Microsoft Sentinel high experimental kql

Google DNS - UNC2452 (Nobelium) APT Group activity

'Detects UNC2452 (Nobelium) APT Group activity.'

View Source

Detection Logic

GCPCloudDNS
| where Query has_any ('tomasubiera.com', 'theandersonco.com', 'stonecrestnews.com', 'nordicmademedia.com')
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...