Azure Sentinel
@AzureSentinel50 followers944 downloads1,418 copies43 likes37,651 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
'This hunting query identifies GitHub OAuth Apps that have restrictions disabled that may be a sign of compromise. Attacker will want to disable such security tools in order to go undetected. '
Find Endpoints policies settings via compliance settings in the registry
This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
URLs clicked in Email
Qakbot operators have been abusing the Craigslist messaging system to send malicious emails. These emails contain non-clickable links to malicious domains impersonating Craigslist, which the user is instructed to manually type into the address bar to access.
List all PnP Devices that have been allowed or blocked
Find all alert evidence for a single endpoint. This is handy for exporting to a third-party SIEM.
List all the scan types and device name of those scansg
This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
This query identifies UAC elevated processes by analyzing launches of consent.exe (the process that performs UAC elevation).
The first parameter of consent.exe is the process ID being elevated, therefore we extract this value and use a combination of
that ID and the DeviceId to join it with processes that ran UAC elevated on the device. Given that process IDs can be reused,
a time filter is performed to ensure that the elevation request and the process launch occur within a specified period of time
(as written 30 minutes).
The first parameter of consent.exe is the process ID being elevated, therefore we extract this value and use a combination of
that ID and the DeviceId to join it with processes that ran UAC elevated on the device. Given that process IDs can be reused,
a time filter is performed to ensure that the elevation request and the process launch occur within a specified period of time
(as written 30 minutes).
Page 121 of 123