LoFP / vulnerability scanners

Techniques

• t1078
• t1078.004
• t1110
• t1190
• t1505
• t1505.001

Sample rules

Suspicious SQL Query

• source: sigma
• technicques:
  • t1190
  • t1505
  • t1505.001

Description

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Detection logic

condition: keywords
keywords:
- drop
- truncate
- dump
- select \*

Sign-in Failure Due to Conditional Access Requirements Not Met

• source: sigma
• technicques:
  • t1078
  • t1078.004
  • t1110

Description

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Detection logic

condition: selection
selection:
  ResultType: 53003
  Resultdescription: Blocked by Conditional Access