Sunturai
Back to results
HighMicrosoft Sentinel analytics

[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022

Use Microsoft's up-to-date Threat Intelligence solution from the Content Hub to replace the deprecated query with outdated IoCs. Install it from: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy

Detection logic

Detection requirements

Platform
IaaSLinuxmacOSOffice SuiteSaaSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
azurefirewallazuremonitor_vminsightscefcefamacheckpointciscoasaciscoasaamadnsf5fortinetmicrosoftthreatprotectionoffice365paloaltonetworkssecurityeventswindowsfirewallwindowsfirewallamawindowsforwardedeventswindowssecurityevents
Log source service
azurediagnosticscommonsecuritylogdeviceeventsdevicefileeventsdevicenetworkeventsdeviceprocesseventsdnseventsofficeactivitysecurityeventsecurityeventsvmconnectionwindowseventwindowsfirewall

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice