kqlMITfrom Azure/Azure-Sentinel
Privileged User Logon from new ASN
'Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days. Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'
Quality
98
FP risk
—
Forks
0
Views
1
ATT&CK techniques
Rule source🔒 locked
🔒
Sign in to view the rule source
Free accounts can view the source for the top-ranked rules. Create one in seconds — no credit card required.
Sign in →