs from the incident. 2. Searches asset information by the IPs in Micros... |
| Tenable.io - Enrich incident with vulnerability info | Playbook | 📦 Solution | TenableIO | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Obtains IPs from the incident. 2. Searches asset IDs by the IPs in Microsoft Sent... |
| Tenable.io - Launch Scan | Playbook | 📦 Solution | TenableIO | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Launches scan by scan id provided during the playbook deployment. 2. Adds informa... |
| TenableIOAssets 🔍 | Parser | 📦 Solution | TenableIO | |
| TenableIOVulnerabilities 🔍 | Parser | 📦 Solution | TenableIO | |
| The Hive - Create alert | Playbook | 📦 Solution | TheHive | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Parses alert extended properties. 2. Parses alert custom details. 3. Creates aler... |
| The Hive - Create case | Playbook | 📦 Solution | TheHive | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Creates case in TheHive instance with enriched description and title. 2. Gets Hos... |
| The Hive - Lock user | Playbook | 📦 Solution | TheHive | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. Parses alerts custom details 2. Locks Users by UserId or UserLogin passed from al... |
| TheHive 🔍 | Parser | 📦 Solution | TheHive | |
| Theom Critical Risks | Analytic Rule | 📦 Solution | Theom | "Creates Microsoft Sentinel incidents for critical risk Theom alerts." |
| Theom High Risks | Analytic Rule | 📦 Solution | Theom | "Creates Microsoft Sentinel incidents for high risk Theom alerts." |
| Theom Insights | Analytic Rule | 📦 Solution | Theom | "Creates Microsoft Sentinel incidents for Theom insight alerts." |
| Theom Low Risks | Analytic Rule | 📦 Solution | Theom | "Creates Microsoft Sentinel incidents for low risk Theom alerts" |
| Theom Medium Risks | Analytic Rule | 📦 Solution | Theom | "Creates Microsoft Sentinel incidents for medium risk Theom alerts." |
| Theom - Dev secrets unencrypted | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0001 (Developer secrets have been observed in unencrypted data stores. Encrypt data at rest to comply with this CI... |
| Theom - National IDs unencrypted | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0002 (National IDs have been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS req... |
| Theom - Financial data unencrypted | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0003 (Financial data has been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS re... |
| Theom - Healthcare data unencrypted | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0004 (Healthcare data has been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS r... |
| Theom - Unencrypted public data stores | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0005 (Theom has observed data stores that are both unencrypted and publicly accessible. Review if the data store a... |
| Theom - Critical data in API headers or body | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId's TRIS0007 to TRIS0010 and TRIS0014" |
| Theom - Dev secrets exposed | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0012 (Theom has observed developer secrets in a data store that is publicly exposed. As per this requirement, use ... |
| Theom - Healthcare data exposed | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0015 (Theom has observed healthcare data in a data store that is publicly exposed. As per this requirement, use th... |
| Theom - National IDs exposed | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0018 (Theom has observed National IDs in a data store that is publicly exposed. As per this requirement, use this ... |
| Theom - Financial data exposed | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0026 (Theom has observed financial data in a data store that is publicly exposed. As per this requirement, use thi... |
| Theom - Dark Data with large fin value | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0032 (Theom has observed data with a large financial value, but that has not been accessed recently. Use this info... |
| Theom - Least priv large value shadow DB | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0032 (Theom has observed shadow (or clone) databases/tables that have a large financial value. Additionally, it ha... |
| Theom - Overprovisioned Roles Shadow DB | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0034 (Theom has observed shadow (or clone) databases/tables. Additionally, it has observed roles that are overprov... |
| Theom - Shadow DB large datastore value | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0035 (Theom has observed shadow (or clone) databases/tables with large financial value. As per this requirement, u... |
| Theom - Shadow DB with atypical accesses | Analytic Rule | 📦 Solution | Theom | "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0036 (Theom has observed shadow or clone databases/tables. Additionally, it has observed atypical accesses to thes... |
| Theom | Workbook | 📦 Solution | Theom | |
| Preview - TI map Domain entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies compromises and attacks and detect malicious activities in one's domain entity from TI. |
| TI map Domain entity to PaloAlto CommonSecurityLog | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI |
| TI Map Domain Entity to DeviceNetworkEvents | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in DeviceNetworkEvents. |
| TI map Domain entity to DnsEvents | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in DnsEvents from any Domain IOC from TI |
| TI map Domain entity to EmailEvents | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in EmailEvents table from any Domain IOC from TI |
| TI map Domain entity to EmailUrlInfo | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in EmailUrlInfo table from any Domain IOC from TI. |
| TI map Domain entity to Web Session Events (ASIM Web Session schema) | Analytic Rule | 📦 Solution | Threat Intelligence | This rule identifies Web Sessions for which the target URL hostname is a known IoC. This rule uses the [Advanced Security Information Model (ASIM)](https:/aka.ms/AboutASIM) and supports any web sessio... |
| TI map Domain entity to PaloAlto | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in Palo Alto data in CommonSecurityLog table from any Domain IOC from TI |
| TI map Domain entity to SecurityAlert | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in SecurityAlert table from any Domain IOC from TI |
| TI map Domain entity to Syslog | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in Syslog table from any Domain IOC from TI |
| TI map Email entity to AzureActivity | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in AzureActivity table from any Email IOC from TI |
| Preview - TI map Email entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies compromises and attacks and detect malicious activities in one's email entity from TI |
| TI map Email entity to EmailEvents | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in EmailEvents table from any Email IOC from TI |
| TI map Email entity to OfficeActivity | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in OfficeActivity table from any Email IOC from TI |
| TI map Email entity to PaloAlto CommonSecurityLog | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in CommonSecurityLog table from any Email IOC from TI |
| TI map Email entity to SecurityAlert | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in SecurityAlert table from any Email IOC from TI which will extend coverage to datatypes such as MCAS, StorageThreatProtection and many others |
| TI map Email entity to SecurityEvent | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in SecurityEvent table from any Email IOC from TI |
| TI map Email entity to SigninLogs | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in SigninLogs table from any Email IOC from TI |
| TI map File Hash to CommonSecurityLog Event | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in CommonSecurityLog Event data from any FileHash IOC from TI |
| TI map File Hash to DeviceFileEvents Event | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in DeviceFileEvents Event data from any FileHash IOC from TI |
| TI map File Hash to Security Event | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in Security Event data from any File Hash IOC from TI |
| TI map Domain entity to Dns Events (ASIM DNS Schema) | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in DNS events from any Domain IOC from TI This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema' |
| TI map IP entity to DNS Events (ASIM DNS schema) | Analytic Rule | 📦 Solution | Threat Intelligence | This rule identifies DNS requests for which response IP address is a known IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the AS... |
| TI map IP entity to AppServiceHTTPLogs | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in AppServiceHTTPLogs from any IP IOC from TI |
| TI map IP entity to AWSCloudTrail | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in AWSCloudTrail from any IP IOC from TI |
| TI Map IP Entity to AzureActivity | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in AzureActivity. |
| TI map IP entity to AzureFirewall | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in AzureFirewall (NetworkRule & ApplicationRule Logs) from any IP IOC from TI |
| TI map IP entity to Azure Key Vault logs | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in Azure Key Vault logs from any IP IOC from TI |
| TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in AzureNetworkAnalytics_CL (NSG Flow Logs) from any IP IOC from TI that was Allowed |
| TI Map IP Entity to Azure SQL Security Audit Events | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SQL Security Audit Events. |
| Preview - TI map IP entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies compromises and attacks and detect malicious activities in one's IP entity from TI |
| TI Map IP Entity to CommonSecurityLog | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in CommonSecurityLog. |
| TI Map IP Entity to DeviceNetworkEvents | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in DeviceNetworkEvents Event data from any IP Indicator from TI. |
| TI Map IP Entity to DnsEvents | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in DnsEvents. |
| TI Map IP Entity to Duo Security | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in DuoSecurity. |
| TI map IP entity to Network Session Events (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Threat Intelligence | This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custo... |
| TI map IP entity to Web Session Events (ASIM Web Session schema) | Analytic Rule | 📦 Solution | Threat Intelligence | This rule identifies Web Sessions for which the source IP address is a known IoC. This rule uses the [Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) and supports any web session... |
| TI map IP entity to OfficeActivity | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in OfficeActivity. |
| TI Map IP Entity to SigninLogs | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs. |
| TI Map IP Entity to VMConnection | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in VMConnection. |
| TI Map IP Entity to W3CIISLog | Analytic Rule | 📦 Solution | Threat Intelligence | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in W3CIISLog. |
| TI map IP entity to Workday(ASimAuditEventLogs) | Analytic Rule | 📦 Solution | Threat Intelligence | Detects a match in Workday activity from any IP Indicator of Compromise (IOC) provided by Threat Intelligence (TI). |
| TI map IP entity to GitHub_CL | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies a match in GitHub_CL table from any IP IOC from TI |
| TI Map URL Entity to AuditLogs | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in AuditLogs. |
| Preview - TI map URL entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence | Identifies compromises and attacks and detect malicious activities in one's URL entity from TI |
| TI Map URL Entity to DeviceNetworkEvents | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in DeviceNetworkEvents. |
| TI Map URL Entity to EmailUrlInfo | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in EmailUrlInfo. |
| TI Map URL Entity to OfficeActivity Data [Deprecated] | Analytic Rule | 📦 Solution | Threat Intelligence | This query is Deprecated as its filter conditions will never yield results. This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in Offi... |
| TI Map URL Entity to PaloAlto Data | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in PaloAlto Data. |
| TI Map URL Entity to SecurityAlert Data | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in SecurityAlert data. |
| TI Map URL Entity to Syslog Data | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in Syslog data. |
| TI Map URL Entity to UrlClickEvents | Analytic Rule | 📦 Solution | Threat Intelligence | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents. |
| TI Map File Entity to OfficeActivity Event | Hunting Query | 📦 Solution | Threat Intelligence | This query finds matches in OfficeActivity Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for huntin... |
| TI Map File Entity to Security Event | Hunting Query | 📦 Solution | Threat Intelligence | This query finds matches in Security Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rath... |
| TI Map File Entity to Syslog Event | Hunting Query | 📦 Solution | Threat Intelligence | This query finds matches in Syslog Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rather... |
| TI Map File Entity to VMConnection Event | Hunting Query | 📦 Solution | Threat Intelligence | This query finds matches in VMConnection Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting ... |
| TI Map File Entity to WireData Event | Hunting Query | 📦 Solution | Threat Intelligence | This query finds matches in WireData Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rath... |
| ThreatIntelligence | Workbook | 📦 Solution | Threat Intelligence | |
| TI map Domain entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies compromises and attacks and detect malicious activities in one's domain entity from TI. |
| TI map Domain entity to PaloAlto CommonSecurityLog | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI |
| TI Map Domain Entity to DeviceNetworkEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in DeviceNetworkEvents. |
| TI map Domain entity to DnsEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in DnsEvents from any Domain IOC from TI |
| TI map Domain entity to EmailEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in EmailEvents table from any Domain IOC from TI |
| TI map Domain entity to EmailUrlInfo | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in EmailUrlInfo table from any Domain IOC from TI. |
| TI map Domain entity to Web Session Events (ASIM Web Session schema) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This rule identifies Web Sessions for which the target URL hostname is a known IoC. This rule uses the [Advanced Security Information Model (ASIM)](https:/aka.ms/AboutASIM) and supports any web sessio... |
| TI map Domain entity to PaloAlto | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in Palo Alto data in CommonSecurityLog table from any Domain IOC from TI |
| TI map Domain entity to SecurityAlert | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in SecurityAlert table from any Domain IOC from TI |
| TI map Domain entity to Syslog | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in Syslog table from any Domain IOC from TI |
| TI map Email entity to AzureActivity | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in AzureActivity table from any Email IOC from TI |
| TI map Email entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies compromises and attacks and detect malicious activities in one's email entity from TI |
| TI map Email entity to EmailEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in EmailEvents table from any Email IOC from TI |
| TI map Email entity to OfficeActivity | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in OfficeActivity table from any Email IOC from TI |
| TI map Email entity to PaloAlto CommonSecurityLog | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in CommonSecurityLog table from any Email IOC from TI |
| TI map Email entity to SecurityAlert | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in SecurityAlert table from any Email IOC from TI which will extend coverage to datatypes such as MCAS, StorageThreatProtection and many others |
| TI map Email entity to SecurityEvent | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in SecurityEvent table from any Email IOC from TI |
| TI map Email entity to SigninLogs | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in SigninLogs table from any Email IOC from TI |
| TI map File Hash to CommonSecurityLog Event | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in CommonSecurityLog Event data from any FileHash IOC from TI |
| TI map File Hash to DeviceFileEvents Event | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in DeviceFileEvents Event data from any FileHash IOC from TI |
| TI map File Hash to Security Event | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in Security Event data from any File Hash IOC from TI |
| TI map Domain entity to Dns Events (ASIM DNS Schema) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in DNS events from any Domain IOC from TI This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema' |
| TI map IP entity to DNS Events (ASIM DNS schema) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This rule identifies DNS requests for which response IP address is a known IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the AS... |
| TI map IP entity to AppServiceHTTPLogs | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in AppServiceHTTPLogs from any IP IOC from TI |
| TI map IP entity to AWSCloudTrail | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in AWSCloudTrail from any IP IOC from TI |
| TI Map IP Entity to AzureActivity | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in AzureActivity. |
| TI map IP entity to AzureFirewall | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in AzureFirewall (NetworkRule & ApplicationRule Logs) from any IP IOC from TI |
| TI map IP entity to Azure Key Vault logs | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in Azure Key Vault logs from any IP IOC from TI |
| TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in AzureNetworkAnalytics_CL (NSG Flow Logs) from any IP IOC from TI that was Allowed |
| TI Map IP Entity to Azure SQL Security Audit Events | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SQL Security Audit Events. |
| TI map IP entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies compromises and attacks and detect malicious activities in one's IP entity from TI |
| TI Map IP Entity to CommonSecurityLog | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in CommonSecurityLog. |
| TI Map IP Entity to DeviceNetworkEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in DeviceNetworkEvents Event data from any IP Indicator from TI. |
| TI Map IP Entity to DnsEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in DnsEvents. |
| TI Map IP Entity to Duo Security | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in DuoSecurity. |
| TI map IP entity to Network Session Events (ASIM Network Session schema) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custo... |
| TI map IP entity to Web Session Events (ASIM Web Session schema) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This rule identifies Web Sessions for which the source IP address is a known IoC. This rule uses the [Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) and supports any web session... |
| TI map IP entity to OfficeActivity | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in OfficeActivity. |
| TI Map IP Entity to SigninLogs | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs. |
| TI Map IP Entity to VMConnection | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in VMConnection. |
| TI Map IP Entity to W3CIISLog | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query maps any IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in W3CIISLog. |
| TI map IP entity to Workday(ASimAuditEventLogs) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Detects a match in Workday activity from any IP Indicator of Compromise (IOC) provided by Threat Intelligence (TI). |
| TI map IP entity to GitHub_CL | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies a match in GitHub_CL table from any IP IOC from TI |
| TI Map URL Entity to AuditLogs | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in AuditLogs. |
| TI map URL entity to Cloud App Events | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | Identifies compromises and attacks and detect malicious activities in one's URL entity from TI |
| TI Map URL Entity to DeviceNetworkEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in DeviceNetworkEvents. |
| TI Map URL Entity to EmailUrlInfo | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in EmailUrlInfo. |
| TI map URL entity to Web Session Events (ASIM Web Session schema) | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This rule identifies Web Sessions where the full requested URL matches a known malicious URL from Threat Intelligence sources. The rule uses the Advanced Security Information Model (ASIM) and supports... |
| TI Map URL Entity to PaloAlto Data | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in PaloAlto Data. |
| TI Map URL Entity to SecurityAlert Data | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in SecurityAlert data. |
| TI Map URL Entity to Syslog Data | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in Syslog data. |
| TI Map URL Entity to UrlClickEvents | Analytic Rule | 📦 Solution | Threat Intelligence (NEW) | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents. |
| TI Map File Entity to OfficeActivity Event | Hunting Query | 📦 Solution | Threat Intelligence (NEW) | This query finds matches in OfficeActivity Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for huntin... |
| TI Map File Entity to Security Event | Hunting Query | 📦 Solution | Threat Intelligence (NEW) | This query finds matches in Security Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rath... |
| TI Map File Entity to Syslog Event | Hunting Query | 📦 Solution | Threat Intelligence (NEW) | This query finds matches in Syslog Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rather... |
| TI Map File Entity to VMConnection Event | Hunting Query | 📦 Solution | Threat Intelligence (NEW) | This query finds matches in VMConnection Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting ... |
| TI Map File Entity to WireData Event | Hunting Query | 📦 Solution | Threat Intelligence (NEW) | This query finds matches in WireData Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rath... |
