Igor Oliveira
@Pr0fiLeRR2 followers156 downloads197 copies6 likes3,877 views
26 detections
Filters
Last updated
All Time
Detection languages
16
10
Categories
5
2
1
1
1
Platforms
14
3
2
2
Products / Services
10
3
1
MITRE Techniques
4
4
4
4
2
CVEs
2
1
This is highly adjustable script that tells us whether HTTPS request was successful, the reason why it was blocked or not, and on top of that, it explains the error code. This is still a work-in-progress but it already does 99% of the job.
Detects configuration changes on firewall devices via CommonSecurityLog.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
This query will work every 30 minutes to see if anyone that's not InfoSec performed any administrative Identity actions on users. This will also depend on your company policy, if only Information Security members are allowed to perform actions on risky users such as dismissing users, then this will trigger.
This query detect when a AD user end up becoming Risky for some reason.
Detects actions performed on RiskyUsers in Azure Entra ID by unauthorized
members. Specifically looks for CA or GA accounts performing IdentityProtection
actions where the admin is not from the Information Security department.
Note: String parsing (AdminLocalPart, AdminLastName, StrippedAdminName),
fallback identity matching, summarize arg_max, and project are handled
natively in KQL post-conversion.
members. Specifically looks for CA or GA accounts performing IdentityProtection
actions where the admin is not from the Information Security department.
Note: String parsing (AdminLocalPart, AdminLastName, StrippedAdminName),
fallback identity matching, summarize arg_max, and project are handled
natively in KQL post-conversion.
This KQL script detects if end user interacted with a PDF attachment in a potential phishing/BEC incident
Enrichment rule pulling identity details from IdentityInfo table.
Correlated with AuditLogs via AccountUPN to enrich admin and target
user identity details including department and job title.
Used in correlation with Rule 09198296-c7e9-43a7-b85f-6aaa70d281c5
via correlation rule 5841b08f-f363-4139-a70a-5cc91e13efc3.
Note: Multiple join fallback logic (by UPN, last name, full name)
and StrippedAdminName prefix removal are handled natively in KQL.
Correlated with AuditLogs via AccountUPN to enrich admin and target
user identity details including department and job title.
Used in correlation with Rule 09198296-c7e9-43a7-b85f-6aaa70d281c5
via correlation rule 5841b08f-f363-4139-a70a-5cc91e13efc3.
Note: Multiple join fallback logic (by UPN, last name, full name)
and StrippedAdminName prefix removal are handled natively in KQL.
Correlates AuditLogs and IdentityInfo on AccountUPN to detect
unauthorized CA or GA members performing IdentityProtection actions
on RiskyUsers in Azure Entra ID outside of the Information Security
department.
Note: The following logic is NOT expressible in Sigma and must be
applied post-conversion in native KQL:
- Multiple join fallback matching (by UPN, last name, full name)
- StrippedAdminName prefix removal (CA - / GA - )
- summarize arg_max(TimeGenerated, *) by AccountUPN
- iff() fallback logic for department and job title
- sort by TimeGenerated desc
- project-reorder
unauthorized CA or GA members performing IdentityProtection actions
on RiskyUsers in Azure Entra ID outside of the Information Security
department.
Note: The following logic is NOT expressible in Sigma and must be
applied post-conversion in native KQL:
- Multiple join fallback matching (by UPN, last name, full name)
- StrippedAdminName prefix removal (CA - / GA - )
- summarize arg_max(TimeGenerated, *) by AccountUPN
- iff() fallback logic for department and job title
- sort by TimeGenerated desc
- project-reorder
Detects logons to Keystone core banking system outside of business hours.
Excludes specific departments and job titles that have extended access.
Note: Timezone conversion (UTC to PST), WeekDay function, summarize, and
project-reorder are handled natively in KQL post-conversion.
Excludes specific departments and job titles that have extended access.
Note: Timezone conversion (UTC to PST), WeekDay function, summarize, and
project-reorder are handled natively in KQL post-conversion.
This will show clearly the daily successful traffic for each day of the week, and then it will project the peak hours, medium and low hours of each day. And in the last column, it shows the Imperva rule that it hit, which also indicates if an attack was successful.
Page 1 of 3