Jan Mulder
@Wolkenman0 followers5 downloads17 copies0 likes131 views
16 detections
Filters
Last updated
All Time
Detection languages
16
Categories
3
2
1
1
1
Platforms
11
5
5
4
3
Products / Services
5
3
2
2
2
MITRE Techniques
2
2
2
1
1
IDS Classtypes
1
Detects Windows systems that have not installed a patch or update within the last 45 days by querying Quick Fix Engineering (QFE) installation dates.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects multiple failed sign-in attempts against specific high-privilege break-glass accounts in Microsoft Entra ID within a 1-hour window.
Detects devices that are missing a specific Windows Update KB5xxxxxx by checking the OsVersion table against the WindowsQfe update history table.
Detects and monitors sign-in events for specific high-privilege or sensitive accounts, such as break-glass accounts, within Microsoft Entra ID.
Identifies devices that have been enrolled within the last 30 days, displaying details such as device name, model, enrollment profile name, and enrollment date.
This rule detects devices with a BIOS release date older than 730 days (2 years), which could indicate unpatched or outdated firmware posing security and stability risks.
Detects queries checking for specific Windows hotfixes (QFE) using the WindowsQfe table.
Summarizes the count of devices grouped by their manufacturer and model from device inventory or telemetry data.
Summarizes the count of devices by CPU manufacturer and architecture using Kusto Query Language (KQL).
Page 1 of 2