Azure Sentinel
@AzureSentinel50 followers965 downloads1,436 copies43 likes37,858 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
This query helps reviewing top 100 malicious senders
This query helps hunting for top outbound recipient domains which are sending inbound emails with threats
In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents
The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.
This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Find accounts that have been added/removed from groups in AD.
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if an instance of Qakbot has attempted to overwrite its original binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if an instance of Qakbot has attempted to overwrite its original binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
'This query detects Process Doppelganging, a technique that calls several APIs related to NTFS transactions which allow to substitute the PE content before the process is even created.
Ref: https://attack.mitre.org/techniques/T1055/013/'
Ref: https://attack.mitre.org/techniques/T1055/013/'
'Identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
Page 70 of 123