| ThreatIntelligenceNew | Workbook | 📦 Solution | Threat Intelligence (NEW) | |
| ThreatIntelIndicatorsv2 | Parser | 📦 Solution | Threat Intelligence (NEW) | |
| DynamicThreatModeling&Response | Workbook | 📦 Solution | ThreatAnalysis&Response | |
| ThreatAnalysis&Response | Workbook | 📦 Solution | ThreatAnalysis&Response | |
| Threat Connect TI map Domain entity to DnsEvents | Analytic Rule | 📦 Solution | ThreatConnect | Identifies a match in DnsEvents from any ThreatConnect Domain IOC from TI |
| ThreatConnect TI map Email entity to OfficeActivity | Analytic Rule | 📦 Solution | ThreatConnect | Identifies a match in OfficeActivity table from any Email IOC from ThreatConnect TI |
| ThreatConnect TI map Email entity to SigninLogs | Analytic Rule | 📦 Solution | ThreatConnect | Identifies a match in SigninLogs table from any Email IOC from ThreatConnect TI |
| ThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema) | Analytic Rule | 📦 Solution | ThreatConnect | ThreatConnect Specific: This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and suppor... |
| ThreatConnect TI Map URL Entity to OfficeActivity Data | Analytic Rule | 📦 Solution | ThreatConnect | This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in OfficeActivity data. |
| ThreatConnectOverview | Workbook | 📦 Solution | ThreatConnect | |
| Block IP & URL on ThreatX-WAF cloud | Playbook | 📦 Solution | ThreatXCloud | This Playbook Provides the automation on blocking the suspicious/malicious IP and URL on ThreatX cloud waf |
| Fetch Threat Intel from ThreatX | Playbook | 📦 Solution | ThreatXCloud | This playbook provides/updates the threat intel and essential details in comments section of triggered incident so that SOC analysts can directly take corrective measure to stop the attack |
| Tomcat - Commands in URI | Analytic Rule | 📦 Solution | Tomcat | Detects commands in URI |
| Tomcat - Known malicious user agent | Analytic Rule | 📦 Solution | Tomcat | Detects known malicious user agents |
| Tomcat - Multiple client errors from single IP address | Analytic Rule | 📦 Solution | Tomcat | Detects multiple client errors from one source in short timeframe |
| Tomcat - Multiple empty requests from same IP | Analytic Rule | 📦 Solution | Tomcat | Detects multiple empty requests from same IP |
| Tomcat - Multiple server errors from single IP address | Analytic Rule | 📦 Solution | Tomcat | Detects multiple server errors from one source in short timeframe |
| Tomcat - Put file and get file from same IP address | Analytic Rule | 📦 Solution | Tomcat | Detects put or get files from one source in short timeframe |
| Tomcat - Request from localhost IP address | Analytic Rule | 📦 Solution | Tomcat | Detects request from localhost IP address. |
| Tomcat - Request to sensitive files | Analytic Rule | 📦 Solution | Tomcat | Detects request to sensitive files. |
| Tomcat - Server errors after multiple requests from same IP | Analytic Rule | 📦 Solution | Tomcat | Detects server errors after multiple requests from same IP address. |
| Tomcat - Sql injection patterns | Analytic Rule | 📦 Solution | Tomcat | Detects possible sql injection patterns |
| Tomcat - Request to forbidden file | Hunting Query | 📦 Solution | Tomcat | Query shows request to forbidden files. |
| Tomcat - Abnormal request size | Hunting Query | 📦 Solution | Tomcat | Query shows abnormal request size. |
| Tomcat - Catalina errors | Hunting Query | 📦 Solution | Tomcat | Query shows errors events. |
| Tomcat - Rare files requested | Hunting Query | 📦 Solution | Tomcat | Query shows rare files requested |
| Tomcat - Rare URLs requested | Hunting Query | 📦 Solution | Tomcat | Query shows rare URLs requested. |
| Tomcat - Top files with error requests | Hunting Query | 📦 Solution | Tomcat | Query shows list of files with error requests. |
| Tomcat - Top URLs client errors | Hunting Query | 📦 Solution | Tomcat | Query shows URLs list with client errors. |
| Tomcat - Top URLs server errors | Hunting Query | 📦 Solution | Tomcat | Query shows URLs list with server errors. |
| Tomcat - Uncommon user agent strings | Hunting Query | 📦 Solution | Tomcat | Query searches uncommon user agent strings. |
| Tomcat - Rare user agents with client errors | Hunting Query | 📦 Solution | Tomcat | Query shows rare user agent strings with client errors |
| Tomcat - Rare user agents with server errors | Hunting Query | 📦 Solution | Tomcat | Query shows rare user agent strings with server errors |
| Tomcat | Workbook | 📦 Solution | Tomcat | |
| TomcatEvent | Parser | 📦 Solution | Tomcat | |
| Notify Sentinel Incident Creation and Update to Torq Webhook | Playbook | 📦 Solution | Torq | Sends an HTTPS request to a webhook trigger in Torq everytime a new Incident is created or updated in Microsoft Sentinel |
| TrellixEvents | Parser | 📦 Solution | Trellix | |
| ApexOne - Attack Discovery Detection | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects Attack Discovery Detection events. |
| ApexOne - Suspicious commandline arguments | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects suspicious commandline arguments. |
| ApexOne - Commands in Url | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects commands in Url. |
| ApexOne - Device access permissions was changed | Analytic Rule | 📦 Solution | Trend Micro Apex One | Query shows device access permissions was changed. |
| ApexOne - Inbound remote access connection | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects inbound remote access connection. |
| ApexOne - Multiple deny or terminate actions on single IP | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects multiple deny or terminate actions on single IP. |
| ApexOne - Possible exploit or execute operation | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects possible exploit or execute operation. |
| ApexOne - C&C callback events | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects C&C callback events. |
| ApexOne - Spyware with failed response | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects spyware with failed response. |
| ApexOne - Suspicious connections | Analytic Rule | 📦 Solution | Trend Micro Apex One | Detects suspicious connections. |
| ApexOne - Behavior monitoring actions by files | Hunting Query | 📦 Solution | Trend Micro Apex One | Shows behavior monitoring actions taken for files. |
| ApexOne - Behavior monitoring operations by users | Hunting Query | 📦 Solution | Trend Micro Apex One | Shows behavior monitoring operations by users. |
| ApexOne - Behavior monitoring triggered policy by command line | Hunting Query | 📦 Solution | Trend Micro Apex One | Shows behavior monitoring triggered policy by command line. |
| ApexOne - Behavior monitoring event types by users | Hunting Query | 📦 Solution | Trend Micro Apex One | Shows behavior monitoring event types. |
| ApexOne - Channel type by users | Hunting Query | 📦 Solution | Trend Micro Apex One | Shows channel type. |
| ApexOne - Data loss prevention action by IP | Hunting Query | 📦 Solution | Trend Micro Apex One | Shows data loss prevention action by IP address. |
| ApexOne - Rare application protocols by Ip address | Hunting Query | 📦 Solution | Trend Micro Apex One | Query searches rare application protocols by Ip address. |
| ApexOne - Spyware detection | Hunting Query | 📦 Solution | Trend Micro Apex One | Query searches spyware detection events. |
| ApexOne - Suspicious files events | Hunting Query | 📦 Solution | Trend Micro Apex One | Query searches suspicious files events. |
| ApexOne - Top sources with alerts | Hunting Query | 📦 Solution | Trend Micro Apex One | Query shows list of top sources with alerts. |
| TrendMicroApexOne | Workbook | 📦 Solution | Trend Micro Apex One | |
| TMApexOneEvent | Parser | 📦 Solution | Trend Micro Apex One | |
| Trend Micro CAS - DLP violation | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects when DLP policy violation occurs. |
| Trend Micro CAS - Possible phishing mail | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects possible phishing mail. |
| Trend Micro CAS - Ransomware infection | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Triggeres when ransomware was detected. |
| Trend Micro CAS - Ransomware outbreak | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Triggeres when ransomware was detected on several accounts. |
| Trend Micro CAS - Suspicious filename | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects unexpected filename. |
| Trend Micro CAS - Threat detected and not blocked | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects when threat was not blocked by CAS solution. |
| Trend Micro CAS - Unexpected file via mail | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects when unexpected file recieved via mail. |
| Trend Micro CAS - Unexpected file on file share | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects unexpected files on file share. |
| Trend Micro CAS - Infected user | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects when malware was detected for user account. |
| Trend Micro CAS - Multiple infected users | Analytic Rule | 📦 Solution | Trend Micro Cloud App Security | Detects when same malware was detected for multiple user account. |
| Trend Micro CAS - Files stored on cloud fileshare services | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for stored on cloud fileshare services. |
| Trend Micro CAS - Infected files received via email | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for infected files received via email. |
| Trend Micro CAS - Ransomware threats | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for ransomware threats. |
| Trend Micro CAS - Rare files received via email services | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for rare files recieved via email services. |
| Trend Micro CAS - Risky users | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for users with high number of threats. |
| Trend Micro CAS - Security risk scan threats | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for threats discovered via security risk scans. |
| Trend Micro CAS - Suspicious files on sharepoint | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for suspicious files on sharepoint. |
| Trend Micro CAS - Files received via email services | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for top files recieved via email services. |
| Trend Micro CAS - DLP violations | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for DLP violations by users. |
| Trend Micro CAS - Virtual Analyzer threats | Hunting Query | 📦 Solution | Trend Micro Cloud App Security | Query searches for Virtual Analyzer threats. |
| TrendMicroCAS | Workbook | 📦 Solution | Trend Micro Cloud App Security | |
| TrendMicroCAS 🔍 | Parser | 📦 Solution | Trend Micro Cloud App Security | |
| TrendMicroDeepSecurityAttackActivity | Workbook | 📦 Solution | Trend Micro Deep Security | |
| TrendMicroDeepSecurityOverview | Workbook | 📦 Solution | Trend Micro Deep Security | |
| TrendMicroDeepSecurity | Parser | 📦 Solution | Trend Micro Deep Security | |
| TrendMicroTippingPoint | Parser | 📦 Solution | Trend Micro TippingPoint | |
| Create Incident for XDR Alerts | Analytic Rule | 📦 Solution | Trend Micro Vision One | This Query creates an incident based on Trend Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage. |
| TrendMicroXDROverview | Workbook | 📦 Solution | Trend Micro Vision One | |
| Ubiquiti - Possible connection to cryptominning pool | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects connections which may indicate that device is infected with cryptominer. |
| Ubiquiti - Connection to known malicious IP or C2 | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects allowed connections to IP addresses which are in TI list and are known to be malicious. |
| Ubiquiti - Unusual FTP connection to external server | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects local to remote (L2R) FTP connections. |
| Ubiquiti - Large ICMP to external server | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects large ICMP packets to external host. |
| Ubiquiti - connection to non-corporate DNS server | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects connections to non-corporate DNS servers. |
| Ubiquiti - Unusual DNS connection | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects unusual remote to local (R2L) DNS connections. |
| Ubiquiti - RDP from external source | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects remote to local (R2L) RDP connection. |
| Ubiquiti - SSH from external source | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects remote to local (R2L) SSH connection to internal host. |
| Ubiquiti - Unknown MAC Joined AP | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects when device with unseen MAC Address joined AP. |
| Ubiquiti - Unusual traffic | Analytic Rule | 📦 Solution | Ubiquiti UniFi | Detects unusual traffic masking as HTTP(S). |
| Ubiquiti - DNS requests timed out | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows failed DNS requests due to timeout. |
| Ubiquiti - Hidden internal DNS server | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of unaccounted internal DNS servers. |
| Ubiquiti - Rare internal ports | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of least used internal destination ports. |
| Ubiquiti - Top blocked destinations | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of top destinations connections to which were blocked by firewall. |
| Ubiquiti - Top blocked external services | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of top blocked connections to external services. |
| Ubiquiti - Top blocked internal services | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of top blocked connections to internal services. |
| Ubiquiti - Top blocked sources | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of top sources with blocked connections. |
| Ubiquiti - Top firewall rules | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of top triggered firewall rules. |
| Ubiquiti - Unusual number of subdomains for top level domain (TLD) | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query counts the number of unique subdomains for each TLD. |
| Ubiquiti - Vulnerable devices | Hunting Query | 📦 Solution | Ubiquiti UniFi | Query shows list of devices (APs) which do not have the latest version of firmware installed. |
| Ubiquiti | Workbook | 📦 Solution | Ubiquiti UniFi | |
| UbiquitiAuditEvent | Parser | 📦 Solution | Ubiquiti UniFi | |
| Anomalies on users tagged as VIP | Hunting Query | 📦 Solution | UEBA Essentials | Shows all users tagged as VIP in the VIP users watchlist that had anomalies with a score greater than 0. |
| Anomalous Microsoft Entra ID Account Creation | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not requi... |
| Anomalous Activity Role Assignment | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions. The query below generates an output of all users performing an "action" operation regard... |
| Anomalous AWS Console Login Without MFA from Uncommon Country | Hunting Query | 📦 Solution | UEBA Essentials | Detect unusual logon times, MFA fatigue, or service principal misuse across hybrid environments. Get visibility into geo-location of events and Threat Intelligence insights. Here''s an example of how ... |
| Anomalous Code Execution on a Virtual Machine | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common featu... |
| Anomalous connection from highly privileged user | Hunting Query | 📦 Solution | UEBA Essentials | Shows all users from a given department, which have a high impact on the organization, who connected to a resource for the first time and none of their peers accessed it. |
| Anomalous Database Export Activity | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may attempt to exfiltrate sensitive data by exporting databases. The query identifies users performing an "Export database" operation where one or more behavioral features deviate from the... |
| Anomalous Database Vulnerability Baseline Removal | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may disable security tools to avoid possible detection of their tools and activities. DarkComet, for example, can disable Security Center functions like anti-virus. The query below generat... |
| Anomalous Entra High-Privilege Role Modification | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accoun... |
| Anomalous Failed Logon | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard-co... |
| Anomalous First-Time Device Logon | Hunting Query | 📦 Solution | UEBA Essentials | Identifies anomalous device logon events from Microsoft Defender for Endpoint (MDE) where a user connects to a device for the first time or a device connects from a new IP address. The query filters h... |
| Anomalous GCP IAM Activity | Hunting Query | 📦 Solution | UEBA Essentials | Identifies anomalous IAM-related activities in Google Cloud Platform (GCP) Audit Logs where the investigation priority is greater than zero. This query highlights potential privilege or access anomali... |
| Anomalous Geo Location Logon | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may steal the credentials of a specific user or service account using credential access techniques or capture credentials earlier in their reconnaissance process through social engineering... |
| Anomalous High-Privileged Role Assignment | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high-privilege groups. Dragonfly 2.0, for example, added newly created accounts t... |
| Anomalous High-Score Activity Triage | Hunting Query | 📦 Solution | UEBA Essentials | Identify the highest-scoring anomalies for rapid triage using Anomalies Table. |
| Anomalous Okta First-Time or Uncommon Actions | Hunting Query | 📦 Solution | UEBA Essentials | Detects anomalous Okta activities where a user performs an action that is uncommon in the tenant or connects from a country for the first time. The query focuses on high-priority anomalies and provide... |
| Anomalous Password Reset | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may interrupt the availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed c... |
| Anomalous RDP Activity | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to mov... |
| Anomalous Resource Access | Hunting Query | 📦 Solution | UEBA Essentials | The adversary may be trying to move through the environment. APT29 and APT32, for example, have used PtH and PtT techniques to lateral move around the network. The query below generates an output of a... |
| Anomalous Sign-in by New or Dormant Account | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may steal the credentials of a specific user or service account using credential access techniques or capture credentials earlier in their reconnaissance process through social engineering... |
| Anomalous action performed in tenant by privileged user | Hunting Query | 📦 Solution | UEBA Essentials | Shows activities that have never been executed in the tenant, performed by a user with high privileges. |
| Anomaly Detection Trend Analysis | Hunting Query | 📦 Solution | UEBA Essentials | Visualizes anomaly detection trends over the past 90 days, showing daily counts of triggered anomaly templates. Use this time-series chart to identify patterns, spikes in anomalous behavior, and seaso... |
| Anomaly Template Distribution by Tactics and Techniques | Hunting Query | 📦 Solution | UEBA Essentials | Provides a statistical overview of anomaly detections over the past 30 days, grouped by template name, MITRE ATT&CK tactics, and techniques. Use this query to identify the most frequently triggered an... |
| Dormant Local Admin Logon | Hunting Query | 📦 Solution | UEBA Essentials | Adversaries may steal the credentials of a specific user or service account using credential access techniques or capture credentials earlier in their reconnaissance process through social engineering... |
| Dormant account activity from uncommon country | Hunting Query | 📦 Solution | UEBA Essentials | Shows dormant accounts (not active in the last 180 days) that connect from a country for the first time and the country is uncommon in the tenant or is the first time the ISP is used. |
| Anomalous login activity originated from Botnet, Tor proxy or C2 | Hunting Query | 📦 Solution | UEBA Essentials | Shows login activity (successful or failed) originated from botnet, Tor proxy or C2, with at least one 'True' activity insight. |
| Top Anomalous Source IP Triage | Hunting Query | 📦 Solution | UEBA Essentials | Identifies the top source IP addresses with multiple distinct anomaly templates over the past 30 days (excluding single noisy hits), then surfaces their most recent (last 24h) high-fidelity anomalous ... |
| UEBA Multi-Source Anomalous Activity Overview | Hunting Query | 📦 Solution | UEBA Essentials | Retrieves and displays anomalous activity detected across multiple identity and cloud sources (AWS CloudTrail, Okta, GCP Audit Logs, and general authentication events) using UEBA anomaly templates. Th... |
| Anomalous Key Vault Modification by High-Privilege User | Hunting Query | 📦 Solution | UEBA Essentials | Shows all Key Vault modification activities performed by high-privilege users. If the activity is performed for the first time (by the user or in the tenant) or if the activity originated from a never... |
| User-Centric Anomaly Investigation | Hunting Query | 📦 Solution | UEBA Essentials | Investigates all anomalous activities associated with a specific user account over the past 30 days, including anomaly scores, behavioral insights, source locations, and MITRE ATT&CK mappings. Customi... |
| UEBABehaviorsAnalysisWorkbook | Workbook | 📦 Solution | UEBA Essentials | |
| URLhaus-CheckHashAndEnrichIncident | Playbook | 📦 Solution | URLhaus | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. [Gets Information](https://urlhaus-api.abuse.ch/#payloadinfo) from URLhaus by has... |
| URLhaus-CheckHostAndEnrichIncident | Playbook | 📦 Solution | URLhaus | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. [Gets Information](https://urlhaus-api.abuse.ch/#payloadinfo) from URLhaus by has... |
| URLhaus-CheckURLAndEnrichIncident | Playbook | 📦 Solution | URLhaus | Once a new Microsoft Sentinel incident is created, this playbook gets triggered and performs the following actions: 1. [Gets Information](https://urlhaus-api.abuse.ch/#payloadinfo) from URLhaus by has... |
| Vaikora - Agent policy violation | Analytic Rule | 📦 Solution | Vaikora-Sentinel | Identifies AI agent actions explicitly blocked by a Vaikora policy. Repeated violations from the same agent may indicate prompt injection, policy circumvention, or a compromised workflow. |
| Vaikora - Behavioral anomaly detected | Analytic Rule | 📦 Solution | Vaikora-Sentinel | Identifies AI agent behavioral anomalies flagged by Vaikora with an anomaly score of 0.7 or above, indicating significant deviation from the agent's established behavioral baseline. |
| Vaikora - High severity AI agent action detected | Analytic Rule | 📦 Solution | Vaikora-Sentinel | Identifies AI agent actions from Vaikora classified as high or critical severity. These events may indicate an agent operating outside safe parameters or triggering policy thresholds. |
| VaikoraAgentSignalsDashboard | Workbook | 📦 Solution | Vaikora-Sentinel | |
| Valence Security Alerts | Analytic Rule | 📦 Solution | Valence Security | Valence Security Alerts |
| ValenceAlertsWorkbook | Workbook | 📦 Solution | Valence Security | |
| Valimail Enforce - Email Authentication Key Deleted | Analytic Rule | 📦 Solution | ValimailEnforce | This query searches for deletion of SPF delegations or DKIM keys, which are medium-severity events that could degrade email authentication posture for a domain. |
| Valimail Enforce - DMARC Policy Weakened to None | Analytic Rule | 📦 Solution | ValimailEnforce | This query searches for DMARC policies changed to 'none', which disables enforcement and leaves the domain vulnerable to spoofing and phishing attacks. |
| Valimail Enforce - Unusual Rate of Configuration Changes or User Additions | Analytic Rule | 📦 Solution | ValimailEnforce | This query searches for a single user performing more than 3 configuration changes or user additions within a 1-hour window on any domain. An unusual burst of changes may indicate a compromised admin ... |
| Valimail Enforce - High-Value User Management Event | Analytic Rule | 📦 Solution | ValimailEnforce | This query searches for high-severity user management events such as user deletion or deactivation in Valimail Enforce, which may indicate unauthorized access or insider threat. |
| Valimail Enforce - Bulk Domain Changes by Single User | Hunting Query | 📦 Solution | ValimailEnforce | Hunt for users who have made configuration changes to an unusually high number of domains in a short period. May indicate a compromised admin account or unauthorized bulk reconfiguration. |
| Valimail Enforce - Configuration Change Rate Trend | Hunting Query | 📦 Solution | ValimailEnforce | Hunt for configuration change and user addition activity grouped by user and domain over hourly buckets. Use this to establish baselines, spot unusual spikes, and investigate specific users or domains... |
| Valimail Enforce - DMARC Policy Change History | Hunting Query | 📦 Solution | ValimailEnforce | Hunt for all DMARC policy changes across domains over the selected time range. Helps identify domains that have had their enforcement posture changed and by whom. |
| Valimail Enforce - High Value Event Summary | Hunting Query | 📦 Solution | ValimailEnforce | Summarizes all high-value Valimail Enforce events over the selected time range, grouped by category and user. Good for periodic security reviews and baselining normal admin activity. |
| vArmour AppController - SMB Realm Traversal | Analytic Rule | 📦 Solution | vArmour Application Controller | Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms |
| vArmour_AppContoller_Workbook | Workbook | 📦 Solution | vArmour Application Controller | |
| VaronisSaaS | Workbook | 📦 Solution | VaronisSaaS | |
| Vectra AI Detect - Suspected Compromised Account | Analytic Rule | 📦 Solution | Vectra AI Detect | Create an incident when an Account is suspected to be compromised. The higher the severity level is, the more immediate attention it requires as Vectra AI engine is more confident that this is a real... |
| Vectra Account's Behaviors | Analytic Rule | 📦 Solution | Vectra AI Detect | This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. This rule is focused on account's detections. |
| Vectra AI Detect - Detections with High Severity | Analytic Rule | 📦 Solution | Vectra AI Detect | Create an incident for high severity malicious behavior detected by Vectra AI (Threat score superior to 7.0). The Severity is a mapping with the Threat score assigned to a detection. It ranges betwee... |
| Vectra AI Detect - Suspected Compromised Host | Analytic Rule | 📦 Solution | Vectra AI Detect | Create an incident when a Host is suspected to be compromised. The higher the severity level is, the more immediate attention it requires as Vectra AI engine is more confident that this is a real thr... |
| Vectra Host's Behaviors | Analytic Rule | 📦 Solution | Vectra AI Detect | This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. This rule is focused on host's detections. |
| Vectra AI Detect - New Campaign Detected | Analytic Rule | 📦 Solution | Vectra AI Detect | Identifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign. |
| Vectra AI Detect - Suspicious Behaviors by Category | Analytic Rule | 📦 Solution | Vectra AI Detect | Create an incident for each new malicious behavior detected by Vectra Detect for a specific Category. By default, it looks through all tactics. This can be modified to create incident only for a subs... |
| AIVectraDetectWorkbook | Workbook | 📦 Solution | Vectra AI Detect | |
| VectraStream_function | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_beacon | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_dcerpc | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_dhcp | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_dns | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_http | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_isession | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_kerberos | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_ldap | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_match | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_ntlm | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_radius | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_rdp | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_smbfiles | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_smbmapping | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_smtp | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_ssh | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_ssl | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_stream | Parser | 📦 Solution | Vectra AI Stream | |
| vectra_x509 | Parser | 📦 Solution | Vectra AI Stream | |
| Vectra Create Incident Based on Tag for Accounts | Analytic Rule | 📦 Solution | Vectra XDR | Create an incident when the account entity presents a specific tag. If the tag is present, an incident should be created and marked with highest priority. |
| Vectra Create Incident Based on Tag for Hosts | Analytic Rule | 📦 Solution | Vectra XDR | Create an incident when the host entity presents a specific tag. If the tag is present, an incident should be created and marked with highest priority. |
| Defender Alert Evidence | Analytic Rule | 📦 Solution | Vectra XDR | This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity... |
| Vectra Create Detection Alert for Accounts | Analytic Rule | 📦 Solution | Vectra XDR | This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monit... |
| Vectra Create Detection Alert for Hosts | Analytic Rule | 📦 Solution | Vectra XDR | This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monit... |
| Vectra Create Incident Based on Priority for Accounts | Analytic Rule | 📦 Solution | Vectra XDR | Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer... |
| Vectra Create Incident Based on Priority for Hosts | Analytic Rule | 📦 Solution | Vectra XDR | Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer... |
| VectraXDR | Workbook | 📦 Solution | Vectra XDR | |
| Vectra Download Pcap File To Storage | Playbook | 📦 Solution | Vectra XDR | This playbook enables user to download pcap file of any detections associated with a Vectra Entity to default file share of storage account. Users can provide detection ids via MS Teams AdaptiveCard. |
| Vectra Add Note To Entity | Playbook | 📦 Solution | Vectra XDR | This playbook extracts notes from incident comments and adds them to Vectra Entity if comment added in proper structure, otherwise it prompts the user for input to add note to the Vectra Entity. |
| Vectra Add Tag To Entity | Playbook | 📦 Solution | Vectra XDR | This playbook extracts tags from incident comments and adds them to the entity if comment found with proper structure, otherwise it prompts the user for tags input to add them to the Vectra Entity. |
| Vectra Add Tag To Entity All Detections | Playbook | 📦 Solution | Vectra XDR | This playbook enables user to add tags to all detections associated with a Vectra Entity. Tags can be fetched from comments of the associated incident else if no comments found, users can provide comm... |
| Vectra Add Tag To Entity Selected Detections | Playbook | 📦 Solution | Vectra XDR | This playbook enables users to add tags to selected detections associated with an entity. Users can provide inputs of detections selection and tags value via Microsoft Teams. |
| Vectra Assign Dynamic User To Entity | Playbook | 📦 Solution | Vectra XDR | This playbook will assign a user selected by user from teams adpative card to an entity in Vectra when the status of an incident changes from 'New' to 'Active'. |
| Vectra Assign Static User To Entity | Playbook | 📦 Solution | Vectra XDR | This playbook will assign a predefined user to an entity in Vectra when the status of an incident changes from 'New' to 'Active'. |
| Vectra Close Detections | Playbook | 📦 Solution | Vectra XDR | This playbook enables user to close detections associated with a Vectra Entity with reason as Remediated or Benign. User can add detection ids in comments along with the reason to close the detections... |
| Vectra Decorate Incident Based On Tag | Playbook | 📦 Solution | Vectra XDR | This playbook will add pre-defined or user customizable comment to an incident generated based on tags and add pre-defined or user customizable note to associated Vectra Entity. |
| Vectra Decorate Incident Based On Tags And Notify | Playbook | 📦 Solution | Vectra XDR | This playbook will add pre-defined or user customizable comment to an incident generated based on tags, add pre-defined or user customizable note to associated Vectra Entity and notify to Microsoft Te... |
| Vectra Dynamic Assign Member To Group | Playbook | 📦 Solution | Vectra XDR | This playbook allows users to filter the group list by providing a group type and a description. From the filtered list, users can choose a group and provide member details to add members to the group... |
| Vectra Dynamic Resolve Assignment | Playbook | 📦 Solution | Vectra XDR | When an incident is closed, This playbook will prompt the operator to select an outcome from a predefined list, choose detections to triage from associated detection IDs and name list, provide a resol... |
| Vectra Generate Access Token | Playbook | 📦 Solution | Vectra XDR | This playbook will generate access token and refresh token for another playbooks. |
| Vectra Incident Timeline Update | Playbook | 📦 Solution | Vectra XDR | This playbook will update the incident timeline by keeping most recent alerts and adding most recent detections and defender alerts from entities timeline to the incident timeline. |
| Vectra Mark Detections As Fixed | Playbook | 📦 Solution | Vectra XDR | This playbook will mark active detection as fixed associated with an entity based on choice of user provided over MS Teams. Also it adds a pre-defined but user customizable comment to an incident and ... |
| Vectra Open Closed Detections | Playbook | 📦 Solution | Vectra XDR | This playbook enables user to close opened detections associated with a Vectra Entity. User can add detection ids in comments of the associated incident else if no comments found, users can provide de... |
| Vectra Operate On Entity Source IP | Playbook | 📦 Solution | Vectra XDR | This Playbook will extract the ip from entities associated with an incident on which playbook is triggered. |
| Vectra Static Assign Member To Group | Playbook | 📦 Solution | Vectra XDR | This playbook will take input of group id and members from user via MS teams and assign members to the provided group. |
| Vectra Static Resolve Assignment | Playbook | 📦 Solution | Vectra XDR | This playbook resolves the assignment for an entity in Vectra and adds a note for the assignment when the status of an incident is changed to 'closed', and also it triages all active detections associ... |
| Vectra Update Incident Based on Tag And Notify | Playbook | 📦 Solution | Vectra XDR | This playbook runs hourly to identify entities with Medium severity incidents, checks for user-defined tags in Vectra, and if found, upgrades the incident severity to High, adds a comment, and sends a... |
| VectraAudits | Parser | 📦 Solution | Vectra XDR | |
| VectraDetections | Parser | 📦 Solution | Vectra XDR | |
| VectraEntityScoring | Parser | 📦 Solution | Vectra XDR | |
| VectraHealth | Parser | 📦 Solution | Vectra XDR | |
| VectraLockdown | Parser | 📦 Solution | Vectra XDR | |
| Adding User or Group Failed | Analytic Rule | 📦 Solution | Veeam | Detects failed attempts to add a user or user group to Veeam Backup & Replication. |
| Application Group Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when an application group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Application Group Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when application group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Archive Repository Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when an archive repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Archive Repository Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when archive repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Attempt to Delete Backup Failed | Analytic Rule | 📦 Solution | Veeam | Detects failed backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure. |
| Attempt to Update Security Object Failed | Analytic Rule | 📦 Solution | Veeam | Detects failed attempts to update security objects in Veeam Backup & Replication. Security objects include users and roles, credential records, certificates, or passwords. |
| Backup Proxy Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a backup proxy is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Backup Repository Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Backup Repository Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Best Practice Compliance Check Not Passed | Analytic Rule | 📦 Solution | Veeam | Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer. |
| Cloud Gateway Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a cloud gateway is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Cloud Gateway Pool Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a cloud gateway pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Cloud Gateway Pool Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when cloud gateway pool settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Cloud Gateway Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when cloud gateway settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Cloud Replica Permanent Failover Performed by Tenant | Analytic Rule | 📦 Solution | Veeam | Detects permanent failover of a cloud replica initiated by a tenant. This might indicate disaster recovery activity or issues with primary systems. |
| Configuration Backup Failed | Analytic Rule | 📦 Solution | Veeam | Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure. |
| Configuration Backup Job Failed | Analytic Rule | 📦 Solution | Veeam | Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure. |
| Configuration Backup Job Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when configuration backup job settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Connection to Backup Repository Lost | Analytic Rule | 📦 Solution | Veeam | Detects when a backup server fails to connect to a backup repository. |
| Credential Record Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a credential record is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Credential Record Updated | Analytic Rule | 📦 Solution | Veeam | Detects when a credential record is updated in Veeam Backup & Replication. |
| Detaching Backups Started | Analytic Rule | 📦 Solution | Veeam | Detects when a backup file is detached from a backup job. |
| Encryption Password Added | Analytic Rule | 📦 Solution | Veeam | Detects when an encryption password is added to Veeam Backup & Replication. |
| Encryption Password Changed | Analytic Rule | 📦 Solution | Veeam | Detects when an encryption password is updated in Veeam Backup & Replication. |
| Encryption Password Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when an encryption password is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| External Repository Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when an external repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| External Repository Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when external repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Failover Plan Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a failover plan is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Failover Plan Failed | Analytic Rule | 📦 Solution | Veeam | Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems. |
| Failover Plan Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when failover plan settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Failover Plan Started | Analytic Rule | 📦 Solution | Veeam | Detects when a failover plan starts. This might indicate disaster recovery activity or issues with primary systems. |
| Failover Plan Stopped | Analytic Rule | 📦 Solution | Veeam | Detects when a failover plan stops. This might indicate disaster recovery activity or issues with primary systems. |
| File Server Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a file server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| File Server Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when file server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| File Share Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a file share is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Four-Eyes Authorization Disabled | Analytic Rule | 📦 Solution | Veeam | Detects when four-eyes authorization is disabled. |
| Four-Eyes Authorization Request Created | Analytic Rule | 📦 Solution | Veeam | Detects when a four-eyes authorization request is created. |
| Four-Eyes Authorization Request Expired | Analytic Rule | 📦 Solution | Veeam | Detects when a four-eyes authorization request is expired. |
| Four-Eyes Authorization Request Rejected | Analytic Rule | 📦 Solution | Veeam | Detects when a four-eyes authorization request is rejected. |
| General Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when Veeam Backup & Replication general settings are updated. This might indicate configuration changes that require review. |
| Global Network Traffic Rules Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a global network traffic rule is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Global VM Exclusions Added | Analytic Rule | 📦 Solution | Veeam | Detects when global VM exclusion are added in Veeam Backup & Replication. |
| Global VM Exclusions Changed | Analytic Rule | 📦 Solution | Veeam | Detects when global VM exclusions are updated in Veeam Backup & Replication. |
| Global VM Exclusions Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a VM is removed from global exclusions in Veeam Backup & Replication. This might indicate unauthorized changes. |
| Host Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a host is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Host Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Hypervisor Host Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a hypervisor host is deleted from Veeam Backup & Replication. This might indicate unauthorized changes to the virtualization environment. |
| Hypervisor Host Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when hypervisor host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Invalid Code for Multi-Factor Authentication Entered | Analytic Rule | 📦 Solution | Veeam | Detects failed multi-factor authentication attempts. This might indicate credential stuffing or brute-force attacks. |
| Job Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a job is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Job No Longer Used as Second Destination | Analytic Rule | 📦 Solution | Veeam | Detects when a job used as a secondary destination is removed. |
| KMS Key Rotation Job Finished | Analytic Rule | 📦 Solution | Veeam | Detects when a KMS key rotation job is finished. |
| KMS Server Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a KMS server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| KMS Server Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when KMS server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| License Expired | Analytic Rule | 📦 Solution | Veeam | Detects when a Veeam license is expired. This could impact backup operations and data protection. |
| License Expiring | Analytic Rule | 📦 Solution | Veeam | Detects when a Veeam license expires shortly. |
| License Grace Period Started | Analytic Rule | 📦 Solution | Veeam | Detects when a Veeam license grace period starts. This might indicate potential licensing issues that need attention. |
| License Limit Exceeded | Analytic Rule | 📦 Solution | Veeam | Detects when the Veeam license limit is exceeded. |
| License Removed | Analytic Rule | 📦 Solution | Veeam | Detects when the Veeam license is removed from Veeam Backup & Replication. |
| License Support Expired | Analytic Rule | 📦 Solution | Veeam | Detects when the Veeam support contract is expired. This might impact backup operations and data protection. |
| License Support Expiring | Analytic Rule | 📦 Solution | Veeam | Detects when the Veeam support contract expires shortly. |
| Malware Activity Detected | Analytic Rule | 📦 Solution | Veeam | Detects when restore points marked as suspicious. This might indicate potential compromise of backup data. |
| Malware Detection Exclusions List Updated | Analytic Rule | 📦 Solution | Veeam | Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data. |
| Malware Detection Session Finished | Analytic Rule | 📦 Solution | Veeam | Detects when malware detection session finishes. |
| Malware Detection Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when malware detection settings are updated. |
| Malware Event Detected | Analytic Rule | 📦 Solution | Veeam | Detects when restore points are marked as infected. This might indicate potential compromise of backup data. |
| Multi-Factor Authentication Disabled | Analytic Rule | 📦 Solution | Veeam | Detects when multi-factor authentication is disabled for all users. |
| Multi-Factor Authentication for User Disabled | Analytic Rule | 📦 Solution | Veeam | Detects when multi-factor authentication is disabled for a specific user. |
| Multi-Factor Authentication Token Revoked | Analytic Rule | 📦 Solution | Veeam | Detects when a multi-factor authentication token is revoked. |
| Multi-Factor Authentication User Locked | Analytic Rule | 📦 Solution | Veeam | Detects when the allowed number of multi-factor authentication attempts is exceeded for a user. |
| NDMP Server Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when an NDMP server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Objects Added to Malware Detection Exclusions | Analytic Rule | 📦 Solution | Veeam | Detects when an object is added to malware detection exclusions. |
| Objects Deleted from Malware Detection Exclusions | Analytic Rule | 📦 Solution | Veeam | Detects when an object is deleted from malware detection exclusions. |
| Objects for Job Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when objects are deleted from the job. This might indicate unauthorized removal of critical components. |
| Objects for Protection Group Changed | Analytic Rule | 📦 Solution | Veeam | Detects when protection group objects are updated. |
| Objects for Protection Group Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when objects are deleted from a protection group. This might indicate unauthorized removal of critical components. |
| Object Marked as Clean | Analytic Rule | 📦 Solution | Veeam | Detects when an object is marked as clean. |
| Object Storage Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when an object storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Object Storage Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when object storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Preferred Networks Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a preferred network is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Protection Group Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a protection group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Protection Group Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when protection group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Recovery Token Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a recovery token is deleted. This might indicate unauthorized removal of critical components. |
| Restore Point Marked as Clean | Analytic Rule | 📦 Solution | Veeam | Detects when a restore point is marked as clean. |
| Restore Point Marked as Infected | Analytic Rule | 📦 Solution | Veeam | Detects when a restore point is marked as infected. |
| Scale-Out Backup Repository Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a scale-out backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Scale-Out Backup Repository Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when scale-out backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Service Provider Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a service provider is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Service Provider Updated | Analytic Rule | 📦 Solution | Veeam | Detects when service provider settings are updated in Veeam Backup & Replication. |
| SSH Credentials Changed | Analytic Rule | 📦 Solution | Veeam | Detects when SSH credentials are updated. |
| Storage Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Storage Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| Subtenant Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a subtenant is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Subtenant Updated | Analytic Rule | 📦 Solution | Veeam | Detects when subtenant settings are updated in Veeam Backup & Replication. |
| SureBackup Job Failed | Analytic Rule | 📦 Solution | Veeam | Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure. |
| Tape Erase Job Started | Analytic Rule | 📦 Solution | Veeam | Detects when tape erase operations start. This might indicate data destruction activity. |
| Tape Library Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a tape library is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Tape Media Pool Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a tape media pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Tape Media Vault Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a tape media vault is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Tape Medium Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a tape medium is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Tape Server Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a tape server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Tenant Password Changed | Analytic Rule | 📦 Solution | Veeam | Detects when a tenant password is updated. |
| Tenant Quota Changed | Analytic Rule | 📦 Solution | Veeam | Detects when a tenant quota is updated. |
| Tenant Quota Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a tenant quota is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Tenant Replica Started | Analytic Rule | 📦 Solution | Veeam | Detects when a tenant replica starts. |
| Tenant Replica Stopped | Analytic Rule | 📦 Solution | Veeam | Detects when a tenant replica stops. |
| Tenant State Changed | Analytic Rule | 📦 Solution | Veeam | Detects when tenant state is updated. |
| User or Group Added | Analytic Rule | 📦 Solution | Veeam | Detects when a user or user group is added to Veeam Backup & Replication. |
| User or Group Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a user or user group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Veeam ONE Application with No Recent Data Backup Sessions | Analytic Rule | 📦 Solution | Veeam | Detects applications with no recent backup sessions. |
| Veeam ONE Backup Copy RPO | Analytic Rule | 📦 Solution | Veeam | Detects Veeam ONE Backup Copy RPO violation alerts. |
| Veeam ONE Backup Server Security and Compliance State | Analytic Rule | 📦 Solution | Veeam | Detects backup server security and compliance state issues. |
| Veeam ONE Computer with No Backup | Analytic Rule | 📦 Solution | Veeam | Detects computers with no backup. |
| Veeam ONE Immutability Change Tracking | Analytic Rule | 📦 Solution | Veeam | Detects changes in Veeam ONE immutability tracking configuration. |
| Veeam ONE Immutability State | Analytic Rule | 📦 Solution | Veeam | Detects changes in the immutability state of Veeam Backup & Replication repositories. This might indicate configuration changes that require review. |
| Veeam ONE Job Disabled | Analytic Rule | 📦 Solution | Veeam | Detects when a Veeam ONE job is disabled. |
| Veeam ONE Job Disabled (Veeam Backup for Microsoft 365) | Analytic Rule | 📦 Solution | Veeam | Detects when Veeam Backup for Microsoft 365 jobs are disabled. |
| Veeam ONE Possible Ransomware Activity (Hyper-V) | Analytic Rule | 📦 Solution | Veeam | Detects Veeam ONE possible ransomware activity alerts for Microsoft Hyper-V. |
| Veeam ONE Possible Ransomware Activity (vSphere) | Analytic Rule | 📦 Solution | Veeam | Detects Veeam ONE possible ransomware activity alerts for VMware vSphere. |
| Veeam ONE Suspicious Incremental Backup Size | Analytic Rule | 📦 Solution | Veeam | Detects suspiciously large incremental backup sizes. |
| Veeam ONE Unusual Job Duration | Analytic Rule | 📦 Solution | Veeam | Detects Veeam ONE unusual job duration alerts. |
| Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365) | Analytic Rule | 📦 Solution | Veeam | Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration. |
| Veeam ONE Malware Detection Change Tracking | Analytic Rule | 📦 Solution | Veeam | Detects changes in Veeam ONE malware detection tracking. |
| Veeam ONE VM with No Backup | Analytic Rule | 📦 Solution | Veeam | Detects Veeam ONE VMs with no backup. |
| Veeam ONE VM with No Backup (Hyper-V) | Analytic Rule | 📦 Solution | Veeam | Detects Veeam ONE VMs with no backup (Hyper-V). |
| Veeam ONE VM with No Replica | Analytic Rule | 📦 Solution | Veeam | Detects Veeam ONE VMs with no replica configuration. |
| Veeam ONE VM with No Replica (Hyper-V) | Analytic Rule | 📦 Solution | Veeam | Detects Hyper-V VMs with no replica configured. |
| Virtual Lab Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a virtual lab is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| Virtual Lab Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when virtual lab settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| WAN Accelerator Deleted | Analytic Rule | 📦 Solution | Veeam | Detects when a WAN accelerator is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components. |
| WAN Accelerator Settings Updated | Analytic Rule | 📦 Solution | Veeam | Detects when WAN accelerator settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review. |
| VeeamDataPlatformMonitoring | Workbook | 📦 Solution | Veeam | |
| VeeamSecurityActivities | Workbook | 📦 Solution | Veeam | |
| Veeam-ChangeCollectionTime | Playbook | 📦 Solution | Veeam | This Microsoft Sentinel playbook adjusts the recurrence intervals for Veeam collection playbooks based on settings in the collection_schedule_settings watchlist. |
| Veeam-CollectConfigurationBackups | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook that automatically runs configuration backup sessions on Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from the wa... |
| Veeam-CollectCovewareFindings | Playbook | 📦 Solution | Veeam | This Microsoft Sentinel playbook automatically collects Coveware findings on a schedule. Retrieves Coveware settings from watchlist and calls the GetCovewareFindings function for each enabled server, ... |
| Veeam-CollectMalwareEvents | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook that automatically collects malware events from Veeam Backup & Replication servers on a schedule. The playbook gets Veeam Backup & Replication settings from watchlist and... |
| Veeam-CollectSecurityComplianceAnalyzerResult | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook that automatically collects Veeam Security Compliance Analyzer results from Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication s... |
| Veeam-CollectVeeamAuthorizationEvents | Playbook | 📦 Solution | Veeam | This Microsoft Sentinel playbook automatically collects Veeam authorization events Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from watchlist ... |
| Veeam-CollectVeeamONEAlarms | Playbook | 📦 Solution | Veeam | This Microsoft Sentinel playbook automatically collects Veeam ONE alarms on a schedule. Retrieves Veeam ONE settings from the watchlist and calls the GetVoneAlarms function for each enabled server, in... |
| Veeam-FindCleanRestorePoints | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook with the incident trigger, that finds the last clean restore point for VM, specified in the incident by VbrHostName and MachineDisplayName. If finds a clean restore point... |
| Veeam-PerformConfigurationBackupOnIncident | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook that automatically runs configuration backup session when triggered by an incident. The playbook gets Veeam Backup & Replication settings from incident custom fields, run... |
| Veeam-PerformInstantVMRecovery | Playbook | 📦 Solution | Veeam | This Microsoft Sentinel playbook performs instant VM recovery on the vm specified by MachineDisplayName custom field of Microsoft Sentinel's incident custom fields. The playbook automatically finds th... |
| Veeam-PerformScanBackup | Playbook | 📦 Solution | Veeam | This Microsoft Sentinel playbook with an incident trigger performs antivirus scan on Veeam backup using VbrHostName, BackupObjectId, MachineDisplayName custom incident fields to identify backup. Indic... |
| Veeam-ResolveTriggeredAlarm | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook with an incident trigger that resolves Veeam ONE alarms (identified by TriggeredAlarmId custom incident field) on the Veeam ONE server specified by the VoneHostName custo... |
| Veeam-SetupConnections | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook that configures Key Vault secrets and hybrid connections for Veeam servers. The playbook gets server settings and Key Vault secrets from vbr_settings and vone_settings wa... |
| Veeam-StartQuickBackup | Playbook | 📦 Solution | Veeam | A Microsoft Sentinel playbook with an incident trigger, that performs quick backup support for affected backupObject (specifided by the BackupObjectId incidents custom field) when triggered by Microso... |
| Veeam-StartSecurityComplianceAnalyzer | Playbook | 📦 Solution | Veeam | This Microsoft Sentinel playbook initiates and monitors Veeam Security and Compliance Analyzer sessions via HTTP trigger. |
| Veeam_GetFinishedConfigurationBackupSessions | Parser | 📦 Solution | Veeam | |
| Veeam_GetJobFinished | Parser | 📦 Solution | Veeam | |
| Veeam_GetSecurityEvents | Parser | 📦 Solution | Veeam | |
| Veeam_GetVeeamONEAlarms | Parser | 📦 Solution | Veeam | |
| action_results_lookup | Watchlist | 📦 Solution | Veeam | |
| coveware_settings | Watchlist | 📦 Solution | Veeam | |
| job_types_lookup | Watchlist | 📦 Solution | Veeam | |
| license_editions_lookup | Watchlist | 📦 Solution | Veeam | |
| license_types_lookup | Watchlist | 📦 Solution | Veeam | |
| operation_names_lookup | Watchlist | 📦 Solution | Veeam | |
| session_states_lookup | Watchlist | 📦 Solution | Veeam | |
| vbr_events_lookup | Watchlist | 📦 Solution | Veeam | |
| vbr_settings | Watchlist | 📦 Solution | Veeam | |
| collection_schedule_settings | Watchlist | 📦 Solution | Veeam | |
| vone_settings | Watchlist | 📦 Solution | Veeam | |
| Alarming number of anomalies generated in NetBackup | Analytic Rule | 📦 Solution | Veritas NetBackup | This rule generates an incident when an alarming number of anomalies are generated in the last 15 minutes. |
| Multiple failed attempts of NetBackup login | Analytic Rule | 📦 Solution | Veritas NetBackup | This rule generates an incident when there are more than 5 failed login attemts for a given host in the last 15 minutes. |
| Versasec CMS - Multiple Failed Login Attempts | Analytic Rule | 📦 Solution | VersasecCMS | Detects when Operator login failed to often. |
| VersasecCmsError | Parser | 📦 Solution | VersasecCMS | Structured view of Versasec CMS error events |
| VersasecCmsSyslog | Parser | 📦 Solution | VersasecCMS | Standardized parser for Versasec CMS system activities |
| URL Enrichment - Virus Total Report - Alert Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each URL entity and query VirusTotal for info (https://developers.virustotal.com/v3.0/reference#url-info). |
| URL Enrichment - Virus Total Report - Incident Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each URL entity and query VirusTotal for info (https://developers.virustotal.com/v3.0/reference#url-info). |
| IP Enrichment - Virus Total Report - Alert Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each IP entity and query VirusTotal for IP Address Report (https://developers.virustotal.com/v3.0/reference#ip-info). It will write the results to Log Analytics and add a comme... |
| IP Enrichment - Virus Total Report - Entity Trigger | Playbook | 📦 Solution | VirusTotal | This playbook will query VirusTotal Report for the selected IP Address (https://developers.virustotal.com/v3.0/reference#ip-info). The report will be added as a comment to the incident |
| IP Enrichment - Virus Total Report - Incident Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each IP entity and query VirusTotal for IP Address Report (https://developers.virustotal.com/v3.0/reference#ip-info). It will write the results to Log Analytics and add a comme... |
| FileHash Enrichment - Virus Total Report - Alert Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each File Hash entity and query VirusTotal for file report (https://developers.virustotal.com/v3.0/reference#file-info). |
| FileHash Enrichment - Virus Total Report - Incident Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each File Hash entity and query VirusTotal for file report (https://developers.virustotal.com/v3.0/reference#file-info). |
| URL Enrichment - Virus Total Domain Report - Alert Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each URL entity and query VirusTotal for Domain info (https://developers.virustotal.com/v3.0/reference#domain-info). |
| URL Enrichment - Virus Total Domain Report - Incident Triggered | Playbook | 📦 Solution | VirusTotal | This playbook will take each URL entity and query VirusTotal for Domain Report (https://developers.virustotal.com/v3.0/reference#domain-info). It will write the results to Log Analytics and add a comm... |
| VTI - High Severity Domain Collision Detection | Analytic Rule | 📦 Solution | Visa Threat Intelligence (VTI) | This will alert when a collision is detected for EmailUrlInfo events with VTI high severity domain IoCs |
| VTI - High Severity SHA1 Collision Detection | Analytic Rule | 📦 Solution | Visa Threat Intelligence (VTI) | This will alert when a collision is detected for DeviceFileEvents events with VTI high severity SHA1 IoCs |
| VTI_IOC_Feed | Workbook | 📦 Solution | Visa Threat Intelligence (VTI) | |
| VMRay URL Analyis | Playbook | 📦 Solution | VMRay | Submits a url or set of urls associated with an incident to VMRay for Analyis. |
| VMRay Email Attachment Analyis | Playbook | 📦 Solution | VMRay | Submits a attachment or set of attachment associated with an office 365 email to VMRay for Analyis. |
| Critical Threat Detected | Analytic Rule | 📦 Solution | VMware Carbon Black Cloud | This creates an incident in the event a critical threat was identified on a Carbon Black managed endpoint. |
| Known Malware Detected | Analytic Rule | 📦 Solution | VMware Carbon Black Cloud | This creates an incident when a known Malware is detected on a endpoint managed by a Carbon Black. |
| VMwareCarbonBlack | Workbook | 📦 Solution | VMware Carbon Black Cloud | |
| Endpoint enrichment - Carbon Black | Playbook | 📦 Solution | VMware Carbon Black Cloud | This playbook will collect device information from Carbon Black and post a report on the incident. |
| Isolate endpoint - Carbon Black | Playbook | 📦 Solution | VMware Carbon Black Cloud | This playbook will quarantine the host in Carbon Black. |
| Endpoint take action from Teams - Carbon Black | Playbook | 📦 Solution | VMware Carbon Black Cloud | This playbook sends an adaptive card to the SOC Teams channel, lets the analyst decide on action: Quarantine the device or Update the policy. It posts a comment on the incident with the information co... |
| VMware Cloud Web Security - Policy Publish Event | Analytic Rule | 📦 Solution | VMware SASE | This alert is capturing events when VMware CWS policies were published. During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules w... |
| VMware Cloud Web Security - Policy Change Detected | Analytic Rule | 📦 Solution | VMware SASE | This Analytics rule provides notifications when a VMware CWS policy has been modified. These alerts serve audit purposes. Policy changes might lower the level of security controls. |
| VMware Cloud Web Security - Web Access Policy Violation | Analytic Rule | 📦 Solution | VMware SASE | VMware Cloud Web Security reported access events which were violating web access policy rules. Additional investigation might be required. |
| VMware Cloud Web Security - Data Loss Prevention Violation | Analytic Rule | 📦 Solution | VMware SASE | This Analytics rule receives VMware CWS DLP alerts and combines them with their respective Web Log events. Each Data Loss Prevention event is an alert of policy violations and should be investigated. |
| VMware SD-WAN Edge - Device Congestion Alert - Packet Drops | Analytic Rule | 📦 Solution | VMware SASE | The VMware Edge Cloud Orchestrator reported an edge congestion event, where the Edge is dropping a large number of packets on one of its interfaces. This could indicate an ongoing Denial of Service at... |
| VMware SD-WAN Edge - IDS/IPS Alert triggered (Search API) | Analytic Rule | 📦 Solution | VMware SASE | The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available. This analytics rule analyses Search API streams. Search API queries r... |
| VMware SD-WAN Edge - IDS/IPS Alert triggered (Syslog) | Analytic Rule | 📦 Solution | VMware SASE | The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available. This analytics rule analyzes Syslog streams. |
| VMware SD-WAN Edge - IDS/IPS Signature Update Succeeded | Analytic Rule | 📦 Solution | VMware SASE | The VMware SD-WAN Edge Management Plane reported a successful IDS/IPS signature update. New signatures might impact Data Plane traffic, therefore an audit event is generated. |
| VMware SD-WAN Edge - IDS/IPS Signature Update Failed | Analytic Rule | 📦 Solution | VMware SASE | The VMware SD-WAN Edge Management Plane reported a failed IDS/IPS signature update. This can indicate a potential management plane issue, an Edge OS version mismatch (IDS/IPS has been introduced in re... |
| VMware SD-WAN Edge - Network Anomaly Detection - Potential Fragmentation Attack | Analytic Rule | 📦 Solution | VMware SASE | The VMware SD-WAN Edge appliance received packets potentially part of an IP Fragmentation attack or indicating an MTU mismatch. An IP fragmentation attack is a cyberattack that exploits how IP packet... |
| VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected | Analytic Rule | 📦 Solution | VMware SASE | This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge. |
| VMware SD-WAN Edge - All Cloud Security Service Tunnels DOWN | Analytic Rule | 📦 Solution | VMware SASE | This analytics rule collects events where an SD-WAN Edge reports that all Cloud Security Service (CSS) tunnels are down. Losing connectivity to a Secure Service Edge (SSE) service can impact security ... |
| VMware SD-WAN - Orchestrator Audit Event | Analytic Rule | 📦 Solution | VMware SASE | This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked. |
| VMware SD-WAN Edge - Network Anomaly Detection - RPF Check Failure | Analytic Rule | 📦 Solution | VMware SASE | The VMware SD-WAN Edge appliance received packets that failed a Reverse Path Forwarding (RPF) Check. Reverse path forwarding (RPF) check is a network security mechanism that verifies whether the sour... |
| VMware Edge Cloud Orchestrator - High number of login failures from a source IP address | Hunting Query | 📦 Solution | VMware SASE | This query identifies repeating authentication attempts (5 or higher attempts) from a single source IP. These could be failed automation or service accounts, however, it is worth investigating these e... |
| VMwareSASESOCDashboard | Workbook | 📦 Solution | VMware SASE | |
| vCenter - Root impersonation | Analytic Rule | 📦 Solution | VMware vCenter | Detects when root impersonation occurs. |
| VMware vCenter - Root login | Analytic Rule | 📦 Solution | VMware vCenter | Detects when root user login from uncommon IP address. |
| vCenter | Workbook | 📦 Solution | VMware vCenter | |
| vCenter | Parser | 📦 Solution | VMware vCenter | |
| VMware ESXi - Dormant VM started | Analytic Rule | 📦 Solution | VMWareESXi | Detects when dormant VM was started. |
| VMware ESXi - Low patch disk space | Analytic Rule | 📦 Solution | VMWareESXi | This rule is triggered when low patch disk store space is detected. |
| VMware ESXi - Low temp directory space | Analytic Rule | 📦 Solution | VMWareESXi | This rule is triggered when temp directory space is detected. |
| VMware ESXi - Multiple Failed Shell Login via SSH | Analytic Rule | 📦 Solution | VMWareESXi | Identifies a failed ESXi Shell login via SSH in a short TimeFrame. This could be suspicious activity especially if this alert is seen triggering many times within a short time frame which could be evi... |
