Anomalous OS Login via Token (Kali365)
Correlates a successful authentication from a new, untrusted IP address utilizing a Linux/Kali User-Agent, a known signature of the Kali365 framework.
Microsoft Sentinel (KQL)

Correlates a successful authentication from a new, untrusted IP address utilizing a Linux/Kali User-Agent, a known signature of the Kali365 framework.

Already have an account?