30 detection rules reference this catalog entry. View catalog entry.Kusto (30)
- Dataverse - Anomalous application user activity severity medium T0834,T0859,T0871,T1528,T1569
- Dataverse - Audit log data deletion severity low T1070
- Dataverse - Audit logging disabled severity low T1685
- Dataverse - Bulk record ownership re-assignment or sharing severity medium T1548
- Dataverse - Export activity from terminated or notified employee severity medium T1048,T1567
- Dataverse - Hierarchy security manipulation severity medium T1078,T1548
- Dataverse - Honeypot instance activity severity medium T1526,T1538,T1567
- Dataverse - Login by a sensitive privileged user severity high T1078,T1133,T1190,T1212
- Dataverse - Login from IP in the block list severity high T1078,T1133,T1190
- Dataverse - Login from IP not in the allow list severity high T1078,T1133,T1190
- Dataverse - Malware found in SharePoint document management site severity medium T1204
- Dataverse - Mass deletion of records severity medium T1485
- Dataverse - Mass export of records to Excel severity low T1567
- Dataverse - Mass record updates severity medium T1485,T1565,T1641
- Dataverse - New Dataverse application user activity type severity medium T0871,T1078,T1635
- Dataverse - New non-interactive identity granted access severity informational T0859,T1078,T1098
- Dataverse - New sign-in from an unauthorized domain severity medium T1078,T1133,T1190
- Dataverse - New user agent type that was not used before severity low T0819,T0866,T1036,T1078
- Dataverse - New user agent type that was not used with Office 365 severity low T1133,T1190
- Dataverse - Organization settings modified severity informational T1078
- Dataverse - Removal of blocked file extensions severity medium T1629
- Dataverse - SharePoint document management site added or updated severity informational T1537,T1567
- Dataverse - Suspicious security role modifications severity medium T1404,T1548,T1626
- Dataverse - Suspicious use of TDS endpoint severity low T1048,T1190
- Dataverse - Suspicious use of Web API severity medium T1106,T1526,T1567,T1580,T1595
- Dataverse - Terminated employee exfiltration to USB drive severity high T1052
- Dataverse - TI map IP to DataverseActivity severity medium T0859,T0886,T1021,T1078,T1133,T1199
- Dataverse - TI map URL to DataverseActivity severity medium T0819,T0862,T0863,T0865,T0873,T1204
- Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection severity medium T1629
- Dataverse - User bulk retrieval outside normal activity severity low T1048