EXPLORE DETECTIONS
Large Number of Analytics Rules Deleted
This query can be used to detect when a large number of Sentinel Analytics Rules is deleted in a short timeframe. This could be part of the detection lifecycle, but it could also have been done with malicious intent.
Large Number of Virtual Machines started
This query detects when a Large Number of Virtual Machines is started within a short timeframe. The query uses two inputs; Threshold and TimeFrame. The threshold determines the number of machines from when the query should output results. The timeframe determines how long the period is to reach the threshold.
Last Heartbeat Arc Machines
This query lists the latest heartbeat for each Azure Arc onboarded machine.
Last Password Change Time with Account Creation Time
| where Department contains @"Cyber" or JobTitle contains "architect" //Example of further filtering
Last Password Change User
This query lists the last PasswordChangeTime based on Active Directory logs. In case you asked a user to perform a password reset, you can confirm using this query if it was actually performed.
Latest Antivirus Scan Status
This query lists the latest completed antivirus scan for each device. The query filters all devices that have performed a successful scan today.
Launching questd ransomware using osascript
This query was originally published in the threat analytics report, *EvilQuest signals the rise of Mac ransomware*.
LDAPNightmare Exploitation Attempt
The query below detects the inital connection made to try and run the LDAPNightmare exploit. The intial connection connects to the victim server, which sends a DNS SRV query. If the query below triggers it does not necessarily mean that the exploit worked, if the system is patched or the RPC access is denied the exploit cannot be executed but the query will return results. By this you can also hunt for attempts, if the victim is still vulnerable for the vulnerability it is likely exploited.
List *.All MS Graph Permissions Added
This rule detects the usage of *.All Microsoft Graph permissions that are added. *.All permissions should be scoped if possible, this ensures that the least privilege principle can still be applied. You should monitor for overpermissive applications and rare permissions that are added to applications.
List *.All MS Graph Permissions Added by application.
This rule detects the usage of *.All Microsoft Graph permissions that are added. *.All permissions should be scoped if possible, this ensures that the least privilege principle can still be applied. You should monitor for overpermissive applications and rare permissions that are added to applications. This query summarize the results for each ServicePrincipalAppId, especially applications that have been granted multiple *.All permissions should be investigated.
List Activities Compromised Device Can Perform as Source
```KQL
List Activities Compromised Device Can Perform as Source
```KQL
List AD Delegations
This query is aimed to Monitor different types of delegation in the environment.
List Alert Supression Actions
This query lists all the supressions that have been added to Defender XDR. This gives you an overview of what rules are added, by who and why they have been added.
List all AuditLog activities of a user
```KQL
List all AuditLog activities of a user
```KQL
List all Cloud Permissions of a Compromised User
```KQL
List all Cloud Permissions of a Compromised User
```KQL
List all Global Admins in your tenant
This query lists all accounts that have the Global Admin role assigned to their account. If you have enabled PIM, then only users that have pimmed to Global Admin in the search period will be shown.
List all GraphAPI requests of a suspicious user
```KQL
List all GraphAPI requests of a suspicious user
```KQL
List All Role Additions
This query list all role additions that have been performed in your tenant. See the Microsoft Link for the default roles that exsits in Azure Active Directory. They contain reader, operator, administrator and other roles. It is good practice to gain insight into the roles that have been assigned to accounts. Based on this query you can build a detection for specific roles with high priviliges such as Global Admin, Security Admin or Exchange Admin.
List Antivirus Scan Activities
This query lists all manual (and playbook related) anvitius actions that are initiated and the related comments per device.
List applications with Mail.* API permissions
The query below lists the applications that have Mail.* Graph API permissions. These permissions are highly sensitive as it can give access to individual or shared mailboxes.