| VMware ESXi - Multiple new VMs started | Analytic Rule | 📦 Solution | VMWareESXi | Detects when multiple new VMs were started. |
| VMware ESXi - Multiple VMs stopped | Analytic Rule | 📦 Solution | VMWareESXi | Detects when multiple VMs ware stopped by user. |
| VMware ESXi - New VM started | Analytic Rule | 📦 Solution | VMWareESXi | Detects when new VM was started. |
| VMware ESXi - Root impersonation | Analytic Rule | 📦 Solution | VMWareESXi | Detects when root impersonation occurs. |
| VMware ESXi - Root login | Analytic Rule | 📦 Solution | VMWareESXi | Detects when root user login from uncommon IP address. |
| VMware ESXi - Root password changed | Analytic Rule | 📦 Solution | VMWareESXi | Detects when root user password is changed. |
| VMware ESXi - Shared or stolen root account | Analytic Rule | 📦 Solution | VMWareESXi | Detects when shared or stolen root account. |
| VMware ESXi - SSH Enable on ESXi Host | Analytic Rule | 📦 Solution | VMWareESXi | Detects when vim-cmd is used to enable SSH on an ESXi host |
| VMware ESXi - Unexpected disk image | Analytic Rule | 📦 Solution | VMWareESXi | Detects unexpected disk image for VM. |
| VMware ESXi - VM stopped | Analytic Rule | 📦 Solution | VMWareESXi | Detects when VM was stopped. |
| VMware ESXi - List of dormant users. | Hunting Query | 📦 Solution | VMWareESXi | Query searches for dormant user dormant. |
| VMware ESXi - Download errors | Hunting Query | 📦 Solution | VMWareESXi | Query searches for download errors. |
| VMware ESXi - NFC download activities | Hunting Query | 📦 Solution | VMWareESXi | Query searches for download activities. |
| VMware ESXi - Root logins failures | Hunting Query | 📦 Solution | VMWareESXi | Query searches for failed root logins. |
| VMware ESXi - Root logins | Hunting Query | 📦 Solution | VMWareESXi | Query searches for root logins. |
| VMware ESXi - List of unused VMs | Hunting Query | 📦 Solution | VMWareESXi | Query searches for unused VMs. |
| VMware ESXi - List of virtual disks (images) | Hunting Query | 📦 Solution | VMWareESXi | Query searches for virtual disks (images) seen for VM. |
| VMware ESXi - VM high resource load | Hunting Query | 📦 Solution | VMWareESXi | Query searches for VMs with high resource consumption. |
| VMware ESXi - List of powered off VMs | Hunting Query | 📦 Solution | VMWareESXi | Query searches for powered off VMs. |
| VMware ESXi - List of powered on VMs | Hunting Query | 📦 Solution | VMWareESXi | Query searches for powered on VMs. |
| VMWareESXi | Workbook | 📦 Solution | VMWareESXi | |
| VMwareESXi | Parser | 📦 Solution | VMWareESXi | |
| Votiro - File Blocked from Connector | Analytic Rule | 📦 Solution | Votiro | The analytic rule is intended to detect when a file is blocked by Votiro Sanitization Engine due to a specific policy, and notify the appropriate parties so that they can take appropriate action. The ... |
| Votiro - File Blocked in Email | Analytic Rule | 📦 Solution | Votiro | The analytic rule is designed to identify when an email is blocked by Votiro Sanitization Engine policy. The rule generates an alert when an email is blocked after Sanitization process which is not pa... |
| Votiro Monitoring Dashboard | Workbook | 📦 Solution | Votiro | |
| WatchGuardFirebox 🔍 | Parser | 📦 Solution | Watchguard Firebox | |
| Watchlist - close incidents with safe IPs | Playbook | 📦 Solution | Watchlists Utilities | This playbook leverages Microsoft Sentinel Watchlists in order to close incidents which include IP addresses considered safe. |
| Watchlists - Inform Subscription Owner | Playbook | 📦 Solution | Watchlists Utilities | This playbook leverages Microsoft Sentinel Watchlists in order to get the relevant subscription owner contact details, and inform about an ASC alert that occured in that subscription. It uses Microsof... |
| Watchlist - Change Incident Severity and Title if User VIP - Alert Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook leverages Microsoft Sentinel Watchlists in order to adapt the incidents severity which include User entity and check it against VIP user list. |
| Watchlist - Change Incident Severity and Title if User VIP - Incident Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook leverages Microsoft Sentinel Watchlists in order to adapt the incidents severity which include User entity and check it against VIP user list |
| Add User To Watchlist - Alert Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a user entity from the alert to a new or existing watchlist. |
| Add User To Watchlist - Incident Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a User entity to a new or existing watchlist. |
| Add URL To Watchlist - Alert Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a URL entity from the alert to a new or existing watchlist. |
| Add URL To Watchlist - Incident Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a URL entity to a new or existing watchlist. |
| Add IP To Watchlist - Alert Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a IP entity from the alert to a new or existing watchlist. |
| Add IP To Watchlist - Incident Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a IP entity to a new or existing watchlist. |
| Add Host To Watchlist - Alert Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a host entity from the alert to a new or existing watchlist. |
| Add Host To Watchlist - Incident Trigger | Playbook | 📦 Solution | Watchlists Utilities | This playbook will add a Host entity to a new or existing watchlist. |
| Detect URLs containing known malicious keywords or commands (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | The utilization of system commands or functions in the request URL may suggest that an attacker is trying to gain unauthorized access to the environment by exploiting a vulnerable service. |
| Detect unauthorized data transfers using timeseries anomaly (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This query utilizes built-in KQL anomaly detection algorithms to identify anomalous data transfers to public networks. It detects significant deviations from a baseline pattern, allowing the detection... |
| The download of potentially risky files from the Discord Content Delivery Network (CDN) (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This detection mechanism identifies instances where requests are made to Discord CDN addresses for file extensions that are considered risky. It triggers when a callout is made to a Discord server t... |
| Detect known risky user agents (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This rule is designed to flag web requests that contain a user agent header that is recognized as malicious. It relies on a predefined list of known user agents, which is referenced from a specific CS... |
| Detect Local File Inclusion(LFI) in web requests (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privilege... |
| Detect instances of multiple client errors occurring within a brief period of time (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This detection mechanism identifies situations where multiple client errors originate from a single source within a limited time frame. |
| Detect instances of multiple server errors occurring within a brief period of time (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This detection mechanism identifies situations where multiple server errors originate from a single source within a limited time frame. |
| Identify instances where a single source is observed using multiple user agents (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This detection mechanism identifies requests originating from a single source within a brief time period that exhibit multiple user agents. Such behavior could indicate unusual web browsing activities... |
| Detect potential presence of a malicious file with a double extension (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | Double extension vulnerability is a significant concern in file uploads, as it can lead to various issues if an attacker successfully uploads a virus-infected file. |
| Detect potential file enumeration activity (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This detection method identifies potential cases of file enumeration activity. The query is designed to identify client sources that generate multiple requests resulting in 404 error codes |
| Detect presence of private IP addresses in URLs (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This rule identifies requests made to atypical URLs, as malware can exploit IP addresses for communication with command-and-control (C2) servers. The detection identifies network requests that contain... |
| Detect requests for an uncommon resources on the web (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This detection mechanism examines connections made to a domain where only a single file is requested, which is considered unusual since most contemporary web applications require additional resources.... |
| Detect presence of uncommon user agents in web requests (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This rule assists in detecting rare user agents, which may indicate web browsing activity by an unconventional process different from the usual ones. The rule specifically searches for UserAgent strin... |
| Detect web requests to potentially harmful files (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This rule detects web requests made to URLs containing file types such as .ps1, .bat, .vbs,.scr etc. which have the potential to be harmful if downloaded. This rule uses the [Advanced Security Informa... |
| Detect threat information in web requests (ASIM Web Session) | Analytic Rule | 📦 Solution | Web Session Essentials | This rule would generate an alert if EvenSeverity is 'High' or 'ThreatRiskLevel' or 'ThreatOriginalConfidence' value is greater than 90. |
| Empty User Agent Detected (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | This rule helps to identify instances of empty user agent requests originating from IP addresses that have previously reported user agent at least once within the same time period. |
| Excessive number of forbidden requests detected (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | This rule detects abnormal number of 403 errors from clients. HTTP 403 is returned when the client is not permitted access to the resource despite providing authentication in case such as when authent... |
| Detect IPAddress in the requested URL (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | This rule detects IPAddress in the requested URL |
| Detect Kali Linux UserAgent (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | This rule helps to detect usage of Kali Linux in your environment. Attackers might utilize Kali Linux's tools and features for unauthorized penetration testing, reconnaissance, or exploitation attempt... |
| Beaconing traffic based on common user agents visiting limited number of domains (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | This query searches web proxy logs for a specific type of beaconing behavior by caparing with a known request pattern. |
| Potential beaconing detected - Similar sent bytes (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | Calculate the number of SrcBytes (Sent bytes) for each unique combination of SrcIpAddress and DstIpAddress within a 24-hour timeframe. The presence of a high count of repetitive identical SrcBytes cou... |
| Potential beaconing detected (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | Identifies beaconing patterns from web traffic logs based on recurrent timedelta patterns. Reference Blog: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/detect-network-beaconing-via-i... |
| Request from bots and crawlers (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | While most of these values are associated with legitimate bots or crawlers, malicious actors may sometimes spoof or manipulate user agent headers to disguise their activities. It is important to inves... |
| Detect threat information in web requests (ASIM Web Session) | Hunting Query | 📦 Solution | Web Session Essentials | This query identifies the presence of threat information in fields such as EventSeverity, ThreatName, and ThreatCategory |
| WebSessionEssentials | Workbook | 📦 Solution | Web Session Essentials | |
| Summarize Web Session Data | Playbook | 📦 Solution | Web Session Essentials | The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Sessi... |
| Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts | Analytic Rule | 📦 Solution | Web Shells Threat Protection | Takes Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts where web scripts are present in the evidence and correlates with requests made to those scripts in the WCSIISLog to surf... |
| Identify SysAid Server web shell creation | Analytic Rule | 📦 Solution | Web Shells Threat Protection | This query looks for potential webshell creation by the threat actor Mercury after the sucessful exploitation of SysAid server. Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-... |
| SUPERNOVA webshell | Analytic Rule | 📦 Solution | Web Shells Threat Protection | Identifies SUPERNOVA webshell based on W3CIISLog data. References: - https://unit42.paloaltonetworks.com/solarstorm-supernova/ |
| Exchange IIS Worker Dropping Webshells | Hunting Query | 📦 Solution | Web Shells Threat Protection | This query checks for the IIS worker process dropping files that resemble web shells and other artifacts seen in known attacks. Reference: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-... |
| Possible webshell drop | Hunting Query | 📦 Solution | Web Shells Threat Protection | This query searches for files with common web page content extensions created by IIS or Apache that could run arbitrary code. It includes a throttling mechanism to reduce false positive detections for... |
| Webshell Detection | Hunting Query | 📦 Solution | Web Shells Threat Protection | Web shells are scripts that allow remote administration when uploaded to a web server. This query can detect web shells using GET requests by searching for keywords in URL strings. |
| Possible Webshell usage attempt related to SpringShell(CVE-2022-22965) | Hunting Query | 📦 Solution | Web Shells Threat Protection | This query searches Azure Web Application Firewall data for potential Webshell usage related to the SpringShell RCE vulnerability (CVE-2022-22965). For more information refer to Microsoft's security b... |
| UMWorkerProcess Creating Webshell | Hunting Query | 📦 Solution | Web Shells Threat Protection | This query detects unusual file content created by UMWorkerProcess, indicating exploitation of CVE-2021-26858 to generate a web shell. More related queries can be found on the Microsoft Security Respo... |
| Web Shell Activity | Hunting Query | 📦 Solution | Web Shells Threat Protection | This query detects web shells by analyzing the distribution of commonly-used scripts against regular scripts for public client IPs with no W3CIIS activity in a fixed lookback period. |
| WindowsFirewall | Workbook | 📦 Solution | Windows Firewall | |
| Caramel Tsunami Actor IOC - July 2021 | Analytic Rule | 📦 Solution | Windows Forwarded Events | Identifies a match across IOC's related to an actor tracked by Microsoft as Caramel Tsunami |
| Chia_Crypto_Mining IOC - June 2021 | Analytic Rule | 📦 Solution | Windows Forwarded Events | Identifies a match across IOC's related to Chia cryptocurrency farming/plotting activity |
| Progress MOVEIt File transfer above threshold 🔍 | Analytic Rule | 📦 Solution | Windows Forwarded Events | Identifies Progress MOVEIt File Transfers above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we ... |
| Progress MOVEIt File transfer folder count above threshold 🔍 | Analytic Rule | 📦 Solution | Windows Forwarded Events | Identifies Progress MOVEIt File Transfers with distinct folder count above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a s... |
| ADFS Database Named Pipe Connection | Analytic Rule | 📦 Solution | Windows Security Events | This detection uses Sysmon telemetry to detect suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). In order to use this query you need to be ... |
| AD FS Remote Auth Sync Connection | Analytic Rule | 📦 Solution | Windows Security Events | This detection uses Security events from the "AD FS Auditing" provider to detect suspicious authentication events on an AD FS server. The results then get correlated with events from the Windows Filte... |
| AD FS Remote HTTP Network Connection | Analytic Rule | 📦 Solution | Windows Security Events | This detection uses Sysmon events (NetworkConnect events) to detect incoming network traffic on port 80 on AD FS servers. This could be a sign of a threat actor trying to use replication services on t... |
| Excessive Windows Logon Failures | Analytic Rule | 📦 Solution | Windows Security Events | This query identifies user accounts which has over 50 Windows logon failures today and at least 33% of the count of logon failures over the previous 7 days. |
| Exchange OAB Virtual Directory Attribute Containing Potential Webshell | Analytic Rule | 📦 Solution | Windows Security Events | This query uses Windows Event ID 5136 in order to detect potential webshell deployment by exploitation of CVE-2021-27065. This query looks for changes to the InternalHostName or ExternalHostName prope... |
| Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task | Analytic Rule | 📦 Solution | Windows Security Events | This query detects instances where an attacker has gained the ability to execute code on an ADFS Server through SMB and Remote Service or Scheduled Task. |
| Microsoft Entra ID Local Device Join Information and Transport Key Registry Keys Access | Analytic Rule | 📦 Solution | Windows Security Events | This detection uses Windows security events to detect suspicious access attempts by the same process to registry keys that provide information about an Microsoft Entra ID joined or registered devices ... |
| SecurityEvent - Multiple authentication failures followed by a success | Analytic Rule | 📦 Solution | Windows Security Events | Identifies accounts who have failed to logon to the domain multiple times in a row, followed by a successful authentication within a short time frame. Multiple failed attempts followed by a success ca... |
| New EXE deployed via Default Domain or Default Domain Controller Policies | Analytic Rule | 📦 Solution | Windows Security Events | This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice i... |
| Non Domain Controller Active Directory Replication | Analytic Rule | 📦 Solution | Windows Security Events | This query detects potential attempts by non-computer accounts (non domain controllers) to retrieve/synchronize an active directory object leveraging directory replication services (DRS). A Domain Con... |
| NRT Base64 Encoded Windows Process Command-lines | Analytic Rule | 📦 Solution | Windows Security Events | This detection identifies instances of a base64 encoded PE file header seen in the process command line parameter. |
| NRT Process executed from binary hidden in Base64 encoded file | Analytic Rule | 📦 Solution | Windows Security Events | Encoding malicious software is a technique used to obfuscate files from detection. The first CommandLine component is looking for Python decoding base64. The second CommandLine component is looking fo... |
| NRT Security Event log cleared | Analytic Rule | 📦 Solution | Windows Security Events | Checks for event id 1102 which indicates the security event log was cleared. It uses Event Source Name "Microsoft-Windows-Eventlog" to avoid generating false positives from other sources, like AD FS s... |
| AD user enabled and password not set within 48 hours | Analytic Rule | 📦 Solution | Windows Security Events | Identifies when an account is enabled with a default password and the password is not set by the user within 48 hours. Effectively, there is an event 4722 indicating an account was enabled and within ... |
| Potential Fodhelper UAC Bypass | Analytic Rule | 📦 Solution | Windows Security Events | This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process w... |
| Potential re-named sdelete usage | Analytic Rule | 📦 Solution | Windows Security Events | This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C driv... |
| Scheduled Task Hide | Analytic Rule | 📦 Solution | Windows Security Events | This query detects attempts by malware to hide the scheduled task by deleting the SD (Security Descriptor) value. Removal of SD value results in the scheduled task disappearing from schtasks /query an... |
| Sdelete deployed via GPO and run recursively | Analytic Rule | 📦 Solution | Windows Security Events | This query looks for the Sdelete process being run recursively after being deployed to a host via GPO. Attackers could use this technique to deploy Sdelete to multiple host and delete data on them. |
| Starting or Stopping HealthService to Avoid Detection | Analytic Rule | 📦 Solution | Windows Security Events | This query detects events where an actor is stopping or starting HealthService to disable telemetry collection/detection from the agent. The query requires a SACL to audit for access request to the s... |
| Process Execution Frequency Anomaly | Analytic Rule | 📦 Solution | Windows Security Events | This detection identifies anomalous spike in frequency of executions of sensitive processes which are often leveraged as attack vectors. The query leverages KQL's built-in anomaly detection algorithms... |
| AD Account Lockout | Hunting Query | 📦 Solution | Windows Security Events | Detects Active Directory account lockouts |
| Commands executed by WMI on new hosts - potential Impacket | Hunting Query | 📦 Solution | Windows Security Events | Query identifies hosts with WMI command runs, absent in last 7 days and filters for Impacket wmiexec arguments. Impacket filters can be adjusted for targeted hunting. |
| Crash dump disabled on host | Hunting Query | 📦 Solution | Windows Security Events | This detection looks the prevention of crash dumps being created. This can be used to limit reporting by malware, look for suspicious processes setting this registry key. |
| Domain controller installation media creation | Hunting Query | 📦 Solution | Windows Security Events | This hunting query helps to detect attempts to create installation media from domain controllers, either remotely or locally using a commandline tool called ntdsutil. These media are intended to be us... |
| Cscript script daily summary breakdown | Hunting Query | 📦 Solution | Windows Security Events | breakdown of scripts running in the environment |
| VIP account more than 6 failed logons in 10 | Hunting Query | 📦 Solution | Windows Security Events | VIP Account with more than 6 failed logon attempts in 10 minutes, include your own VIP list in the table below NTSTATUS codes - https://docs.microsoft.com/openspecs/windows_protocols/ms-erref/596a107... |
| Decoy User Account Authentication Attempt | Hunting Query | 📦 Solution | Windows Security Events | The query detects authentication attempts from a decoy user account. A decoy user account is explicitly created and monitored to alert the SOC, indicating a malicious activity when the account is in ... |
| Discord download invoked from cmd line | Hunting Query | 📦 Solution | Windows Security Events | This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware del... |
| Enumeration of users and groups | Hunting Query | 📦 Solution | Windows Security Events | Finds attempts to list users or groups using the built-in Windows 'net' tool |
| Exchange PowerShell Snapin Added | Hunting Query | 📦 Solution | Windows Security Events | The Exchange Powershell Snapin was loaded on a host, this allows for a Exchange server management via PowerShell. Whilst this is a legitimate administrative tool it is abused by attackers to performs ... |
| Summary of failed user logons by reason of failure | Hunting Query | 📦 Solution | Windows Security Events | A summary of failed logons can be used to infer lateral movement with the intention of discovering credentials and sensitive data |
| Group added to Built in Domain Local or Global Group | Hunting Query | 📦 Solution | Windows Security Events | A Group created in the last 7 days was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expe... |
| Host Exporting Mailbox and Removing Export | Hunting Query | 📦 Solution | Windows Security Events | Query detects mailbox exports from on-prem Exchange servers, followed by export removal from same host within a short time window. This is a common attack pattern used by attackers when exfiltrating e... |
| Hosts with new logons | Hunting Query | 📦 Solution | Windows Security Events | Shows new accounts that have logged onto a host for the first time - this may clearly be benign activity but an account logging onto multiple hosts for the first time can also be used to look for evid... |
| Establishing internal proxies | Hunting Query | 📦 Solution | Windows Security Events | This hunting query helps to detect attempts to create proxies on compromised systems using the built-in netsh portproxy command. VoltTyphoon has been seen creating these proxies on compromised hosts... |
| Invoke-PowerShellTcpOneLine Usage. | Hunting Query | 📦 Solution | Windows Security Events | Invoke-PowerShellTcpOneLine is a PowerShell script to create a simple and small reverse shell. It can be abused by attackers to exfiltrate data. This query looks for command line activity similar to I... |
| KrbRelayUp Local Privilege Escalation Service Creation | Hunting Query | 📦 Solution | Windows Security Events | This query detects the default service name created by KrbRelayUp. KrbRelayUp is Local Privilege Escalation tool that combine features of Rubeus and KrbRelay. |
| Least Common Parent And Child Process Pairs | Hunting Query | 📦 Solution | Windows Security Events | Looks across your environment for least common Parent/Child process combinations. Will possibly find some malicious activity disguised as well known process names. By ZanCo |
| Least Common Processes by Command Line | Hunting Query | 📦 Solution | Windows Security Events | Looks across your environment for least common Process Command Lines, may be noisy and require allowlisting. By ZanCo |
| Least Common Processes Including Folder Depth | Hunting Query | 📦 Solution | Windows Security Events | Looks across your environment for least common Process Command Lines, may be noisy and require allowlisting. By ZanCo |
| Masquerading files | Hunting Query | 📦 Solution | Windows Security Events | Malware writers often use windows system process names like svchost.exe to hide malicious activities. Query searches for execution of process svchost.exe, filtering out execution by well-known SIDs an... |
| Potential Exploitation of MS-RPRN printer bug | Hunting Query | 📦 Solution | Windows Security Events | This query detects potential attempts to remotely access to the print spooler service on Active Directory Domain Controllers which could indicate an exploitation of MS-RPRN printer bug from a server t... |
| Multiple Explicit Credential Usage - 4648 events | Hunting Query | 📦 Solution | Windows Security Events | Query identifies credential abuse across hosts, using Security Event 4648 to detect multiple account connections to various machines, indicative of Solorigate-like patterns. |
| New Child Process of W3WP.exe | Hunting Query | 📦 Solution | Windows Security Events | Hunting Query detects unusual child processes of w3wp.exe not seen in 14 days, signaling potential web server compromise and web shell installation. |
| New processes observed in last 24 hours | Hunting Query | 📦 Solution | Windows Security Events | New processes in stable environments may indicate malicious activity. Analyzing logon sessions where these binaries ran can help identify attacks. |
| Nishang Reverse TCP Shell in Base64 | Hunting Query | 📦 Solution | Windows Security Events | This query searches for Base64-encoded commands associated with the Nishang reverse TCP shell. Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1 |
| Summary of users created using uncommon/undocumented commandline switches | Hunting Query | 📦 Solution | Windows Security Events | Summarizes uses of uncommon & undocumented commandline switches to create user accounts. User accounts may be created to achieve persistence on a machine. |
| Powercat Download | Hunting Query | 📦 Solution | Windows Security Events | Powercat is a PowerShell implementation of netcat. Whilst it can be used as a legitimate administrative tool it can be abused by attackers to exfiltrate data. This query looks for command line activit... |
| PowerShell downloads | Hunting Query | 📦 Solution | Windows Security Events | Finds PowerShell execution events that could involve a download |
| New PowerShell scripts encoded on the commandline | Hunting Query | 📦 Solution | Windows Security Events | Identify and decode new encoded powershell scripts this week versus previous 14 days |
| Entropy for Processes for a given Host | Hunting Query | 📦 Solution | Windows Security Events | Query tracks rare processes on hosts, using entropy to highlight unusual activity. Lower Weight/ProcessEntropy scores suggest higher interest. |
| Rare Processes Run by Service Accounts | Hunting Query | 📦 Solution | Windows Security Events | Service accounts normally are supposed to perform a limited set of tasks in a stable environment. The query collects a list of service account and then joins them with rare processes in an environment... |
| Rare Process Path | Hunting Query | 📦 Solution | Windows Security Events | Identifies when a process is running from a rare path. This could indicate malicious or unexpected activity as attacks often try to use common process names running from non-standard locations |
| Hosts Running a Rare Process with Commandline | Hunting Query | 📦 Solution | Windows Security Events | This query searches for hosts running a rare process. A rare process has execution requency of less than 1% of the average for 30 days and less than a count of 100 on a given host or less than a 14 co... |
| Hosts Running a Rare Process | Hunting Query | 📦 Solution | Windows Security Events | This query searches for hosts running a rare process. A rare process has execution requency of less than 1% of the average for 30 days and less than a count of 100 on a given host or less than a 14 co... |
| Remote Task Creation/Update using Schtasks Process | Hunting Query | 📦 Solution | Windows Security Events | This query detects a scheduled task, created/updated remotely, using the Schtasks process. |
| Service installation from user writable directory | Hunting Query | 📦 Solution | Windows Security Events | This query detects a service installation that is originated from a user writable directory. Ref: https://attack.mitre.org/techniques/T1569/002/ |
| Suspected LSASS Dump | Hunting Query | 📦 Solution | Windows Security Events | Look for evidence of the LSASS process being dumped either using Procdump or comsvcs.dll. Often used by attackers to access credentials stored on a system. |
| Suspicious command line tokens in LolBins or LolScripts | Hunting Query | 📦 Solution | Windows Security Events | This query identifies Microsoft-signed Binaries and Scripts that are not system initiated. This technique is commonly used in phishing attacks. |
| Suspicious Enumeration using Adfind Tool | Hunting Query | 📦 Solution | Windows Security Events | Query detects Adfind tool use for domain reconnaissance, regardless of executable name, focusing on DC and ADFS servers, to spot potential adversary activity. |
| Suspicious Windows Login Outside Normal Hours | Hunting Query | 📦 Solution | Windows Security Events | Query identifies unusual logon events outside a user's normal hours by comparing with the last 14 days' logon activity, flagging anomalies based on historical patterns. |
| Uncommon processes - bottom 5% | Hunting Query | 📦 Solution | Windows Security Events | Query highlights uncommon, rare process runs, to flag new potentially unauthorized binaries in stable environments for potential attack detection. |
| Summary of user logons by logon type | Hunting Query | 📦 Solution | Windows Security Events | Comparing succesful and nonsuccessful logon attempts can be used to identify attempts to move laterally within the environment with the intention of discovering credentials and sensitive data. |
| User Account added to Built in Sensitive or Privileged Domain Local or Global Group | Hunting Query | 📦 Solution | Windows Security Events | User account was added to a privileged built in domain local group or global group such as the Enterprise Adminis, Cert Publishers or DnsAdmins Be sure to verify this is an expected addition. |
| Long lookback User Account Created and Deleted within 10mins | Hunting Query | 📦 Solution | Windows Security Events | User account created and then deleted within 10 minutes across last 14 days |
| User account added or removed from a security group by an unauthorized user | Hunting Query | 📦 Solution | Windows Security Events | User account added or removed from a security group by an unauthorized user, pass in a list |
| User created by unauthorized user | Hunting Query | 📦 Solution | Windows Security Events | User account created by an unauthorized user, pass in a list |
| VIP account more than 6 failed logons in 10 | Hunting Query | 📦 Solution | Windows Security Events | VIP Account with more than 6 failed logon attempts in 10 minutes, include your own VIP list in the table below |
| Windows System Shutdown/Reboot(Sysmon) | Hunting Query | 📦 Solution | Windows Security Events | This hunting query uses Sysmon telemetry to detect System Shutdown/Reboot (MITRE Technique: T1529). |
| Windows System Time changed on hosts | Hunting Query | 📦 Solution | Windows Security Events | Identifies when the system time was changed on a Windows host which can indicate potential timestomping activities. |
| EventAnalyzer | Workbook | 📦 Solution | Windows Security Events | |
| IdentityAndAccess | Workbook | 📦 Solution | Windows Security Events | |
| Potential DGA detected | Analytic Rule | 📦 Solution | Windows Server DNS | Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). Alerts are generated when a new IP address is seen ... |
| Rare client observed with high reverse DNS lookup count | Analytic Rule | 📦 Solution | Windows Server DNS | Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity. Alerts are generated if the IP performing such reverse DNS lookups was not seen doing... |
| DNS events related to mining pools | Analytic Rule | 📦 Solution | Windows Server DNS | Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools. |
| DNS events related to ToR proxies | Analytic Rule | 📦 Solution | Windows Server DNS | Identifies IP addresses performing DNS lookups associated with common ToR proxies. |
| NRT DNS events related to mining pools | Analytic Rule | 📦 Solution | Windows Server DNS | Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools. |
| DNS lookups for commonly abused TLDs | Hunting Query | 📦 Solution | Windows Server DNS | Some top level domains (TLDs) are more commonly associated with malware for a range of reasons - including how easy domains on these TLDs are to obtain. Many of these may be undesirable from an ente... |
| DNS - domain anomalous lookup increase | Hunting Query | 📦 Solution | Windows Server DNS | Checking for a threefold increase or more of domain lookups per client IP address for the current day compared to the daily average for the previous week. This can potentially identify excessive traff... |
| DNS Full Name anomalous lookup increase | Hunting Query | 📦 Solution | Windows Server DNS | Checking for a threefold increase or more in Full Name lookups per Client IP for the current day as compared to the daily average for the previous week. This can potentially identify excessive traffic... |
| Potential DGA detected | Hunting Query | 📦 Solution | Windows Server DNS | Clients with a high NXDomain count could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). Based on quartile percent analysis algorithm. |
| High reverse DNS count by host | Hunting Query | 📦 Solution | Windows Server DNS | Clients with a high reverse DNS count could be carrying out reconnaissance or discovery activity. |
| Abnormally long DNS URI queries | Hunting Query | 📦 Solution | Windows Server DNS | The length of a DNS query can often be an indicator of suspicious activity. Typical domain name lengths are short, whereas the domain name query used for data exfiltration or tunneling can often be ve... |
| DNS Domains linked to WannaCry ransomware campaign | Hunting Query | 📦 Solution | Windows Server DNS | Displays the client DNS request for any of the known domains linked to WannaCry. These results may indicate a Wannacry/Wannacrypt ransomware infection. Reference: Domain listing from https://pastebin.... |
| Solorigate DNS Pattern | Hunting Query | 📦 Solution | Windows Server DNS | Looks for the DGA pattern of the domain associated with Solorigate in order to find other domains with the same activity pattern. |
| Solorigate Encoded Domain in URL | Hunting Query | 📦 Solution | Windows Server DNS | Looks for a logon domain seen in Azure AD logs appearing in a DNS query encoded with the DGA encoding used in the Solorigate incident. Reference: https://blogs.microsoft.com/on-the-issues/2020/12/13/c... |
| Dns | Workbook | 📦 Solution | Windows Server DNS | |
| WithSecureTopComputersByInfections | Workbook | 📦 Solution | WithSecureElementsViaFunction | |
| WizFindings | Workbook | 📦 Solution | Wiz | |
| Workplace_Facebook 🔍 | Parser | 📦 Solution | Workplace from Facebook | |
| XbowCriticalHighFindings | Analytic Rule | 📦 Solution | XBOW | Creates an incident for each Critical or High severity finding reported by XBOW that is currently in an open state. These findings represent the most severe security issues and require immediate atten... |
| XbowLowFindings | Analytic Rule | 📦 Solution | XBOW | Creates an incident for each Low severity finding reported by XBOW that is currently in an open state. These findings represent minor security issues or best-practice violations that should be address... |
| XbowMediumFindings | Analytic Rule | 📦 Solution | XBOW | Creates an incident for each Medium severity finding reported by XBOW that is currently in an open state. These findings represent moderate security risks that should be addressed in a timely manner. ... |
| XbowNewAssetDiscovered | Analytic Rule | 📦 Solution | XBOW | Alerts when a new asset is registered in XBOW for the first time. This is detected by matching assets whose CreatedAt timestamp falls within the current query window, indicating the asset was newly ad... |
| ZeroFox Alerts - High Severity Alerts | Analytic Rule | 📦 Solution | ZeroFox | Detects high severity alerts from ZeroFox |
| ZeroFox Alerts - Informational Severity Alerts | Analytic Rule | 📦 Solution | ZeroFox | Detects informational severity alerts from ZeroFox |
| ZeroFox Alerts - Low Severity Alerts | Analytic Rule | 📦 Solution | ZeroFox | Detects low severity alerts from ZeroFox |
| ZeroFox Alerts - Medium Severity Alerts | Analytic Rule | 📦 Solution | ZeroFox | Detects medium severity alerts from ZeroFox |
| Zero Networks Segement - Machine Removed from protection | Analytic Rule | 📦 Solution | ZeroNetworks | Detects when a machine is removed from protection. |
| Zero Networks Segment - New API Token created | Analytic Rule | 📦 Solution | ZeroNetworks | Detects when a api token has been created. |
| Zero Networks Segment - Rare JIT Rule Creation | Analytic Rule | 📦 Solution | ZeroNetworks | Identifies when a JIT Rule connection is new or rare by a given account today based on comparison with the previous 14 days. JIT Rule creations are indicated by the Activity Type Id 20 |
| Zero Networks Segment - Excessive access by user | Hunting Query | 📦 Solution | ZeroNetworks | Find users who gained access to the largest number of target assets in the selected time range |
| Zero Networks Segment - Excessive access to a built-in group by user | Hunting Query | 📦 Solution | ZeroNetworks | A rule was created which granted a user access to a large, built-in, group of assets. |
| Zero Networks Segment - Inbound Block Rules Deleted | Hunting Query | 📦 Solution | ZeroNetworks | Query searches for inbound block rules deleted by non AI. |
| Zero Networks Segment - Outbound Block Rules Deleted | Hunting Query | 📦 Solution | ZeroNetworks | Query searches for outbound block rules deleted by non AI. |
| ZNSegmentAudit | Workbook | 📦 Solution | ZeroNetworks | |
| Add Asset to Protection - Zero Networks Segment | Playbook | 📦 Solution | ZeroNetworks | This playbook takes a host from a Microsoft Sentinel incident and adds it to protection. The playbook is configured to add the machine to protection(learning). If you want to have it go straight to pr... |
| Add Block Outbound Rule - Zero Networks Acccess Orchestrator | Playbook | 📦 Solution | ZeroNetworks | This playbook allows blocking an IP outbound from protected assets in Zero Networks Segment. |
| Enrich Incident - Zero Networks Acccess Orchestrator | Playbook | 📦 Solution | ZeroNetworks | This playbook will take each Host entity and get its Asset status from Zero Network Segment. The playbook will then write a comment to the Microsoft Sentinel incident with a table of assets and protec... |
| ZNSegmentAudit | Parser | 📦 Solution | ZeroNetworks | |
| ZeroTrust(TIC3.0) Control Assessment Posture Change | Analytic Rule | 📦 Solution | ZeroTrust(TIC3.0) | Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines |
| ZeroTrustTIC3 | Workbook | 📦 Solution | ZeroTrust(TIC3.0) | |
| Notify-GovernanceComplianceTeam | Playbook | 📦 Solution | ZeroTrust(TIC3.0) | This Security Orchestration, Automation, & Response (SOAR) capability is designed for configuration with the solution's analytics rules. When analytics rules trigger this automation notifies the gover... |
| Create-AzureDevOpsTask | Playbook | 📦 Solution | ZeroTrust(TIC3.0) | This playbook will create the Azure DevOps task filled with the Microsoft Sentinel incident details. |
| Create Jira Issue | Playbook | 📦 Solution | ZeroTrust(TIC3.0) | This playbook will open a Jira Issue when a new incident is opened in Microsoft Sentinel. |
| ZimperiumWorkbooks | Workbook | 📦 Solution | Zimperium Mobile Threat Defense | |
| AV detections related to Zinc actors | Analytic Rule | 📦 Solution | Zinc Open Source | This query looks for Microsoft Defender AV detections related to Zinc threat actor. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joi... |
| Zinc Actor IOCs files - October 2022 | Analytic Rule | 📦 Solution | Zinc Open Source | Identifies a match across filename and commandline IOC's related to an actor tracked by Microsoft as Zinc. Reference: https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-so... |
| [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 | Analytic Rule | 📦 Solution | Zinc Open Source | Use Microsoft's up-to-date Threat Intelligence solution from the Content Hub to replace the deprecated query with outdated IoCs. Install it from: https://learn.microsoft.com/azure/sentinel/sentinel-so... |
| ZoomReports | Workbook | 📦 Solution | ZoomReports | |
| Zoom | Parser | 📦 Solution | ZoomReports | |
| Discord CDN Risky File Download 🔍 | Analytic Rule | 📦 Solution | Zscaler Internet Access | Identifies callouts to Discord CDN addresses for risky file extensions. This detection will trigger when a callout for a risky file is made to a discord server that has only been seen once in your env... |
| Request for single resource on domain 🔍 | Analytic Rule | 📦 Solution | Zscaler Internet Access | This will look for connections to a domain where only a single file is requested, this is unusual as most modern web applications require additional recources. This type of activity is often assocaite... |
| NSSAuditLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBActivityLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBCloudStorageLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBCollabLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBCRMLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBEmail | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBFileSharingLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBITSMLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSCASBRepoLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSDNSLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSEmailDLPLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSEndpointDLPLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSFWLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSTunnelLogs | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSWebLogsOffice365 | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSWebLogsOverview | Workbook | 📦 Solution | Zscaler Internet Access | |
| NSSWebLogsThreats | Workbook | 📦 Solution | Zscaler Internet Access | |
| Zscaler OAuth2 Authentication | Playbook | 📦 Solution | Zscaler Internet Access | This playbook obtains OAuth2 access tokens for Zscaler Internet Access (ZIA) integrations using Zscaler ZIdentity OAuth and returns the token response. |
| Zscaler OAuth2 Blacklist URL | Playbook | 📦 Solution | Zscaler Internet Access | This playbook adds URLs to the Zscaler security blacklist using OAuth2 authentication. |
| Zscaler OAuth2 Block IP | Playbook | 📦 Solution | Zscaler Internet Access | This playbook blocks IP addresses in Zscaler by adding them to a category using OAuth2 authentication. |
| Zscaler OAuth2 Block URL | Playbook | 📦 Solution | Zscaler Internet Access | This playbook blocks URLs in Zscaler by adding them to a category using OAuth2 authentication. |
| Zscaler OAuth2 Lookup IP | Playbook | 📦 Solution | Zscaler Internet Access | This playbook looks up IP categorization information from Zscaler using OAuth2 authentication. |
| Zscaler OAuth2 Lookup URL | Playbook | 📦 Solution | Zscaler Internet Access | This playbook looks up URL categorization information from Zscaler using OAuth2 authentication. |
