30 detection rules reference this event. View event page.Kusto (30)
- Dataverse - Anomalous application user activity severity medium T0834, T0859, T0871, T1528, T1569
- Dataverse - Audit log data deletion severity low T1070
- Dataverse - Audit logging disabled severity low T1685
- Dataverse - Bulk record ownership re-assignment or sharing severity medium T1548
- Dataverse - Export activity from terminated or notified employee severity medium T1048, T1567
- Dataverse - Hierarchy security manipulation severity medium T1078, T1548
- Dataverse - Honeypot instance activity severity medium T1526, T1538, T1567
- Dataverse - Login by a sensitive privileged user severity high T1078, T1133, T1190, T1212
- Dataverse - Login from IP in the block list severity high T1078, T1133, T1190
- Dataverse - Login from IP not in the allow list severity high T1078, T1133, T1190
- Dataverse - Malware found in SharePoint document management site severity medium T1204
- Dataverse - Mass deletion of records severity medium T1485
- Dataverse - Mass export of records to Excel severity low T1567
- Dataverse - Mass record updates severity medium T1485, T1565, T1641
- Dataverse - New Dataverse application user activity type severity medium T0871, T1078, T1635
- Dataverse - New non-interactive identity granted access severity informational T0859, T1078, T1098
- Dataverse - New sign-in from an unauthorized domain severity medium T1078, T1133, T1190
- Dataverse - New user agent type that was not used before severity low T0819, T0866, T1036, T1078
- Dataverse - New user agent type that was not used with Office 365 severity low T1133, T1190
- Dataverse - Organization settings modified severity informational T1078
- Dataverse - Removal of blocked file extensions severity medium T1629
- Dataverse - SharePoint document management site added or updated severity informational T1537, T1567
- Dataverse - Suspicious security role modifications severity medium T1404, T1548, T1626
- Dataverse - Suspicious use of TDS endpoint severity low T1048, T1190
- Dataverse - Suspicious use of Web API severity medium T1106, T1526, T1567, T1580, T1595
- Dataverse - Terminated employee exfiltration to USB drive severity high T1052
- Dataverse - TI map IP to DataverseActivity severity medium T0859, T0886, T1021, T1078, T1133, T1199
- Dataverse - TI map URL to DataverseActivity severity medium T0819, T0862, T0863, T0865, T0873, T1204
- Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection severity medium T1629
- Dataverse - User bulk retrieval outside normal activity severity low T1048