Sunturai
Back to results
HighMicrosoft Sentinel analyticsMicrosoft Security Community

New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version)

This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice is that these…

Description

This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice is that these policies should not be used for deployment of files. A threat actor may use these policies to deploy files or scripts to all hosts in a domain. This query uses the ASIM parsers and will need them deployed before usage - https://docs.microsoft.com/azure/sentinel/normalization

Detection logic

Detection requirements

Platform
ESXiLinuxmacOSNetwork DevicesSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
securityevents
Log source service
securityevents

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice