Microsoft Sentinel high experimental kql

ApexOne - Possible exploit or execute operation

'Detects possible exploit or execute operation.'

View Source

Detection Logic

TMApexOneEvent
| where EventMessage has "Behavior Monitoring"
| extend DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3)
| where Event_Type == 2048 or DeviceCustomNumber3 == 403 or DeviceCustomNumber3 == 601
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName

Field Validations

Loading…

Comments (0)

Loading comments...