Detection catalogue

Detects when SMB traffic crosses Production and Non-Production Realms. Possible network share discovery or lateral tool transfer across realms

Identifies web traffic where the iboss platform flagged malware. A populated MalwareDetected flag indicates the gateway detected a malicious file or payload associated with the request. Surfaces the destination, user, and other details to support triage.

Identifies web traffic where the iboss platform flagged command-and-control (C2) activity. A populated CNCDetected flag indicates the gateway observed communication to a known or suspected C2 destination. Surfaces the user, destination URL, and host to support triage of potentially compromised endpoints.

Detects repeated use of the same OAuth token across different IPs or locations over time. This can indicate token theft or session abuse.

Detects when a privileged role is assigned to a new user account. This can indicate unauthorized elevation of privileges.

Detects when a user is assigned a privileged role in Microsoft Entra ID. This may indicate unauthorized privilege escalation and should be validated promptly.

Detects denied privilege elevation requests in Microsoft Entra ID. Review the requester and the target workflow for possible abuse or misconfiguration.

Detects multiple privileged role changes occurring around the same time. This may signal bulk abuse or administrative misconfiguration.

Detects changes to domain federation trust settings or domain authentication mode. These changes can be used to redirect sign-in trust and should be reviewed immediately.

Detects changes to authentication methods on privileged accounts. This may indicate an attacker added a new method to maintain access.

Detects when an application receives permission to assign Microsoft Entra ID roles. This can enable directory privilege escalation and should be reviewed immediately.

Detects an application receiving administrator permissions and then using them to assign a role. This pattern can indicate rapid privilege escalation through app consent abuse.

Detects Azure VM Run Command execution correlated with unusual sign-in behavior from UEBA. This can indicate administrative abuse or post-compromise activity.

Query shows server error by user.

Query shows users access groups.

Query shows rare urlhostname requests.

Query shows top source IP.

Query shows top connectors.

Query shows Users by source location countries.

Query shows destination ports by IP address.

Query shows connection close reasons.

Query shows applications using by accounts.

Query shows abnormal total bytes size.

Detects Unexpected ZPA session duration.

Detects ZAP connections outside operational hours.

Detects ZPA connections from new IP.

Detects ZPA connections from new country.

Detects ZPA connections by new user.

Detects ZPA connections by dormant user.

Detects unexpected version of update operation.