ServiceNow - Large Amount of Tickets Updated by Single User Within Short Time Period
An attacker has gained access to internal systems, and is now closing large amounts of tickets to cover their tracks. This could indicate account compromise, especially if paired with alerts for logins from new IP addresses or a successful login after a brute force attack. By identifying an influx of closed tickets
Microsoft Sentinel (KQL)