| Zscaler-Oauth2-UnblacklistURL | Playbook | 📦 Solution | Zscaler Internet Access | This playbook enables automated removal of URLs from the Zscaler Internet Access (ZIA) blacklist when triggered by Microsoft Sentinel incidents. It uses OAuth2 authentication to securely communicate w... |
| Zscaler OAuth2 Unblock IP | Playbook | 📦 Solution | Zscaler Internet Access | This playbook unblocks IP addresses in Zscaler by removing them from a category using OAuth2 authentication. |
| Zscaler OAuth2 Unblock URL | Playbook | 📦 Solution | Zscaler Internet Access | This playbook unblocks URLs in Zscaler by removing them from a category using OAuth2 authentication. |
| Zscaler-Oauth2-WhitelistURL | Playbook | 📦 Solution | Zscaler Internet Access | This playbook enables automated addition of URLs to the Zscaler Internet Access (ZIA) security whitelist when triggered by Microsoft Sentinel incidents. It uses OAuth2 authentication to securely commu... |
| Zscaler - Shared ZPA session | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects shared ZPA session. |
| Zscaler - Unexpected event count of rejects by policy | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects unexpected event count of rejects by policy. |
| Zscaler - Forbidden countries | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects suspicious ZPA connections from forbidden countries. |
| Zscaler - Unexpected update operation | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects unexpected version of update operation. |
| Zscaler - Connections by dormant user | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects ZPA connections by dormant user. |
| Zscaler - ZPA connections by new user | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects ZPA connections by new user. |
| Zscaler - ZPA connections from new country | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects ZPA connections from new country. |
| Zscaler - ZPA connections from new IP | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects ZPA connections from new IP. |
| Zscaler - ZPA connections outside operational hours | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects ZAP connections outside operational hours. |
| Zscaler - Unexpected ZPA session duration | Analytic Rule | 📦 Solution | Zscaler Private Access (ZPA) | Detects Unexpected ZPA session duration. |
| Zscaler - Abnormal total bytes size | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows abnormal total bytes size. |
| Zscaler - Applications using by accounts | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows applications using by accounts. |
| Zscaler - Connection close reasons | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows connection close reasons. |
| Zscaler - Destination ports by IP | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows destination ports by IP address. |
| Zscaler - Users by source location countries | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows Users by source location countries. |
| Zscaler - Top connectors | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows top connectors. |
| Zscaler - Top source IP | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows top source IP. |
| Zscaler - Rare urlhostname requests | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows rare urlhostname requests. |
| Zscaler - Users access groups | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows users access groups. |
| Zscaler - Server error by user | Hunting Query | 📦 Solution | Zscaler Private Access (ZPA) | Query shows server error by user. |
| ZscalerZPA | Workbook | 📦 Solution | Zscaler Private Access (ZPA) | |
| ZPAEvent | Parser | 📦 Solution | Zscaler Private Access (ZPA) |
📦 In solution package
📄 Standalone (not in solution JSON)
🔗 GitHub only (no content hub package)
🔍 Not listed in solution JSON
| Parser | Source | Solution | Tables |
|---|---|---|---|
| AADUserInfo | 📂 Legacy | AADUserInfo_CL | |
| ADOAuditLogs | 📦 Solution | AzureDevOpsAuditing | ADOAuditLogs_CL, AzureDevOpsAuditing |
| afad_parser | 📦 Solution | Tenable App | Tenable_IE_CL |
| afad_parser 🔍 | 📦 Solution | TenableAD | Tenable_ad_CL |
| afad_parser 🔍 | 📦 Solution | TenableAD | Tenable_ad_CL |
| afad_parser.kql 🔍 | 📦 Solution | Alsid For AD | AlsidForADLog_CL |
| AIShield | 📦 Solution | AIShield AI Security Monitoring | AIShield_CL |
| AkamaiSIEMEvent | 📦 Solution | Akamai Security Events | CommonSecurityLog |
| Alerts_advisory | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_assets | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_bit_bucket | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_cloud_storage | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_compromised_endpoints_cookies | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_compromised_files | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_cyber_crime_forums | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_darkweb_data_breaches | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_darkweb_marketplaces | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_darkweb_ransomware | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_defacement_content | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_defacement_keyword | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_defacement_url | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_discord | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_docker | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_domain_expiry | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_domain_watchlist | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_flash_report | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_github | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_hacktivism | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_i2p | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_iocs | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_ip_risk_score | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_leaked_credentials | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_malicious_ads | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_mobile_apps | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_new_vulnerability | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_news_feed | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_osint | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_ot_ics | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_pastebin | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_phishing | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_physical_threats | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_postman | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_product_vulnerability | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_ransomware_updates | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_social_media_monitoring | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_ssl_expiry | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_stealer_logs | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_subdomains | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_suspicious_domains | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_telegram_mentions | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_tor_links | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_vulnerability | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| Alerts_web_applications | 📦 Solution | Cyble Vision | CybleVisionAlerts_CL |
| AlertsCompromisedCredential | 📦 Solution | Netskopev2 | alertscompromisedcredentialdata_CL |
| AlertsCtep | 📦 Solution | Netskopev2 | alertsctepdata_CL |
| AlertsDLP | 📦 Solution | Netskopev2 | alertsdlpdata_CL |
| AlertsMalsite | 📦 Solution | Netskopev2 | alertsmalsitedata_CL |
| AlertsMalware | 📦 Solution | Netskopev2 | alertsmalwaredata_CL |
| AlertsPolicy | 📦 Solution | Netskopev2 | alertspolicydata_CL |
| AlertsQuarantine | 📦 Solution | Netskopev2 | alertsquarantinedata_CL |
| AlertsRemediation | 📦 Solution | Netskopev2 | alertsremediationdata_CL |
| AlertsSecurityAssessment | 📦 Solution | Netskopev2 | alertssecurityassessmentdata_CL |
| AlertsUba | 📦 Solution | Netskopev2 | alertsubadata_CL |
| AliCloud | 📦 Solution | Alibaba Cloud | AliCloud_CL |
| ApacheHTTPServer | 📦 Solution | ApacheHTTPServer | ApacheHTTPServer_CL |
| ApigeeX | 📦 Solution | Google Apigee | ApigeeX_CL, GoogleApigeeXV2_CL |
| ApigeeXv2 | 📦 Solution | Google Apigee | ApigeeXV2_CL |
| ArmisActivities | 📦 Solution | Armis | Armis_Activities_CL |
| ArmisAlerts | 📦 Solution | Armis | Armis_Alerts_CL |
| ArmisDevice | 📦 Solution | Armis | Armis_Devices_CL |
| ArubaClearPass | 📦 Solution | Aruba ClearPass | CommonSecurityLog |
| ASimAuthenticationOpenSystems 🔍 | 📦 Solution | Open Systems | OpenSystemsAuthenticationLogs_CL |
| ASimDnsMicrosoftNXLog | 📦 Solution | NXLogDNSLogs | ? |
| ASimNetworkSessionOpenSystemsFirewall 🔍 | 📦 Solution | Open Systems | OpenSystemsFirewallLogs_CL |
| ASimWebSessionOpenSystemsSecureWebGateway 🔍 | 📦 Solution | Open Systems | OpenSystemsProxyLogs_CL |
| AssignedIPAddress | 📦 Solution | MicrosoftDefenderForEndpoint | DeviceNetworkInfo |
| Auth0 | 📦 Solution | Auth0 | Auth0AM_CL, Auth0_CL |
| Auth0AM | 📦 Solution | Auth0 | Auth0AM_CL, Auth0Logs_CL |
| AwarenessPerformanceDetails | 📦 Solution | Mimecast | Awareness_Performance_Details_CL |
| AwarenessSafeScore | 📦 Solution | Mimecast | Awareness_SafeScore_Details_CL |
| AwarenessUserData | 📦 Solution | Mimecast | Awareness_User_Data_CL |
| AwarenessWatchlist | 📦 Solution | Mimecast | Awareness_Watchlist_Details_CL |
| AWSALBAccessLogsData | 📦 Solution | AWS ELB | AWSALBAccessLogs, AWSALBAccessLogs_CL |
| AWSELBFlowLogsData | 📦 Solution | AWS ELB | AWSELBFlowLogs, AWSELBFlowLogs_CL |
| AWSNLBAccessLogsData | 📦 Solution | AWS ELB | AWSNLBAccessLogs, AWSNLBAccessLogs_CL |
| AzureFirewallApplicationRule | 📂 Legacy | AzureDiagnostics | |
| AzureFirewallDnsProxy | 📂 Legacy | ? | |
| AzureFirewallNetworkRule | 📂 Legacy | AzureDiagnostics | |
| Bitglass | 📦 Solution | Bitglass | BitglassLogs_CL |
| BitSightAlerts | 📦 Solution | BitSight | BitsightAlerts_data_CL |
| BitSightBreaches | 📦 Solution | BitSight | BitsightBreaches_data_CL |
| BitSightCompanyDetails | 📦 Solution | BitSight | BitsightCompany_details_CL |
| BitSightCompanyRatings | 📦 Solution | BitSight | BitsightCompany_rating_details_CL |
| BitSightDiligenceHistoricalStatistics | 📦 Solution | BitSight | BitsightDiligence_historical_statistics_CL |
| BitSightDiligenceStatistics | 📦 Solution | BitSight | BitsightDiligence_statistics_CL |
| BitSightFindingsData | 📦 Solution | BitSight | BitsightFindings_data_CL |
| BitSightFindingsSummary | 📦 Solution | BitSight | BitsightFindings_summary_CL |
| BitSightGraphData | 📦 Solution | BitSight | BitsightGraph_data_CL |
| BitSightIndustrialStatistics | 📦 Solution | BitSight | BitsightIndustrial_statistics_CL |
| BitSightObservationStatistics | 📦 Solution | BitSight | BitsightObservation_statistics_CL |
| BitwardenEventLogs | 📦 Solution | Bitwarden | BitwardenEventLogs_CL, BitwardenGroups_CL, ... |
| BoxEvents | 📦 Solution | Box | BoxEventsV2_CL, BoxEvents_CL |
| CassandraAuditLog | 📂 Legacy | CassandraAuditLog_CL | |
| CBS_BreachedCredentials 🔍 | 📦 Solution | CTM360 | CBS_BreachedCredentials_AzureV2_CL, CBS_BreachedCredentials_CL |
| CBS_CompromisedCards 🔍 | 📦 Solution | CTM360 | CBS_CompromisedCards_AzureV2_CL, CBS_CompromisedCards_CL |
| CBS_DomainInfringement 🔍 | 📦 Solution | CTM360 | CBS_DomainInfringement_AzureV2_CL, CBS_DomainInfringement_CL |
| CBS_MalwareLogs 🔍 | 📦 Solution | CTM360 | CBS_MalwareLogs_AzureV2_CL, CBS_MalwareLogs_CL |
| CBS_SubdomainInfringement 🔍 | 📦 Solution | CTM360 | CBS_SubdomainInfringement_AzureV2_CL, CBS_SubdomainInfringement_CL |
| CBSLog 🔍 | 📦 Solution | CTM360 | CBSLog_AzureV2_CL, CBSLog_Azure_1_CL |
| CGFWFirewallActivity | 📦 Solution | Barracuda CloudGen Firewall | Syslog |
| Cisco_Umbrella | 📦 Solution | CiscoUmbrella | Cisco_Umbrella_audit_CL, Cisco_Umbrella_cloudfirewall_CL, ... |
| CiscoACIEvent | 📦 Solution | Cisco ACI | Syslog |
| CiscoDuo | 📦 Solution | CiscoDuoSecurity | CiscoDuo_CL |
| CiscoISEEvent | 📦 Solution | Cisco ISE | Syslog |
| CiscoMeraki | 📦 Solution | CiscoMeraki | CiscoMerakiNativePoller_CL, Syslog, ... |
| CiscoSDWANNetflow 🔍 | 📦 Solution | Cisco SD-WAN | CiscoSDWANNetflow_CL |
| CiscoSecureEndpoint | 📦 Solution | Cisco Secure Endpoint | CiscoSecureEndpointAuditLogsV2_CL, CiscoSecureEndpointEventsV2_CL, ... |
| CiscoSEGEvent | 📦 Solution | CiscoSEG | CommonSecurityLog |
| CiscoSyslogFW6LogSummary 🔍 | 📦 Solution | Cisco SD-WAN | Syslog |
| CiscoSyslogUTD 🔍 | 📦 Solution | Cisco SD-WAN | Syslog |
| CiscoUCS | 📦 Solution | Cisco UCS | Syslog |
| CiscoWSAEvent | 📦 Solution | CiscoWSA | Syslog |
| CitrixADCEvent | 📦 Solution | Citrix ADC | Syslog |
| CitrixADCEventOld 🔍 | 📦 Solution | Citrix ADC | CommonSecurityLog |
| ClarotyEvent | 📦 Solution | Claroty | CommonSecurityLog |
| Cloudflare | 📦 Solution | Cloudflare | CloudflareV2_CL, Cloudflare_CL |
| Cloudflare | 📦 Solution | Cloudflare CCF | CloudflareV2_CL, Cloudflare_CL |
| ConfluenceAudit | 📦 Solution | AtlassianConfluenceAudit | Confluence_Audit_CL |
| ContrastADR | 📦 Solution | ContrastADR | ContrastADRAttackEvents_CL |
| ContrastADR_Incident | 📦 Solution | ContrastADR | ContrastADRIncidents_CL |
| Corelight | 📦 Solution | Corelight | ? |
| corelight_anomaly | 📦 Solution | Corelight | Corelight_v2_anomaly_CL |
| corelight_bacnet | 📦 Solution | Corelight | Corelight_v2_bacnet_CL |
| corelight_capture_loss | 📦 Solution | Corelight | Corelight_v2_capture_loss_CL |
| corelight_cip | 📦 Solution | Corelight | Corelight_v2_cip_CL |
| corelight_conn | 📦 Solution | Corelight | Corelight_v2_conn_CL, Corelight_v2_conn_long_CL, ... |
| corelight_conn_agg | 📦 Solution | Corelight | Corelight_v2_conn_agg_CL |
| corelight_conn_long | 📦 Solution | Corelight | Corelight_v2_conn_long_CL |
| corelight_conn_red | 📦 Solution | Corelight | Corelight_v2_conn_red_CL |
| corelight_corelight_burst | 📦 Solution | Corelight | Corelight_v2_corelight_burst_CL |
| corelight_corelight_metrics_disk | 📦 Solution | Corelight | Corelight_v2_corelight_metrics_disk_CL |
| corelight_corelight_metrics_iface | 📦 Solution | Corelight | Corelight_v2_corelight_metrics_iface_CL |
| corelight_corelight_metrics_memory | 📦 Solution | Corelight | Corelight_v2_corelight_metrics_memory_CL |
| corelight_corelight_metrics_system | 📦 Solution | Corelight | Corelight_v2_corelight_metrics_system_CL |
| corelight_corelight_metrics_zeek_doctor | 📦 Solution | Corelight | Corelight_v2_corelight_metrics_zeek_doctor_CL |
| corelight_corelight_overall_capture_loss | 📦 Solution | Corelight | Corelight_v2_corelight_overall_capture_loss_CL |
| corelight_corelight_profiling | 📦 Solution | Corelight | Corelight_v2_corelight_profiling_CL |
| corelight_datared | 📦 Solution | Corelight | Corelight_v2_datared_CL |
| corelight_dce_rpc | 📦 Solution | Corelight | Corelight_v2_dce_rpc_CL |
| corelight_dga | 📦 Solution | Corelight | Corelight_v2_dga_CL |
| corelight_dhcp | 📦 Solution | Corelight | Corelight_v2_dhcp_CL |
| corelight_dnp3 | 📦 Solution | Corelight | Corelight_v2_dnp3_CL |
| corelight_dns | 📦 Solution | Corelight | Corelight_v2_dns_CL, Corelight_v2_dns_red_CL |
| corelight_dns_agg | 📦 Solution | Corelight | Corelight_v2_dns_agg_CL |
| corelight_dns_red | 📦 Solution | Corelight | Corelight_v2_dns_red_CL |
| corelight_dpd | 📦 Solution | Corelight | Corelight_v2_dpd_CL |
| corelight_encrypted_dns | 📦 Solution | Corelight | Corelight_v2_encrypted_dns_CL |
| corelight_enip | 📦 Solution | Corelight | Corelight_v2_enip_CL |
| corelight_enip_debug | 📦 Solution | Corelight | Corelight_v2_enip_debug_CL |
| corelight_enip_list_identity | 📦 Solution | Corelight | Corelight_v2_enip_list_identity_CL |
| corelight_etc_viz | 📦 Solution | Corelight | Corelight_v2_etc_viz_CL |
| corelight_files | 📦 Solution | Corelight | Corelight_v2_files_CL, Corelight_v2_files_red_CL |
| corelight_files_agg | 📦 Solution | Corelight | Corelight_v2_files_agg_CL |
| corelight_files_red | 📦 Solution | Corelight | Corelight_v2_files_red_CL |
| corelight_first_seen | 📦 Solution | Corelight | Corelight_v2_first_seen_CL |
| corelight_ftp | 📦 Solution | Corelight | Corelight_v2_ftp_CL |
| corelight_generic_dns_tunnels | 📦 Solution | Corelight | Corelight_v2_generic_dns_tunnels_CL |
| corelight_generic_icmp_tunnels | 📦 Solution | Corelight | Corelight_v2_generic_icmp_tunnels_CL |
| corelight_http | 📦 Solution | Corelight | Corelight_v2_http2_CL, Corelight_v2_http_CL, ... |
| corelight_http2 | 📦 Solution | Corelight | Corelight_v2_http2_CL |
| corelight_http_agg | 📦 Solution | Corelight | Corelight_v2_http_agg_CL |
| corelight_http_red | 📦 Solution | Corelight | Corelight_v2_http_red_CL |
| corelight_icmp_specific_tunnels | 📦 Solution | Corelight | Corelight_v2_icmp_specific_tunnels_CL |
| corelight_intel | 📦 Solution | Corelight | Corelight_v2_intel_CL |
| corelight_ipsec | 📦 Solution | Corelight | Corelight_v2_ipsec_CL |
| corelight_irc | 📦 Solution | Corelight | Corelight_v2_irc_CL |
| corelight_iso_cotp | 📦 Solution | Corelight | Corelight_v2_iso_cotp_CL |
| corelight_kerberos | 📦 Solution | Corelight | Corelight_v2_kerberos_CL |
| corelight_known_certs | 📦 Solution | Corelight | Corelight_v2_known_certs_CL |
| corelight_known_devices | 📦 Solution | Corelight | Corelight_v2_known_devices_CL |
| corelight_known_domains | 📦 Solution | Corelight | Corelight_v2_known_domains_CL |
| corelight_known_hosts | 📦 Solution | Corelight | Corelight_v2_known_hosts_CL |
| corelight_known_names | 📦 Solution | Corelight | Corelight_v2_known_names_CL |
| corelight_known_remotes | 📦 Solution | Corelight | Corelight_v2_known_remotes_CL |
| corelight_known_services | 📦 Solution | Corelight | Corelight_v2_known_services_CL |
| corelight_known_users | 📦 Solution | Corelight | Corelight_v2_known_users_CL |
| corelight_local_subnets | 📦 Solution | Corelight | Corelight_v2_local_subnets_CL |
| corelight_local_subnets_dj | 📦 Solution | Corelight | Corelight_v2_local_subnets_dj_CL |
| corelight_local_subnets_graphs | 📦 Solution | Corelight | Corelight_v2_local_subnets_graphs_CL |
| corelight_log4shell | 📦 Solution | Corelight | Corelight_v2_log4shell_CL |
| corelight_modbus | 📦 Solution | Corelight | Corelight_v2_modbus_CL |
| corelight_mqtt_connect | 📦 Solution | Corelight | Corelight_v2_mqtt_connect_CL |
| corelight_mqtt_publish | 📦 Solution | Corelight | Corelight_v2_mqtt_publish_CL |
| corelight_mqtt_subscribe | 📦 Solution | Corelight | Corelight_v2_mqtt_subscribe_CL |
| corelight_mysql | 📦 Solution | Corelight | Corelight_v2_mysql_CL |
| corelight_notice | 📦 Solution | Corelight | Corelight_v2_notice_CL |
| corelight_ntlm | 📦 Solution | Corelight | Corelight_v2_ntlm_CL |
| corelight_ntp | 📦 Solution | Corelight | Corelight_v2_ntp_CL |
| corelight_ocsp | 📦 Solution | Corelight | Corelight_v2_ocsp_CL |
| corelight_openflow | 📦 Solution | Corelight | Corelight_v2_openflow_CL |
| corelight_packet_filter | 📦 Solution | Corelight | Corelight_v2_packet_filter_CL |
| corelight_pe | 📦 Solution | Corelight | Corelight_v2_pe_CL |
| corelight_profinet | 📦 Solution | Corelight | Corelight_v2_profinet_CL |
| corelight_profinet_dce_rpc | 📦 Solution | Corelight | Corelight_v2_profinet_dce_rpc_CL |
| corelight_profinet_debug | 📦 Solution | Corelight | Corelight_v2_profinet_debug_CL |
| corelight_radius | 📦 Solution | Corelight | Corelight_v2_radius_CL |
| corelight_rdp | 📦 Solution | Corelight | Corelight_v2_rdp_CL |
| corelight_reporter | 📦 Solution | Corelight | Corelight_v2_reporter_CL |
| corelight_rfb | 📦 Solution | Corelight | Corelight_v2_rfb_CL |
| corelight_s7comm | 📦 Solution | Corelight | Corelight_v2_s7comm_CL |
| corelight_signatures | 📦 Solution | Corelight | Corelight_v2_signatures_CL |
| corelight_sip | 📦 Solution | Corelight | Corelight_v2_sip_CL |
| corelight_smartpcap | 📦 Solution | Corelight | Corelight_v2_smartpcap_CL |
| corelight_smartpcap_stats | 📦 Solution | Corelight | Corelight_v2_smartpcap_stats_CL |
| corelight_smb_files | 📦 Solution | Corelight | Corelight_v2_smb_files_CL |
| corelight_smb_mapping | 📦 Solution | Corelight | Corelight_v2_smb_mapping_CL |
| corelight_smtp | 📦 Solution | Corelight | Corelight_v2_smtp_CL |
| corelight_smtp_links | 📦 Solution | Corelight | Corelight_v2_smtp_links_CL |
| corelight_snmp | 📦 Solution | Corelight | Corelight_v2_snmp_CL |
| corelight_socks | 📦 Solution | Corelight | Corelight_v2_socks_CL |
| corelight_software | 📦 Solution | Corelight | Corelight_v2_software_CL |
| corelight_specific_dns_tunnels | 📦 Solution | Corelight | Corelight_v2_specific_dns_tunnels_CL |
| corelight_ssh | 📦 Solution | Corelight | Corelight_v2_ssh_CL |
| corelight_ssl | 📦 Solution | Corelight | Corelight_v2_ssl_CL, Corelight_v2_ssl_red_CL |
| corelight_ssl_agg | 📦 Solution | Corelight | Corelight_v2_ssl_agg_CL |
| corelight_ssl_red | 📦 Solution | Corelight | Corelight_v2_ssl_red_CL |
| corelight_stats | 📦 Solution | Corelight | Corelight_v2_stats_CL |
| corelight_stepping | 📦 Solution | Corelight | Corelight_v2_stepping_CL |
| corelight_stun | 📦 Solution | Corelight | Corelight_v2_stun_CL |
| corelight_stun_nat | 📦 Solution | Corelight | Corelight_v2_stun_nat_CL |
| corelight_suri_aggregations | 📦 Solution | Corelight | ? |
| corelight_suricata_corelight | 📦 Solution | Corelight | Corelight_v2_suricata_corelight_CL |
| corelight_suricata_eve | 📦 Solution | Corelight | Corelight_v2_suricata_eve_CL |
| corelight_suricata_stats | 📦 Solution | Corelight | Corelight_v2_suricata_stats_CL |
| corelight_suricata_zeek_stats | 📦 Solution | Corelight | Corelight_v2_suricata_zeek_stats_CL |
| corelight_syslog | 📦 Solution | Corelight | Corelight_v2_syslog_CL |
| corelight_tds | 📦 Solution | Corelight | Corelight_v2_tds_CL |
| corelight_tds_rpc | 📦 Solution | Corelight | Corelight_v2_tds_rpc_CL |
| corelight_tds_sql_batch | 📦 Solution | Corelight | Corelight_v2_tds_sql_batch_CL |
| corelight_traceroute | 📦 Solution | Corelight | Corelight_v2_traceroute_CL |
| corelight_tunnel | 📦 Solution | Corelight | Corelight_v2_tunnel_CL |
| corelight_unknown_smartpcap | 📦 Solution | Corelight | Corelight_v2_unknown_smartpcap_CL |
| corelight_util_stats | 📦 Solution | Corelight | Corelight_v2_util_stats_CL |
| corelight_vpn | 📦 Solution | Corelight | Corelight_v2_vpn_CL |
| corelight_weird | 📦 Solution | Corelight | Corelight_v2_weird_CL |
| corelight_weird_agg | 📦 Solution | Corelight | Corelight_v2_weird_agg_CL |
| corelight_weird_red | 📦 Solution | Corelight | Corelight_v2_weird_red_CL |
| corelight_weird_stats | 📦 Solution | Corelight | Corelight_v2_weird_stats_CL |
| corelight_wireguard | 📦 Solution | Corelight | Corelight_v2_wireguard_CL |
| corelight_x509 | 📦 Solution | Corelight | Corelight_v2_x509_CL, Corelight_v2_x509_red_CL |
| corelight_x509_red | 📦 Solution | Corelight | Corelight_v2_x509_red_CL |
| corelight_zeek_doctor | 📦 Solution | Corelight | Corelight_v2_zeek_doctor_CL |
| CortexXDR_Incidents_CL | 📦 Solution | Cortex XDR | CortexXDR_Incidents_CL, PaloAltoCortexXDR_Incidents_CL |
| CPEMAlerts | 📦 Solution | Check Point Cyberint Alerts | argsentdc_CL |
