Azure Security operations detections for infrastructure

Starts from

Detection rule to identify Azure infrastructure based incidents

Extranet lockout trends
Failed sign-ins
In privacy compliant
Potential brute force attack on LDAP
Account enumeration reconnaissance
General correlation between Azure AD and Azure AD FS
Azure AD pass-through authentication errors
Creation of a new Azure AD tenant, using an identity from your tenant.
Kerberos errors
DC security issues
Pass-the-ticket like attacks
Legacy authentications
New Conditional Access Policy created by non-approved actors
Conditional Access Policy removed by non-approved actors
Conditional Access Policy updated by non-approved actors
Removal of a user from a group used to scope critical Conditional Access policies
Addition of a user to a group used to scope critical Conditional Access policies

My shopping cart