Andre Zeemering
@AzeemeringAmsterdam, NetherlandsTrusted contributor
5 followers84 downloads193 copies27 likes2,579 views
18 detections
Filters
Last updated
All Time
Detection languages
17
1
Categories
4
2
2
1
1
Platforms
7
3
2
1
Products / Services
3
2
2
1
1
MITRE Techniques
5
4
3
3
3
Microsoft Entra ID Protection can provide a broad range of risk detections that can be used to identify suspicious activity in your organization.
This KQL detection rule identifies and prioritizes high-fidelity user risk events in Azure AD. It focuses on high-fidelity risk event types, filtering out known, noisy, or low-fidelity events to ensure alerts are accurate, actionable, and reliable.
This KQL detection rule identifies and prioritizes high-fidelity user risk events in Azure AD. It focuses on high-fidelity risk event types, filtering out known, noisy, or low-fidelity events to ensure alerts are accurate, actionable, and reliable.
This query detects URLs shared in Microsoft Teams messages, chats, or meetings that may represent potential security risks. It filters out internal domains, SharePoint URLs, placeholder links, and known system domains to focus specifically on unique external URLs being exchanged within the organization.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
The detection is useful for identifying phishing attempts, malware distribution, unauthorized data sharing, or other unsafe activities originating from collaboration tools.
Microsoft Threat Intelligence observed Russian military Intelligence actor Seashell Blizzard conduct a phishing campaign using Excel attachments embedded with the custom CheapShot malware. CheapShot allows the actor to maintain persistence on targeted devices, likely to support intelligence collection. The actor primarily targeted critical infrastructure and key resources in Ukraine and Europe.
Search for events in your network and locate potential CheapShot malware- related indicators.
The file hashes are associated with CheapShot activity.
Search for events in your network and locate potential CheapShot malware- related indicators.
The file hashes are associated with CheapShot activity.
Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Sentinel analytics rule monitors who has elevated access in your tenant so that admins can take appropriate action.
This KQL detection rule identifies suspicious login attempts in the SigninLogs dataset where a sign-in was blocked because it originated from an IP address flagged for malicious activity.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
This query is designed to identify any attempts to list or enumerate Windows Security Logs using the command-line tool "wevtutil." It focuses on detecting a specific technique known as "Log Collection" (T1654). Here's a simple breakdown of what the query does:
Time Frame: It looks at data from the past 7 days.
Source: It examines events related to processes on devices (DeviceProcessEvents).
Filter Criteria:
It checks for events where a process was created (ActionType contains "ProcessCreated").
It specifically looks for instances where the process involved is "wevtutil.exe" and the command line used includes "enum-logs."
Output: The query extracts and displays specific details about these events, including:
The name of the device where the event occurred (DeviceName).
The type of action that was recorded (ActionType).
The name of the file involved (FileName).
The full command line that was executed (ProcessCommandLine).
The domain and name of the account that executed the command (AccountDomain, AccountName).
The user principal name and command line of the initiating process (InitiatingProcessAccountUpn, InitiatingProcessCommandLine).
In summary, this query helps security analysts detect and investigate potential unauthorized attempts to access or list Windows Security Logs using the "wevtutil" tool.
Time Frame: It looks at data from the past 7 days.
Source: It examines events related to processes on devices (DeviceProcessEvents).
Filter Criteria:
It checks for events where a process was created (ActionType contains "ProcessCreated").
It specifically looks for instances where the process involved is "wevtutil.exe" and the command line used includes "enum-logs."
Output: The query extracts and displays specific details about these events, including:
The name of the device where the event occurred (DeviceName).
The type of action that was recorded (ActionType).
The name of the file involved (FileName).
The full command line that was executed (ProcessCommandLine).
The domain and name of the account that executed the command (AccountDomain, AccountName).
The user principal name and command line of the initiating process (InitiatingProcessAccountUpn, InitiatingProcessCommandLine).
In summary, this query helps security analysts detect and investigate potential unauthorized attempts to access or list Windows Security Logs using the "wevtutil" tool.
Detection of spear-phishing emails containing a signed Remote Desktop Protocol (RDP) configuration file designed to connect to an actor-controlled server. In some cases, the threat actor attempted to enhance credibility by impersonating Microsoft employees and referencing other cloud providers in the phishing lures.dp files in Outlook temporary folders
SPL Query from file: Powershell encoded command observed
Page 2 of 2