List Conditional Access User Sign-in Failure
Description This KQL query lists all users that trigger failed sign in requests due to conditional access failures. This can
Read MoreWhere Every Failure Becomes A Manual
Description This KQL query lists all users that trigger failed sign in requests due to conditional access failures. This can
Read MoreDescription This KQL query detect Data Connectors with changes from fail to success state. Risk Failures in Data connectors mean
Read MoreDescription This KQL query detect Data Connectors with changes from fail to success state. Risk Failures in Data connectors mean
Read MoreDescription Adversaries can use SMB to upload files to remote shares or to interact with files on those shares. A
Read MoreDescription This KQL query detects when multiple sensitive group additions have been initiated from the command-line within a certain timeframe.
Read MoreDescription Adversaries may use executable files to gain initial access. A tactic that is used is to send executable files,
Read MoreDescription Attackers install web shells on servers by taking advantage of security gaps, typically vulnerabilities in web applications, in internet-facing
Read MoreDescription Adversaries can use older kerberos encryption algorithms which are vulnerable to brute force attacks to crack passwords. This query
Read MoreDescription This KQL query list all internet facing devices that have a vulnerability that is exploitable. What exploitable means is
Read More