Igor Oliveira
@Pr0fiLeRR2 followers156 downloads197 copies6 likes3,877 views
26 detections
Filters
Last updated
All Time
Detection languages
16
10
Categories
5
2
1
1
1
Platforms
14
3
2
2
Products / Services
10
3
1
MITRE Techniques
4
4
4
4
2
CVEs
2
1
Of course you can get an easier version to simply search emails by subject, this is too verbose. But this is used to make a workbook that will display a set of information about the incident and give you the possibility to click on a button, generate this and visit the incident's page.
This is a credential after-hours logon activity automation, whenever an employee that's not supposed to log on to the core banking system after hours do so, this will trigger and alert the SOC team.
This is for when we need to investigate user navigation through proxy logs to understand if visit was intentional or if it was a sideload (redirect/iframe/malvertising) causing the navigation.
This query is better used in a workbook for automation.
There are simpler versions of this when investigating manually, this is not for manual use on your day to day activities, this is for automation.
This simple query helps detect whether a user interacted with the URL within the email message or not.
Page 3 of 3