Azure Sentinel
@AzureSentinel50 followers935 downloads1,416 copies43 likes37,639 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
This query visualises total emails with Spoof - DKIM fails summarizing the data daily.
This rule detects emails delivered to an inbox that contain URLs identified as malicious by OpenPhish, indicating a successful phishing attempt or delivery of a known malicious link.
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a
This rule detects attempts to flush Shimcache using rundll32.exe, which can indicate anti-forensic activity or defense evasion by an attacker. The detection logic specifically looks for command-line arguments associated with flushing the Shimcache, including function names like "ShimFlushCache" or "BaseFlushAppcompatCache", and also checks for ordinal values combined with specific DLLs like "apphelp.dll" or "kernel32.dll".
This rule detects inbound emails containing URLs that are commonly used for OAuth consent phishing, where an attacker attempts to trick users into granting permissions to a malicious application.
(no description)
This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6).
This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught.
This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
Page 1 of 123