Tech Creaatives
@Techcreaatives0 followers7 downloads33 copies1 like576 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
Platforms
2
Products / Services
1
1
MITRE Techniques
2
2
1
1
1
This rule detects the presence of newly exposed risky web components, such as administrative panels or development tools, that have been discovered by Microsoft Defender External Attack Surface Management (EASM). The rule identifies components from a predefined list of 'risky_components' that have been seen for the first time within the last 7 days, indicating a recent exposure that could increase the attack surface.
This detection identifies when a user successfully authenticates from a country for the first time within a given period. It establishes a baseline of known countries for each user and alerts on any successful login originating from a country not present in that baseline. This behavior can indicate compromised credentials being used from an unusual location, or a legitimate user traveling to a new country.