All Detections

UNC6395 Malicious User-Agent Activity - Defender KQL

avatar
Tony D@antonyd22alb
updated Oct 7, 2025252378

This rule detects HTTP requests containing User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.

Microsoft Sentinel (KQL)