James Eduard Andaya
@JamesEduard0 followers4 downloads36 copies0 likes235 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
1
1
Products / Services
1
1
MITRE Techniques
2
1
1
1
1
Detects multiple failed connection attempts to Azure Database for MySQL, which may indicate a brute force attack. This rule specifically looks for 'Access Denied' errors (error code 1045) or other non-zero error codes during connection attempts within a defined timeframe from the same client IP address.
This detection monitors for the creation or deletion of files within the TokenBroker and AAD Broker Plugin cache folders. These folders store authentication tokens that, if accessed or manipulated by an unauthorized process, could indicate credential theft activity.