23 detection rules reference this event. View event page.Kusto (23)
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 severity high T1546
- Azure VM Run Command operations executing a unique PowerShell script severity medium T1059, T1059.001, T1570
- Dataverse - Terminated employee exfiltration to USB drive severity high T1052
- Detect executable drops via Azure custom script extension T1021, T1021.008, T1651
- Detect LolDriver drop or load from unknown or unsigned process T1068
- Dev-0530 File Extension Rename severity high T1486
- Europium - Hash and IP IOCs - September 2022 severity high T1003, T1071
- Identify SysAid Server web shell creation severity high T1190
- Ingress Tool Transfer - Certutil severity low T1027, T1105, T1140, T1564, T1564.004
- Mercury - Domain, Hash and IP IOCs - August 2022 severity high T1071
- Microsoft Recommended Driver Block List
- PE file dropped in Color Profile Folder severity medium T1203
- Potential Build Process Compromise - MDE severity medium T1554
- Prestige ransomware IOCs Oct 2022 severity high T1203
- Rare Process as a Service severity medium T1543, T1543.003
- Remote File Creation with PsExec severity high T1570
- Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint)
- SUNBURST and SUPERNOVA backdoor hashes severity high T1059, T1195, T1546
- Suspicious MSC File Launched T1218, T1218.014, T1566
- TI Map File Hash to DeviceFileEvents Event severity medium T1071
- TI map File Hash to DeviceFileEvents Event severity medium T1071
- VTI - High Severity SHA1 Collision Detection severity high T1204
- Zinc Actor IOCs files - October 2022 severity high T1546