Aqua Blizzard AV hits - Feb 2022

UnknownMicrosoft Sentinel analytics

Suspicious Enumeration using Adfind Tool

Query detects Adfind tool use for domain reconnaissance, regardless of executable name, focusing on DC and ADFS servers, to spot potential adversary activity.

T1059T1069T1074T1087T1201+1 more

Licence: MIT License
Published: Oct 17, 2026

UnknownMicrosoft Sentinel analytics

New Child Process of W3WP.exe

Hunting Query detects unusual child processes of w3wp.exe not seen in 14 days, signaling potential web server compromise and web shell installation.

T1203

Licence: MIT License
Published: Oct 17, 2026

HighMicrosoft Sentinel analytics

Scheduled Task Hide

Identifies malware hiding scheduled tasks by deleting the SD (Security Descriptor) value, making tasks disappear from schtasks /query and Task Scheduler. Enable registry auditing policy and auditing on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree. Reference: https://www.microsoft.com/en-us/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ Reference: https://learn.microsoft.

T1562

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

AD FS Remote Auth Sync Connection

Identifies suspicious AD FS authentication by correlating Security events from "AD FS Auditing" with Windows Filtering Platform (WFP) events for incoming port 80 traffic. This may indicate a threat actor abusing AD FS replication services to obtain configuration settings and sensitive information such as AD FS certificates. Enable AD FS auditing on the AD FS server before using this query. References: https://learn.microsoft.

T1005

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

SSH - Potential Brute Force

Identifies an IP address that had 15 failed attempts to sign in via SSH in a 4 hour block during a 24 hour time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.

T1110

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events for ToR proxies

Check for Squid proxy events associated with common ToR proxies. This query presumes the default squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1008T1090

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools. This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer folder count above threshold

Identifies SFTP File Transfers with distinct folder count above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer above threshold

Identifies SFTP File Transfers above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

NRT Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

Failed logon attempts in authpriv

Identifies failed logon attempts from unknown users in Syslog authpriv logs. The unknown user means the account that tried to log in isn't provisioned on the machine. A few hits could indicate someone attempting to access a machine they aren't authorized to access. If there are many of hits, especially from outside your network, it could indicate a brute force attack. Default threshold for logon attempts is 15.

T1110

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Rare Windows Firewall Rule updates using Netsh

This query searches for rare firewall rule changes using netsh utility by comparing rule names and program names from the previous day.

T1204

Licence: MIT License
Published: Oct 17, 2026

UnknownMicrosoft Sentinel analytics

Download of New File Using Curl

Threat actors may use tools such as Curl to download additional files, communicate with C2 infrastructure, or exfiltrate data. This query looks for new files being downloaded using Curl.

T1071

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

Windows Binaries Lolbins Renamed

This query detects the execution of renamed Windows binaries (Lolbins). This is a common technique used by adversaries to evade detection. Ref: https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin

T1059

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

WDigest downgrade attack

When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory. Ref: https://www.microsoft.com/en-us/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/

T1003

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Subscription moved to another tenant

This detection uses AzureActivity logs (Security category) to identify when a subscription is moved to another tenant. A threat actor may move a subscription into their own tenant to circumvent local resource deployment and logging policies. Once moved, threat actors may deploy resources and perform malicious activities such as crypto mining. This is a technique known as "subscription hijacking". More information can be found here: https://techcommunity.microsoft.

T1496

Licence: MIT License
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise User Invite Sent

Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.

T1136T1136.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

HighElastic detection rules

OpenAI ChatGPT Enterprise Domain Created

Detects ChatGPT Enterprise audit events that create a workspace domain boundary entry. Domain changes can expand who is allowed to join or access the tenant and may establish persistence for attacker-controlled domains.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Custom Agent Trigger Changed

Detects ChatGPT Enterprise custom-agent events that create or update a trigger. Triggers can schedule or event-drive agent runs without interactive user presence, enabling persistence and automation abuse.

T1053

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Custom Agent Published

Detects ChatGPT Enterprise custom-agent publish events (`agent_published`). Publishing an agent with connectors, skills, or store visibility can establish durable automation and broaden data access beyond the original user.

T1176

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.

T1176T1213

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Codex Access Token Created

Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with a missing `expires_at` as higher priority during triage.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise App Authentication Linked

Detects ChatGPT Enterprise app authentication events that link a third-party app to a user or workspace. Linking apps establishes durable OAuth-style access that adversaries can use to persist connectors after initial compromise.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

HighElastic detection rules

OpenAI ChatGPT Enterprise Account Owner Role Assigned

Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a compromised account to owner gains durable control-plane access.

T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent

Detects successful ChatGPT Enterprise authentication events where the user agent looks scripted (for example Python, curl, Go HTTP clients, aiohttp, scrapers, or headless browsers) rather than a normal browser. Adversaries and automation often reuse stolen sessions or tokens with non-browser clients.

T1078T1078.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

HighElastic detection rules

OpenAI ChatGPT Enterprise Impossible Travel Login

Detects successful ChatGPT Enterprise logins for the same user email from source IPs whose geo-locations are separated by at least 1,000 km, with implied travel faster than 800 km/h, within a 24-hour window. That pattern can indicate account sharing, VPN or proxy egress mismatches, or an adversary authenticating from a geography far from the legitimate user's baseline.

T1078T1078.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise High File Download Activity

Detects a high number of ChatGPT Enterprise file download audit events for the same user within a rolling 24-hour lookback. Bulk downloads can indicate staging of conversation attachments or workspace files for exfiltration.

T1567

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Resources Sharing Updated

Detects ChatGPT Enterprise audit events that publish a GPT or update sharing for GPTs, skills, or projects (`gpt_publish`, `update_sharing`, `skill_share`, `project_update_sharing`). Broadening share scope can expose custom instructions, tools, or proprietary agent configurations beyond the original audience.

T1567

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Google Drive Download Burst

Detects a ChatGPT Enterprise user downloading five or more distinct Google Drive files through the Drive connector within a one-hour window. Adversaries who abuse a linked Drive connector after session compromise often stage bulk file retrieval before sharing, forwarding, or other exfiltration.

T1213T1567

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Gmail Message Sent via Connector

Detects ChatGPT Enterprise Gmail connector `send_email` responses. Adversaries who abuse a linked Gmail connector after session compromise can exfiltrate data or perform lateral phishing by sending mail on behalf of the user. Draft-only activity (`create_draft`) is excluded.

T1534T1567

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

Detection rules

Aqua Blizzard AV hits - Feb 2022

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules