31 detection rules reference this event. View event page.Kusto (31)
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 severity high T1546
- ADWS Connection from Unexpected Binary T1087, T1087.002, T1119
- DCOM Lateral Movement severity medium T1021, T1021.003
- Detect Msiexec executing DLL network connections T1218, T1218.007
- Europium - Hash and IP IOCs - September 2022 severity high T1003, T1071
- Execution of software vulnerable to webp buffer overflow of CVE-2023-4863 severity informational T1203
- Hunt for ADWS requests from unknown devices T1018, T1021, T1021.002, T1069, T1069.002, T1087
- Hunt for Defender for Identity NNR issues
- Hunt MDE with GSA events
- IP address of Windows host encoded in web request severity medium T1041, T1071, T1071.001
- Mercury - Domain, Hash and IP IOCs - August 2022 severity high T1071
- NTLM Relay Attack T1187, T1557, T1557.001
- Potential Kerberos Relaying Activity - MDE
- Rare Process as a Service severity medium T1543, T1543.003
- Regsvr32 Rundll32 Image Loads Abnormal Extension severity high T1218, T1218.010, T1218.011
- Regsvr32 Rundll32 with Anomalous Parent Process severity high T1218, T1218.010, T1218.011
- Scheduled Task - Suspicious Network Connection
- SMB/Windows Admin Shares severity medium T1021, T1021.002
- Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint)
- Star Blizzard C2 Domains August 2022 severity high T1566
- Suspicious Network Beacons - Microsoft Defender for Endpoint Aggregated Reports
- Suspicious Network Beacons - Microsoft Defender(MDE/M365D)
- Suspicious Network Connections - Supply Chain Attack
- Suspicious office child process created T1204
- TI Map Domain Entity to DeviceNetworkEvents severity medium T1071
- TI Map Domain Entity to DeviceNetworkEvents severity medium T1071
- TI Map IP Entity to DeviceNetworkEvents severity medium T1071
- TI Map IP Entity to DeviceNetworkEvents severity medium T1071
- TI Map URL Entity to DeviceNetworkEvents severity medium T1071
- TI Map URL Entity to DeviceNetworkEvents severity medium T1071
- Zinc Actor IOCs files - October 2022 severity high T1546