Azure Sentinel
@AzureSentinel50 followers965 downloads1,435 copies43 likes37,857 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
'CreepyDrive uses OneDrive for command and control, however, it makes regular requests to predicatable paths.
This detecton will alert when over 20 sequences are observed in a single day.'
This detecton will alert when over 20 sequences are observed in a single day.'
'This query searches for successful user logins from different countries within 3 hours.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
'This query looks for accounts being created where the name does not match a defined pattern.
Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts.
Created accounts should be investigated to ensure they were legitimated created.
The user_regex field in the query needs to be populated with the expected pattern for the environment before deployment.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies'
Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts.
Created accounts should be investigated to ensure they were legitimated created.
The user_regex field in the query needs to be populated with the expected pattern for the environment before deployment.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies'
'Identifies when a recently created Group was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expected addition.
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
Find use of Alternate Data Streams (ADS) for anti-forensic purposes.
Alternate Data Streams execution.
Alternate Data Streams execution.
'Attacker can exfiltrate data from your GitHub repository by cloning it. This hunting query tracks clone activities for each repository, allowing quick identification of anomalies/excessive clones to investigate repo access & permissions.'
'Identifies accounts that have been added to a PIM managed privileged group'
Looks for accounts that uploaded multiple code repositories to external web domain.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_schtask_creation.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This query was originally published in the threat analytics report, SQL Server abuse.
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
Page 25 of 123