Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook
Not mapped to ATT&CK.
No references are available for this detection.
Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice
Explore published rules with transparent provenance, licensing, and ATT&CK mappings.
Showing 30 of 11,488
Query detects Adfind tool use for domain reconnaissance, regardless of executable name, focusing on DC and ADFS servers, to spot potential adversary activity.
Hunting Query detects unusual child processes of w3wp.exe not seen in 14 days, signaling potential web server compromise and web shell installation.
Identifies malware hiding scheduled tasks by deleting the SD (Security Descriptor) value, making tasks disappear from schtasks /query and Task Scheduler. Enable registry auditing policy and auditing on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree. Reference: https://www.microsoft.com/en-us/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ Reference: https://learn.microsoft.
Identifies suspicious AD FS authentication by correlating Security events from "AD FS Auditing" with Windows Filtering Platform (WFP) events for incoming port 80 traffic. This may indicate a threat actor abusing AD FS replication services to obtain configuration settings and sensitive information such as AD FS certificates. Enable AD FS auditing on the AD FS server before using this query. References: https://learn.microsoft.
Identifies an IP address that had 15 failed attempts to sign in via SSH in a 4 hour block during a 24 hour time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.
Check for Squid proxy events associated with common ToR proxies. This query presumes the default squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/
Checks for Squid proxy events in Syslog associated with common mining pools. This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/
Identifies SFTP File Transfers with distinct folder count above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.
Identifies SFTP File Transfers above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.
Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/
Identifies failed logon attempts from unknown users in Syslog authpriv logs. The unknown user means the account that tried to log in isn't provisioned on the machine. A few hits could indicate someone attempting to access a machine they aren't authorized to access. If there are many of hits, especially from outside your network, it could indicate a brute force attack. Default threshold for logon attempts is 15.
This query searches for rare firewall rule changes using netsh utility by comparing rule names and program names from the previous day.
Threat actors may use tools such as Curl to download additional files, communicate with C2 infrastructure, or exfiltrate data. This query looks for new files being downloaded using Curl.
This query detects the execution of renamed Windows binaries (Lolbins). This is a common technique used by adversaries to evade detection. Ref: https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin
When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory. Ref: https://www.microsoft.com/en-us/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
This detection uses AzureActivity logs (Security category) to identify when a subscription is moved to another tenant. A threat actor may move a subscription into their own tenant to circumvent local resource deployment and logging policies. Once moved, threat actors may deploy resources and perform malicious activities such as crypto mining. This is a technique known as "subscription hijacking". More information can be found here: https://techcommunity.microsoft.
Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.
Detects ChatGPT Enterprise audit events that create a workspace domain boundary entry. Domain changes can expand who is allowed to join or access the tenant and may establish persistence for attacker-controlled domains.
Detects ChatGPT Enterprise custom-agent events that create or update a trigger. Triggers can schedule or event-drive agent runs without interactive user presence, enabling persistence and automation abuse.
Detects ChatGPT Enterprise custom-agent publish events (`agent_published`). Publishing an agent with connectors, skills, or store visibility can establish durable automation and broaden data access beyond the original user.
Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.
Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with a missing `expires_at` as higher priority during triage.
Detects ChatGPT Enterprise app authentication events that link a third-party app to a user or workspace. Linking apps establishes durable OAuth-style access that adversaries can use to persist connectors after initial compromise.
Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a compromised account to owner gains durable control-plane access.
Detects successful ChatGPT Enterprise authentication events where the user agent looks scripted (for example Python, curl, Go HTTP clients, aiohttp, scrapers, or headless browsers) rather than a normal browser. Adversaries and automation often reuse stolen sessions or tokens with non-browser clients.
Detects successful ChatGPT Enterprise logins for the same user email from source IPs whose geo-locations are separated by at least 1,000 km, with implied travel faster than 800 km/h, within a 24-hour window. That pattern can indicate account sharing, VPN or proxy egress mismatches, or an adversary authenticating from a geography far from the legitimate user's baseline.
Detects a high number of ChatGPT Enterprise file download audit events for the same user within a rolling 24-hour lookback. Bulk downloads can indicate staging of conversation attachments or workspace files for exfiltration.
Detects ChatGPT Enterprise audit events that publish a GPT or update sharing for GPTs, skills, or projects (`gpt_publish`, `update_sharing`, `skill_share`, `project_update_sharing`). Broadening share scope can expose custom instructions, tools, or proprietary agent configurations beyond the original audience.
Detects a ChatGPT Enterprise user downloading five or more distinct Google Drive files through the Drive connector within a one-hour window. Adversaries who abuse a linked Drive connector after session compromise often stage bulk file retrieval before sharing, forwarding, or other exfiltration.
Detects ChatGPT Enterprise Gmail connector `send_email` responses. Adversaries who abuse a linked Gmail connector after session compromise can exfiltrate data or perform lateral phishing by sending mail on behalf of the user. Draft-only activity (`create_draft`) is excluded.