All Detections

Rare User Agent strings

Azure Sentinel@AzureSentinel
updated Jun 17, 20251020

'This will check for Rare User Agent strings over the last 3 days. This can indicate potential probing of your IIS servers.'

Microsoft Sentinel (KQL)