Azure Sentinel
@AzureSentinel50 followers944 downloads1,418 copies43 likes37,651 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
Endpoint Health with AV information
Find endpoints ASR Rules blocking
'Identifies when a recently created Group was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expected addition.
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
Find status change from Exposurelevel
Software Inventory by OS
Find LNK files on certain devices
One of the tricks used in phishing is obfuscating the domain name in a URL by
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
using the @ symbol. This technique goes all the way back to the original RFC
for URLs, RFC 1738. When you specify an @ in the DNS portion of a URL it denotes
that the left side of the DNS name holds a username and password for
authentication to the server on the right side of the @ sign. Unfortunately,
an attacker can use this technique to trick a user by formatting the URL as
http://www.trusteddomain.com@www.realdomain.com/. When a user sees the link
may they think they're going to www.trusteddomain.com when in fact they are
going to www.realdomain.com. For a working example, try this:
http://www.google.com@www.bing.com/.
This query finds this technique in URLs embedded within e-mails and highlights
the fake and real domains.
Count of sender's email addresses by subject
This query identifies web content filtering events in Advanced Hunting.
Find objects that have been added/removed to different OUs in AD.
Page 120 of 123