Azure Sentinel
@AzureSentinel50 followers944 downloads1,418 copies43 likes37,655 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
'This rule identifies a web request with a user agent header known to belong to a crypto miner. This indicates a crypto miner may have infected the client machine.<br>You can add custom crypto mining indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br> This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
'Query identifies users denied registration for multiple webinars or recordings but successfully registered for at least one event. Threshold variable adjusts number of events user needs to be rejected from.'
'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This query identifies when a user clicks a link that opens a browser to navigate to a URL
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
which uses redirection. It then filters out any redirections to URLs in the same DNS namespace
as the originating URL. Redirection identification is done based on URL query parameters
outlined in the following article: https://www.bleepingcomputer.com/news/security/snapchat-amex-sites-abused-in-microsoft-365-phishing-attacks/
This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Added credential from country X and Signed-In from country Y in a pecific time window:
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
Malicious emails often contain documents and other specially crafted attachments that run PowerShell commands to deliver additional payloads. If you are aware of emails coming from a known malicious sender, you can use this query to list and review PowerShell activities that occurred within 30 minutes after an email was received from the sender .
Use this query to locate persistence in Startup with HTA files.
Page 57 of 123