• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Device network events w low count FQDN

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•31

    Device Network Events Involving Low Count FQDNs. This query reduces network events to only those with the RemoteURL column populated,. Then parses the DNS name from the URL (if needed) and finds the least prevalent. FQDNs. The result is then joined with DeviceNetworkEvents to highlight anomalous. Network communication.

    Microsoft Sentinel (KQL)

    Tags

    TA0011 - Command and ControlT1070.005 - Network Share Connection RemovalT1126 - Network Share Connection RemovalT1049 - System Network Connections DiscoveryT1590.002 - DNST1071.004 - DNST1584.002 - DNS ServerTA0010 - ExfiltrationT1567.004 - Exfiltration Over WebhookT1074 - Data StagedS0586 - TAINTEDSCRIBET1063 - Security Software DiscoveryT1518.001 - Security Software DiscoveryTA0005 - Defense EvasionTA0007 - DiscoveryTA0043 - ReconnaissanceTA0042 - Resource DevelopmentTA0009 - CollectionNetwork Connection OutboundDNS QueryWindowsWindows Defender Atpkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?