Microsoft Sentinel medium experimental kql

Acronis - Multiple Endpoints Accessing Malicious URLs

Multiple endpoints accessing malicious URLs could indicate an ongoing phishing attack, with several employees interacting with those URLs.

View Source

Detection Logic

CommonSecurityLog
| where DeviceVendor == "Acronis"
| where DeviceEventClassID == "MaliciousUrlDetected"
| summarize MaliciousUrlDetected = count() by DeviceName

Field Validations

Loading…

Comments (0)

Loading comments...