| CriblAccess | 📦 Solution | Cribl | CriblAccess_CL |
| CriblAudit | 📦 Solution | Cribl | CriblAudit_CL |
| CriblInternal | 📦 Solution | Cribl | CriblInternal_CL |
| CriblUIAccess | 📦 Solution | Cribl | CriblUIAccess_CL |
| CrowdStrikeFalconEventStream | 📦 Solution | CrowdStrike Falcon Endpoint Protection | CommonSecurityLog |
| CrowdStrikeReplicator | 📦 Solution | CrowdStrike Falcon Endpoint Protection | CrowdstrikeReplicatorLogs_CL |
| CrowdStrikeReplicator 🔍 | 📦 Solution | CrowdStrike Falcon Endpoint Protection | CrowdstrikeReplicatorLogs_CL |
| CrowdStrikeReplicatorV2 | 📦 Solution | CrowdStrike Falcon Endpoint Protection | ASimAuditEventLogs, ASimAuthenticationEventLogs, ... |
| CyberArkEPM | 📦 Solution | CyberArkEPM | CyberArkEPM_CL |
| CyjaxCorrelate | 📦 Solution | Cyjax | ThreatIntelIndicators |
| CyjaxThreatIndicator | 📦 Solution | Cyjax | ThreatIntelIndicators |
| CylancePROTECT | 📦 Solution | Blackberry CylancePROTECT | Syslog, syslog |
| CylancePROTECT-old 🔍 | 📦 Solution | Blackberry CylancePROTECT | Syslog |
| CymruScoutAccountUsage | 📦 Solution | Team Cymru Scout | Cymru_Scout_Account_Usage_Data_CL |
| CymruScoutCommunicationsData | 📦 Solution | Team Cymru Scout | Communication_Data_CL |
| CymruScoutCorrelate | 📦 Solution | Team Cymru Scout | ThreatIntelligenceIndicator |
| CymruScoutDomain | 📦 Solution | Team Cymru Scout | Cymru_Scout_Domain_Data_CL |
| CymruScoutDomainData | 📦 Solution | Team Cymru Scout | Domain_Data_CL |
| CymruScoutFingerprintsData | 📦 Solution | Team Cymru Scout | Fingerprints_Data_CL |
| CymruScoutIdentity | 📦 Solution | Team Cymru Scout | Identity_Data_CL |
| CymruScoutIP | 📦 Solution | Team Cymru Scout | Cymru_Scout_IP_Data_Details_CL, Cymru_Scout_IP_Data_Foundation_CL, ... |
| CymruScoutOpenPortsData | 📦 Solution | Team Cymru Scout | Open_Ports_Data_CL |
| CymruScoutPdnsData | 📦 Solution | Team Cymru Scout | PDNS_Data_CL |
| CymruScoutProtoByIP | 📦 Solution | Team Cymru Scout | Proto_By_IP_Data_CL |
| CymruScoutSummary | 📦 Solution | Team Cymru Scout | Summary_Details_CL |
| CymruScoutSummaryTopCerts | 📦 Solution | Team Cymru Scout | Summary_Details_Top_Certs_Data_CL |
| CymruScoutSummaryTopFingerprints | 📦 Solution | Team Cymru Scout | Summary_Details_Top_Fingerprints_Data_CL |
| CymruScoutSummaryTopOpenPorts | 📦 Solution | Team Cymru Scout | Summary_Details_Top_Open_Ports_Data_CL |
| CymruScoutSummaryTopPdns | 📦 Solution | Team Cymru Scout | Summary_Details_Top_Pdns_Data_CL |
| CymruScoutTopAsnsByIP | 📦 Solution | Team Cymru Scout | Top_Asns_By_IP_Data_CL |
| CymruScoutTopCountryCodesByIP | 📦 Solution | Team Cymru Scout | Top_Country_Codes_By_IP_Data_CL |
| CymruScoutTopServicesByIP | 📦 Solution | Team Cymru Scout | Top_Services_By_IP_Data_CL |
| CymruScoutTopTagsByIP | 📦 Solution | Team Cymru Scout | Top_Tags_By_IP_Data_CL |
| CymruScoutWhois | 📦 Solution | Team Cymru Scout | Whois_Data_CL |
| CymruScoutX509Data | 📦 Solution | Team Cymru Scout | X509_Data_CL |
| CynerioEvent_Authentication 🔍 | 📦 Solution | Cynerio | CynerioEvent_CL |
| CynerioEvent_NetworkSession 🔍 | 📦 Solution | Cynerio | CynerioEvent_CL |
| DataminrPulseAlerts | 📦 Solution | Dataminr Pulse | DataminrPulse_Alerts_CL, watchlist |
| DataminrPulseCyberAlerts | 📦 Solution | Dataminr Pulse | DataminrPulse_Alerts_CL, watchlist |
| DataverseSharePointSites | 📦 Solution | Microsoft Business Applications | ? |
| DefendAuditData 🔍 | 📦 Solution | Egress Defend | EgressDefend_CL |
| DefendAuditData | 📦 Solution | KnowBe4 Defend | KnowBe4Defend_CL |
| Devicefromip | 📦 Solution | MicrosoftDefenderForEndpoint | DeviceNetworkInfo |
| DigitalGuardianDLPEvent | 📦 Solution | Digital Guardian Data Loss Prevention | Syslog |
| DomainToolsDNSActivity | 📦 Solution | DomainTools | DomainToolsDomainEnrichment_CL |
| DragosNotificationsToSentinel | 📦 Solution | Dragos | SecurityAlert |
| DragosPullNotificationsToSentinel | 📦 Solution | Dragos | DragosAlerts_CL, SecurityAlert |
| DragosPushNotificationsToSentinel | 📦 Solution | Dragos | CommonSecurityLog |
| DragosSeverityToSentinelSeverity | 📦 Solution | Dragos | ? |
| dsp_parser | 📦 Solution | Semperis Directory Services Protector | SecurityEvent |
| DSTIMCorrelatedLogs | 📂 Legacy | DSTIMAccess_CL, DSTIMClassification_CL, ... | |
| DuoSecurityAdministrator | 📂 Legacy | DuoSecurityAdministrator_CL | |
| DuoSecurityAuthentication | 📂 Legacy | DuoSecurityAuthentication_CL | |
| DuoSecurityOfflineEnrollment | 📂 Legacy | DuoSecurityOfflineEnrollment_CL | |
| DuoSecurityTelephony | 📂 Legacy | DuoSecurityTelephony_CL | |
| DuoSecurityTrustMonitor | 📂 Legacy | DuoSecurityTrustMonitor_CL | |
| DynatraceAttacks | 📦 Solution | Dynatrace | DynatraceAttacksV2_CL, DynatraceAttacks_CL |
| DynatraceAuditLogs | 📦 Solution | Dynatrace | DynatraceAuditLogsV2_CL, DynatraceAuditLogs_CL |
| DynatraceProblems | 📦 Solution | Dynatrace | DynatraceProblemsV2_CL, DynatraceProblems_CL |
| DynatraceSecurityProblems | 📦 Solution | Dynatrace | DynatraceSecurityProblemsV2_CL, DynatraceSecurityProblems_CL |
| ElasticAgentEvent 🔍 | 📦 Solution | ElasticAgent | ElasticAgentLogs_CL |
| ESETPROTECT | 📦 Solution | ESETPROTECT | Syslog |
| ESETProtectPlatform | 📦 Solution | ESET Protect Platform | IntegrationTable_CL |
| EventIncident | 📦 Solution | Netskopev2 | eventsincidentdata_CL |
| EventsApplication | 📦 Solution | Netskopev2 | eventsapplicationdata_CL |
| EventsAudit | 📦 Solution | Netskopev2 | eventsauditdata_CL |
| EventsConnection | 📦 Solution | Netskopev2 | eventsconnectiondata_CL |
| EventsNetwork | 📦 Solution | Netskopev2 | eventsnetworkdata_CL |
| EventsPage | 📦 Solution | Netskopev2 | eventspagedata_CL |
| ExabeamEvent | 📦 Solution | Exabeam Advanced Analytics | Syslog |
| ExchangeAdminAuditLogs | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | Event |
| ExchangeConfiguration | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | ? |
| ExchangeConfiguration | 📦 Solution | Microsoft Exchange Security - Exchange Online | ? |
| ExchangeEnvironmentList | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | ? |
| ExchangeEnvironmentList | 📦 Solution | Microsoft Exchange Security - Exchange Online | ? |
| ExtraHopDetections | 📦 Solution | ExtraHop | ExtraHop_Detections_CL |
| FireEyeNXEvent | 📦 Solution | FireEye Network Security | CommonSecurityLog |
| ForescoutEvent | 📦 Solution | Forescout (Legacy) | Syslog |
| ForgeRockParser | 📦 Solution | ForgeRock Common Audit for CEF | CommonSecurityLog |
| Fortinet_FortiNDR_Cloud | 📦 Solution | Fortinet FortiNDR Cloud | FncEventsDetections_CL, FncEventsObservation_CL, ... |
| Fortiweb | 📦 Solution | Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel | CommonSecurityLog |
| GCP_IAM | 📦 Solution | GoogleCloudPlatformIAM | GCPIAM, GCP_IAM_CL |
| GCP_MONITOR | 📦 Solution | Google Cloud Platform Cloud Monitoring | GCP_MONITORINGV2_CL, GCP_MONITORING_CL |
| GCPCloudDNS | 📦 Solution | GoogleCloudPlatformDNS | GCPDNS, GCP_DNS_CL |
| GetClassificationList | 📂 Legacy | ? | |
| getForgeRockUsers 🔍 | 📦 Solution | ForgeRock Common Audit for CEF | CommonSecurityLog |
| GitHubAudit | 📂 Legacy | GitHub_CL | |
| GitHubAuditData | 📦 Solution | GitHub | GitHubAuditLogPolling_CL, GitHubAuditLogsV2_CL |
| GitHubCodeScanningData | 📦 Solution | GitHub | githubscanaudit_CL |
| GitHubDependabotData | 📦 Solution | GitHub | githubscanaudit_CL |
| GitHubRepo | 📂 Legacy | GitHubRepoLogs_CL | |
| githubscanaudit | 📦 Solution | GitHub | GitHubAdvancedSecurityAlerts_CL, githubscanaudit_CL |
| GitHubSecretScanningData | 📦 Solution | GitHub | githubscanaudit_CL |
| GitLabAccess | 📦 Solution | GitLab | Syslog |
| GitLabApp | 📦 Solution | GitLab | Syslog |
| GitLabAudit | 📦 Solution | GitLab | Syslog |
| Guardian | 📦 Solution | AIShield AI Security Monitoring | Guardian_CL |
| GWorkspaceActivityReports | 📦 Solution | GoogleWorkspaceReports | GWorkspace_ReportsAPI_access_transparency_CL, GWorkspace_ReportsAPI_admin_CL, ... |
| HackerViewLog 🔍 | 📦 Solution | CTM360 | HackerViewLog_AzureV2_CL, HackerViewLog_Azure_1_CL |
| HYASProtectDNSActivity | 📦 Solution | HYAS Protect | HYASProtectDnsSecurityLogs_CL |
| ibossUrlEvent | 📦 Solution | iboss | CommonSecurityLog |
| IllumioCoreEvent | 📦 Solution | Illumio Core | CommonSecurityLog |
| IllumioSyslogAuditEvents | 📦 Solution | IllumioSaaS | Syslog |
| IllumioSyslogNetworkTrafficEvents | 📦 Solution | IllumioSaaS | IllumioFlowEventsV2_CL, Syslog |
| ImpervaWAFCloud | 📦 Solution | ImpervaCloudWAF | ImpervaWAFCloudV2_CL, ImpervaWAFCloud_CL, ... |
| Infoblox | 📦 Solution | Infoblox NIOS | ? |
| Infoblox_allotherdhcpdTypes | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_allotherdnsTypes | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_allotherlogTypes | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcp_consolidated | 📦 Solution | Infoblox NIOS | ? |
| Infoblox_dhcpack | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpadded | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpbindupdate | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpdiscover | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpexpire | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpinform | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpoffer | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpoption | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpother | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcprelease | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpremoved | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcprequest | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dhcpsession | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dns_consolidated | 📦 Solution | Infoblox NIOS | ? |
| Infoblox_dnsclient | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dnsgss | 📦 Solution | Infoblox NIOS | Syslog |
| Infoblox_dnszone | 📦 Solution | Infoblox NIOS | Syslog |
| InfobloxCDC | 📦 Solution | Infoblox Cloud Data Connector | CommonSecurityLog |
| InfobloxCDC_SOCInsights | 📦 Solution | Infoblox | CommonSecurityLog |
| InfobloxCDC_SOCInsights | 📦 Solution | Infoblox SOC Insights | CommonSecurityLog |
| InfobloxInsight | 📦 Solution | Infoblox | InfobloxInsight_CL |
| InfobloxInsight | 📦 Solution | Infoblox SOC Insights | InfobloxInsight_CL |
| InfobloxInsightAssets | 📦 Solution | Infoblox | InfobloxInsightAssets_CL |
| InfobloxInsightAssets | 📦 Solution | Infoblox SOC Insights | InfobloxInsightAssets_CL |
| InfobloxInsightComments | 📦 Solution | Infoblox | InfobloxInsightComments_CL |
| InfobloxInsightComments | 📦 Solution | Infoblox SOC Insights | InfobloxInsightComments_CL |
| InfobloxInsightEvents | 📦 Solution | Infoblox | InfobloxInsightEvents_CL |
| InfobloxInsightEvents | 📦 Solution | Infoblox SOC Insights | InfobloxInsightEvents_CL |
| InfobloxInsightIndicators | 📦 Solution | Infoblox | InfobloxInsightIndicators_CL |
| InfobloxInsightIndicators | 📦 Solution | Infoblox SOC Insights | InfobloxInsightIndicators_CL |
| InfobloxNIOS | 📂 Legacy | Syslog | |
| InsightVMAssets | 📦 Solution | Rapid7InsightVM | NexposeInsightVMCloud_assets_CL, Rapid7InsightVMCloudAssets |
| InsightVMVulnerabilities | 📦 Solution | Rapid7InsightVM | NexposeInsightVMCloud_vulnerabilities_CL, Rapid7InsightVMCloudVulnerabilities |
| ISCBind | 📦 Solution | ISC Bind | Syslog |
| IvantiUEMEvent | 📦 Solution | Ivanti Unified Endpoint Management | Syslog |
| JamfProtectAlerts | 📦 Solution | Jamf Protect | jamfprotectalerts_CL |
| JamfProtectNetworkTraffic | 📦 Solution | Jamf Protect | jamfprotect_CL |
| JamfProtectTelemetry | 📦 Solution | Jamf Protect | jamfprotecttelemetryv2_CL |
| JamfProtectThreatEvents | 📦 Solution | Jamf Protect | jamfprotect_CL |
| JamfProtectUnifiedLogs | 📦 Solution | Jamf Protect | jamfprotectunifiedlogs_CL |
| JBossEvent | 📦 Solution | JBoss | JBossLogs_CL |
| JiraAudit | 📦 Solution | AtlassianJiraAudit | Jira_Audit_CL, Jira_Audit_v2_CL |
| JuniperIDP | 📦 Solution | JuniperIDP | JuniperIDP_CL |
| JuniperSRX | 📦 Solution | Juniper SRX | Syslog |
| LookoutCSActivities | 📦 Solution | Lookout Cloud Security Platform for Microsoft Sentinel | LookoutCloudSecurity_CL |
| LookoutCSAnomalies | 📦 Solution | Lookout Cloud Security Platform for Microsoft Sentinel | LookoutCloudSecurity_CL |
| LookoutCSViolations | 📦 Solution | Lookout Cloud Security Platform for Microsoft Sentinel | LookoutCloudSecurity_CL |
| LookoutEvents | 📦 Solution | Lookout | LookoutMtdV2_CL |
| MapNetflowUsername 🔍 | 📦 Solution | Cisco SD-WAN | ? |
| MarkLogicAudit | 📦 Solution | MarkLogicAudit | MarkLogicAudit_CL |
| McAfeeCommonSecurityLog | 📂 Legacy | CommonSecurityLog | |
| McAfeeEPOEvent | 📦 Solution | McAfee ePolicy Orchestrator | Syslog |
| McAfeeNSPEvent | 📦 Solution | McAfee Network Security Platform | Syslog |
| MCASActivity | 📂 Legacy | MCASActivity_CL | |
| MerakiConfigurationChanges | 📂 Legacy | MerakiConfigurationChanges_CL | |
| MerakiSecurityEvents | 📂 Legacy | MerakiSecurityEvents_CL | |
| MESCheckOnlineVIP | 📦 Solution | Microsoft Exchange Security - Exchange Online | ? |
| MESCheckVIP | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | ? |
| MESCompareDataMRA | 📦 Solution | Microsoft Exchange Security - Exchange Online | ESIExchangeOnlineConfig_CL |
| MESCompareDataOnPMRA | 📦 Solution | Microsoft Exchange Security - Exchange On-Premises | ESIExchangeConfig_CL |
| MESOfficeActivityLogs | 📦 Solution | Microsoft Exchange Security - Exchange Online | OfficeActivity |
| MimecastAudit | 📦 Solution | Mimecast | Audit_CL |
| MimecastCG | 📦 Solution | Mimecast | Seg_Cg_CL |
| MimecastCloudIntegrated | 📦 Solution | Mimecast | Cloud_Integrated_CL |
| MimecastDLP | 📦 Solution | Mimecast | Seg_Dlp_CL |
| MimecastTTPAttachment | 📦 Solution | Mimecast | Ttp_Attachment_CL |
| MimecastTTPImpersonation | 📦 Solution | Mimecast | Ttp_Impersonation_CL |
| MimecastTTPUrl | 📦 Solution | Mimecast | Ttp_Url_CL |
| MongoDBAudit | 📦 Solution | MongoDBAudit | MongoDBAudit_CL |
| Morphisec | 📦 Solution | Morphisec | MorphisecAlerts_CL |
| MSBizAppsNetworkAddresses | 📦 Solution | Microsoft Business Applications | ? |
| MSBizAppsOrgSettings | 📦 Solution | Microsoft Business Applications | ? |
| MSBizAppsTerminatedEmployees | 📦 Solution | Microsoft Business Applications | ? |
| MSBizAppsVIPUsers | 📦 Solution | Microsoft Business Applications | ? |
| MuleSoftCloudhub | 📦 Solution | Mulesoft | MuleSoft_Cloudhub_CL |
| Netskope 🔍 | 📦 Solution | Netskope | Netskope_CL |
| NetskopeAlerts | 📦 Solution | Netskopev2 | NetskopeAlerts_CL |
| NetskopeCCFWebTransactions | 📦 Solution | Netskopev2 | NetskopeWebTransactions_CL |
| NetskopeCEAlerts | 📦 Solution | Netskopev2 | Netskope_Alerts_CL |
| NetskopeCEEventsApplication | 📦 Solution | Netskopev2 | Netskope_Events_CL |
| NetskopeCEWebTransactions | 📦 Solution | Netskopev2 | Netskope_WebTX_CL |
| NetskopeEventsApplication | 📦 Solution | Netskopev2 | NetskopeEventsApplication_CL |
| NetskopeEventsAudit | 📦 Solution | Netskopev2 | NetskopeEventsAudit_CL |
| NetskopeEventsConnection | 📦 Solution | Netskopev2 | NetskopeEventsConnection_CL |
| NetskopeEventsDLP | 📦 Solution | Netskopev2 | NetskopeEventsDLP_CL |
| NetskopeEventsEndpoint | 📦 Solution | Netskopev2 | NetskopeEventsEndpoint_CL |
| NetskopeEventsInfrastructure | 📦 Solution | Netskopev2 | NetskopeEventsInfrastructure_CL |
| NetskopeEventsNetwork | 📦 Solution | Netskopev2 | NetskopeEventsNetwork_CL |
| NetskopeEventsPage | 📦 Solution | Netskopev2 | NetskopeEventsPage_CL |
| NetskopeWebTransactions | 📦 Solution | Netskopev2 | NetskopeWebtxData_CL |
| NetskopeWebtx | 📦 Solution | NetskopeWebTx | NetskopeWebTransactions_CL |
| NetwrixAuditor | 📦 Solution | Netwrix Auditor | CommonSecurityLog |
| NGINXHTTPServer | 📦 Solution | NGINX HTTP Server | NGINX_CL |
| NozomiNetworksEvents | 📦 Solution | NozomiNetworks | CommonSecurityLog |
| NXLog_parsed_AIX_Audit_view 🔍 | 📦 Solution | NXLogAixAudit | AIX_Audit_CL |
| OCILogs | 📦 Solution | Oracle Cloud Infrastructure | OCI_LogsV2_CL, OCI_Logs_CL |
| OktaSSO | 📦 Solution | Okta Single Sign-On | OktaV2_CL, Okta_CL |
| OnapsisLookup | 📦 Solution | Onapsis Platform | ? |
| OneIdentity_Safeguard 🔍 | 📦 Solution | OneIdentity | CommonSecurityLog |
| OneLogin | 📦 Solution | OneLoginIAM | OneLoginEventsV2_CL, OneLoginUsersV2_CL, ... |
| OneLoginEvents | 📂 Legacy | oneLogin_CL | |
| OpenVpnEvent | 📦 Solution | OpenVPN | Syslog |
| OracleDatabaseAuditEvent | 📦 Solution | OracleDatabaseAudit | Syslog |
| OracleWebLogicServerEvent | 📦 Solution | OracleWebLogicServer | OracleWebLogicServer_CL |
| OSSECEvent | 📦 Solution | OSSEC | CommonSecurityLog |
| PaloAltoCDLEvent | 📦 Solution | PaloAltoCDL | CommonSecurityLog |
| PaloAltoPrismaCloud | 📦 Solution | PaloAltoPrismaCloud | PaloAltoPrismaCloudAlertV2_CL, PaloAltoPrismaCloudAlert_CL, ... |
| pfsensefilterlog | 📂 Legacy | CommonSecurityLog | |
| pfsensenginx | 📂 Legacy | CommonSecurityLog | |
| PingFederateEvent | 📦 Solution | PingFederate | CommonSecurityLog |
| PostgreSQLEvent | 📦 Solution | PostgreSQL | PostgreSQL_CL |
| ProofpointPOD | 📦 Solution | Proofpoint On demand(POD) Email Security | ProofpointPODMailLog_CL, ProofpointPODMessage_CL, ... |
| ProofpointTAPEvent | 📦 Solution | ProofPointTap | ProofPointTAPClicksBlockedV2_CL, ProofPointTAPClicksBlocked_CL, ... |
| PulseConnectSecure | 📦 Solution | Pulse Connect Secure | Syslog |
| PureStorageFlashArrayParserV1 | 📦 Solution | Pure Storage | Syslog |
| PureStorageFlashBladeParserV1 | 📦 Solution | Pure Storage | Syslog |
| QualysHostDetection | 📦 Solution | QualysVM | QualysHostDetectionV2_CL, QualysHostDetectionV3_CL, ... |
| QualysKB | 📦 Solution | Qualys VM Knowledgebase | QualysKB_CL, QualysKnowledgeBase |
| RadiflowEvent | 📦 Solution | Radiflow | CommonSecurityLog |
| RSASecurIDAMEvent | 📦 Solution | RSA SecurID | Syslog |
| SalesforceServiceCloud | 📦 Solution | Salesforce Service Cloud | SalesforceServiceCloudV2_CL, SalesforceServiceCloud_CL |
| SentinelOne | 📦 Solution | SentinelOne | SentinelOneActivities_CL, SentinelOneAgents_CL, ... |
| SlackAudit | 📦 Solution | SlackAudit | SlackAuditNativePoller_CL, SlackAuditV2_CL, ... |
| Snowflake | 📦 Solution | Snowflake | SnowflakeLoad_CL, SnowflakeLogin_CL, ... |
| SophosEPEvent | 📦 Solution | Sophos Endpoint Protection | ? |
| SophosXGFirewall | 📦 Solution | Sophos XG Firewall | Syslog |
| SQLServer_Parser | 📂 Legacy | Event | |
| SquidProxy | 📦 Solution | SquidProxy | SquidProxy_CL |
| StealthDefend | 📂 Legacy | CommonSecurityLog | |
| StealthwatchEvent | 📦 Solution | Cisco Secure Cloud Analytics | Syslog |
| SymantecDLP | 📦 Solution | Broadcom SymantecDLP | CommonSecurityLog |
| SymantecEndpointProtection | 📦 Solution | Symantec Endpoint Protection | Syslog |
| SymantecProxySG | 📂 Legacy | Syslog | |
| SymantecProxySG | 📦 Solution | SymantecProxySG | Syslog |
| SymantecVIP | 📦 Solution | Symantec VIP | Syslog |
| SyslogEventTypeData | 📂 Legacy | Syslog | |
| SyslogExecve | 📂 Legacy | Syslog | |
| SyslogSyscall | 📂 Legacy | Syslog | |
| SyslogUserErr | 📂 Legacy | Syslog | |
| Sysmon-AllVersions_Parser | 📂 Legacy | Event | |
| Sysmon-v10.42-Parser | 📂 Legacy | Event | |
| Sysmon-v11.0 | 📂 Legacy | Event | |
| Sysmon-v12.0 | 📂 Legacy | Event | |
| Sysmon-v9.10-Parser | 📂 Legacy | Event | |
| TenableIOAssets 🔍 | 📦 Solution | TenableIO | Tenable_IO_Assets_CL |
| TenableIOVulnerabilities 🔍 | 📦 Solution | TenableIO | Tenable_IO_Vuln_CL |
| TenableVMAssets | 📦 Solution | Tenable App | Tenable_VM_Asset_CL |
| TenableVMVulnerabilities | 📦 Solution | Tenable App | Tenable_VM_Vuln_CL |
| TheHive 🔍 | 📦 Solution | TheHive | TheHive_CL |
| ThreatIntelIndicatorsv2 | 📦 Solution | Threat Intelligence (NEW) | ThreatIntelIndicators |
| TMApexOneEvent | 📦 Solution | Trend Micro Apex One | CommonSecurityLog |
| TomcatEvent | 📦 Solution | Tomcat | Tomcat_CL |
| TrellixEvents | 📦 Solution | Trellix | TrellixEvents_CL |
| TrendMicroCAS 🔍 | 📦 Solution | Trend Micro Cloud App Security | TrendMicroCAS_CL |
| TrendMicroDeepSecurity | 📦 Solution | Trend Micro Deep Security | CommonSecurityLog |
| TrendMicroTippingPoint | 📦 Solution | Trend Micro TippingPoint | CommonSecurityLog |
| UbiquitiAuditEvent | 📦 Solution | Ubiquiti UniFi | Ubiquiti_CL |
| Unified_ApigeeX | 📦 Solution | Google Apigee | ApigeeXV2_CL, ApigeeX_CL |
| vCenter | 📦 Solution | VMware vCenter | vcenter_CL |
| vectra_beacon | 📦 Solution | Vectra AI Stream | vectra_beacon_CL |
| vectra_dcerpc | 📦 Solution | Vectra AI Stream | vectra_dcerpc_CL |
| vectra_dhcp | 📦 Solution | Vectra AI Stream | vectra_dhcp_CL |
| vectra_dns | 📦 Solution | Vectra AI Stream | vectra_dns_CL |
| vectra_http | 📦 Solution | Vectra AI Stream | vectra_http_CL |
| vectra_isession | 📦 Solution | Vectra AI Stream | vectra_isession_CL |
| vectra_kerberos | 📦 Solution | Vectra AI Stream | vectra_kerberos_CL |
| vectra_ldap | 📦 Solution | Vectra AI Stream | vectra_ldap_CL |
| vectra_match | 📦 Solution | Vectra AI Stream | vectra_match_CL |
| vectra_ntlm | 📦 Solution | Vectra AI Stream | vectra_ntlm_CL |
| vectra_radius | 📦 Solution | Vectra AI Stream | vectra_radius_CL |
| vectra_rdp | 📦 Solution | Vectra AI Stream | vectra_rdp_CL |
| vectra_smbfiles | 📦 Solution | Vectra AI Stream | vectra_smbfiles_CL |
| vectra_smbmapping | 📦 Solution | Vectra AI Stream | vectra_smbmapping_CL |
| vectra_smtp | 📦 Solution | Vectra AI Stream | vectra_smtp_CL |
| vectra_ssh | 📦 Solution | Vectra AI Stream | vectra_ssh_CL |
| vectra_ssl | 📦 Solution | Vectra AI Stream | vectra_ssl_CL |
| vectra_stream | 📦 Solution | Vectra AI Stream | ? |
| vectra_x509 | 📦 Solution | Vectra AI Stream | vectra_x509_CL |
| VectraAudits | 📦 Solution | Vectra XDR | Audits_Data_CL |
| VectraDetections | 📦 Solution | Vectra XDR | Detections_Data_CL |
| VectraEntityScoring | 📦 Solution | Vectra XDR | Entity_Scoring_Data_CL |
| VectraHealth | 📦 Solution | Vectra XDR | Health_Data_CL |
| VectraLockdown | 📦 Solution | Vectra XDR | Lockdown_Data_CL |
| VectraStream_function | 📦 Solution | Vectra AI Stream | VectraStream_CL |
| Veeam_GetFinishedConfigurationBackupSessions | 📦 Solution | Veeam | Syslog |
| Veeam_GetJobFinished | 📦 Solution | Veeam | Syslog |
| Veeam_GetSecurityEvents | 📦 Solution | Veeam | Syslog |
| Veeam_GetVeeamONEAlarms | 📦 Solution | Veeam | Syslog |
| VersasecCmsError | 📦 Solution | VersasecCMS | VersasecCmsErrorLogs_CL |
| VersasecCmsSyslog | 📦 Solution | VersasecCMS | VersasecCmsSysLogs_CL |
| vimNetworkSessionOpenSystemsFirewall 🔍 | 📦 Solution | Open Systems | OpenSystemsFirewallLogs_CL |
| vimWebSessionOpenSystemsProxySecureWebGateway 🔍 | 📦 Solution | Open Systems | OpenSystemsProxyLogs_CL |
| VMwareESXi | 📦 Solution | VMWareESXi | Syslog |
| VotiroEvents | 📦 Solution | Votiro | CommonSecurityLog |
| WatchGuardFirebox 🔍 | 📦 Solution | Watchguard Firebox | Syslog |
| Workplace_Facebook 🔍 | 📦 Solution | Workplace from Facebook | Workplace_Facebook_CL |
| ZNSegmentAudit | 📦 Solution | ZeroNetworks | ZNAudit_CL, ZNSegmentAuditNativePoller_CL |
| Zoom | 📂 Legacy | Zoom_CL | |
| Zoom | 📦 Solution | ZoomReports | Zoom_CL |
| ZPAEvent | 📦 Solution | Zscaler Private Access (ZPA) | ZPA_CL |
📦 In solution package
📂 Legacy parser (Parsers folder)
🔍 Discovered (not in solution JSON)
Unifying Aggregates multiple source parsers
Source Parses a specific product log