Azure Sentinel
@AzureSentinel50 followers944 downloads1,418 copies43 likes37,652 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
This query looks for mass downloads identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
Query for processes that accessed more than 10 IP addresses over port 445 (SMB) - possibly scanning for network shares.
To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135.
Tags: #SMB, #NetworkScanning, #UniqueProcessId.
To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135.
Tags: #SMB, #NetworkScanning, #UniqueProcessId.
'Identifies clients with a high NXDomain count which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). Alert is generated when a new IP address is seen (based on not being seen associated with
NXDomain records in prior 10-day baseline period).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
NXDomain records in prior 10-day baseline period).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
'This hunting query will try to identify the user account used to perform a file upload to blob storage.
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
'Highlights accounts associated with multiple authentications from different geographical locations in a short period of time.'
Microsoft has observed Bazacall using Cobalt Strike in order to move laterally to other machines on the network.
'Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed.
Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP.
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges).
Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location.
Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.'
Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP.
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges).
Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location.
Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.'
'Identifies when the Azure Run Command operation is executed by a UserPrincipalName and IP Address that has resulted in a recent user entity behaviour alert.'
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can help locate a reverse shell established by an attacker. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can help locate a reverse shell established by an attacker. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Page 19 of 123