• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Disabled accounts using Squid proxy

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•21

    'Query finds accounts recorded as disabled by AD in previous time period but still using proxy in current time period. Presumes default squid log format is used. http://www.squid-cache.org/Doc/config/access_log/'

    Microsoft Sentinel (KQL)

    Tags

    T1110 - Brute ForceTA0006 - Credential AccessT1090 - ProxyT1090.001 - Internal ProxyT1098 - Account ManipulationT1136 - Create AccountDS0002 - User AccountTA0011 - Command and ControlTA0003 - PersistenceTA0004 - Privilege EscalationCredential AccessProxy RequestWindowsLinuxNetwork GenericSquid ProxySyslog Generic ForwarderAzure Signin LogsActive Directory Domain Serviceskqltactic:CredentialAccesstechnique:T1110

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?