Gurpreet Suhi
@gsuhi0 followers7 downloads116 copies1 like2,518 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
2
2
1
1
1
Platforms
3
2
Products / Services
3
2
MITRE Techniques
2
2
1
1
1
This rule detects network connections from devices to a predefined list of domains commonly associated with data exfiltration services. Monitoring these connections can help identify attempts to transfer sensitive data out of the network.
Detects when an administrator grants consent to an application on behalf of all users in an Azure AD tenant. This can be a legitimate administrative action but can also be abused by attackers to gain broad access to resources and data within the organization.
Detects successful network connections over FTP (port 21) or SSH (port 22) initiated by common file transfer applications such as WinSCP, FileZilla, psftp, or scp. This activity could indicate data exfiltration, unauthorized access, or command and control.
This rule detects suspicious or malicious use of mshta.exe. It flags executions where mshta.exe is not launched from standard system directories (C:\Windows\System32 or C:\Windows\SysWOW64), or when its command line contains indicators of remote or script execution (e.g., URLs, .hta, .js, .vbs extensions, javascript:, vbscript:). Additionally, it identifies suspicious parent processes that initiate mshta.exe, such as command shells (cmd.exe, powershell.exe), script hosts (wscript.exe, cscript.exe), installers (msiexec.exe), or common Microsoft Office applications (winword.exe, excel.exe).
The below Sentinel KQL analytics rule is able to detect potential privilege escalation to Global Admin role via compromised service principal