Azure Sentinel
@AzureSentinel50 followers944 downloads1,418 copies43 likes37,655 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Find all machines running a given Powersehll cmdlet.
This covers all Powershell commands executed in the Powershell engine by any process.
This covers all Powershell commands executed in the Powershell engine by any process.
This query was originally published in the threat analytics report, ShadowHammer supply chain attack
Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update infrastructure to deliver malware to the company's products. The campaign ran from June to November, 2018. ASUS has since responded with updates that protect their Live Update system, and diagnostic tools to check affected systems.
The following query checks for activity associated with the ShadowHammer implant or container over the past 30 days.
References:
https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
https://www.asus.com/News/hqfgVUyZ6uyAyJe1
Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update infrastructure to deliver malware to the company's products. The campaign ran from June to November, 2018. ASUS has since responded with updates that protect their Live Update system, and diagnostic tools to check affected systems.
The following query checks for activity associated with the ShadowHammer implant or container over the past 30 days.
References:
https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
https://www.asus.com/News/hqfgVUyZ6uyAyJe1
This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails
This query helps reviewing malicious email detections by detection methods
This query helps reviewing count of users attacked more than x times average.
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365.
This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress)
This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily
Page 64 of 123