Erik van Kruiselbergen
@RideMeUpCompletionist
0 followers0 downloads28 copies2 likes428 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
MITRE Techniques
1
1
1
1
1
This rule detects suspicious multi-factor authentication (MFA) behavior by identifying MFA denials that occur from an unknown IP address or with an unusual authentication method for a given user. It establishes a baseline of known IP addresses and usual authentication methods for each user over a 30-day period. Alerts are generated for recent MFA denials (within the last hour) if they involve a high-risk denial detail (e.g., too many invalid codes, user blocked) combined with an unknown IP or unusual authentication method, or if they involve any other denial reason combined with both an unknown IP and an unusual authentication method. This helps to identify potential MFA fatigue attacks or attempts to bypass MFA.
This rule detects the creation or modification of Exchange transport rules or inbox rules that forward or redirect emails to external domains. It specifically looks for operations like 'New-TransportRule', 'Set-TransportRule', 'New-InboxRule', 'Set-InboxRule', 'Set-Mailbox', 'UpdateInboxRules', and 'Set-TransportConfig' where the destination is an email address outside of the organization's verified domains. This activity can indicate data exfiltration or an attempt to maintain persistence and collect sensitive information.
Detects changes to Microsoft.ManagedServices resources (registration definitions and assignments) where the affected resource group matches your known Sentinel resource group. In other words: someone touched your delegation.
This covers both expected changes (your own team onboarding or offboarding a customer) and unexpected ones (a customer admin making unauthorised modifications). The rule fires on both write and delete operations with a successful status.
This covers both expected changes (your own team onboarding or offboarding a customer) and unexpected ones (a customer admin making unauthorised modifications). The rule fires on both write and delete operations with a successful status.