• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Missing Domain Controller Heartbeat

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•1•0•30

    'This detection will go over the heartbeats received from the agents of Domain Controllers over the last hour, and will create alerts if the last heartbeats were received an hour ago.'

    Microsoft Sentinel (KQL)

    Tags

    T1499 - Endpoint Denial of ServiceT1564 - Hide ArtifactsTA0040 - ImpactTA0005 - Defense EvasionT1207 - Rogue Domain ControllerT1556.001 - Domain Controller AuthenticationTA0006 - Credential AccessTA0003 - PersistenceSystem Monitoring StatusWindowsMicrosoft IisActive Directory Domain Serviceskqltactic:Impacttactic:DefenseEvasiontechnique:T1499technique:T1564

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?