cloudflare/Azure-Sentinel

Public

mirrored fromhttps://github.com/cloudflare/Azure-Sentinel

Watch0 Fork0 Star0

Code Commits Issues Pull requests Actions Insights Security

84542793ff7980cc6e7e0b1a0cc691410bd17cc5

Find a branch or tag

Branches

Clone

HTTPS

Download ZIP

Azure-Sentinel/Detections

Name	Last committed	Last updated
Replaced 'Domain' with 'Computer' in the join because domain will be 'Builtin' for the group and host/domain for the user, preventing a match. Also replaced 'CreatedUser' with 'CreatedUserSid' because the group add entry may not reliably include the name of the user added to the group (SID is also a more reliable identifier in general). Lasltly, removed 'where CreatedUserTime < GroupAddTime' because I'm not sure any other case is possible without manually rigging the logs.8454279 7 years ago
AWSCloudTrail	change technique to tactic	7 years ago
AzureActivity	change technique to tactic	7 years ago
CommonSecurityLog	change technique to tactic	7 years ago
DnsEvents	change technique to tactic	7 years ago
MultipleDataSources	Adding in Ajeet's for March	7 years ago
OfficeActivity	OfficeActivity detections and hunting from ashwin (#141)	7 years ago
SecurityEvent	Replaced 'Domain' with 'Computer' in the join because domain will be 'Builtin' for the group and host/domain for the user, preventing a match. Also replaced 'CreatedUser' with 'CreatedUserSid' because the group add entry may not reliably include the name of the user added to the group (SID is also a more reliable identifier in general). Lasltly, removed 'where CreatedUserTime < GroupAddTime' because I'm not sure any other case is possible without manually rigging the logs.	7 years ago
SigninLogs	Azure portal brute foce (#136)	7 years ago
Syslog	change technique to tactic	7 years ago
VMConnection	Adding a couple of interesting queries I threw together while doing r… (#142)	7 years ago

About

No description, website, or topics provided.

No topics configured for this repository.

No releases published yet.

No packages published yet.

Edit repository details

Custom properties

No custom properties are defined for this repository.

Activity

Replaced 'Domain' with 'Computer' in the join because domain will be 'Builtin' for the group and host/domain for the user, preventing a match. Also replaced 'CreatedUser' with 'CreatedUserSid' because the group add entry may not reliably include the name of the user added to the group (SID is also a more reliable identifier in general). Lasltly, removed 'where CreatedUserTime < GroupAddTime' because I'm not sure any other case is possible without manually rigging the logs. (7 years ago)

Languages

No language metadata available.

cloudflare/Azure-Sentinel

Branches

Tags

Clone