https://store-images.s-microsoft.com/image/apps.27512.8168e919-91a7-4521-94e5-3c430ecc158b.ce4612b5-5616-43c4-92dd-687cda9c83a9.38c2cda2-c0a8-4947-845d-710fa0a86c54
Attacker Tools Threat Protection Essentials
Microsoft Sentinel, Microsoft Corporation
Attacker Tools Threat Protection Essentials
Microsoft Sentinel, Microsoft Corporation
Attacker Tools Threat Protection Essentials
Microsoft Sentinel, Microsoft Corporation
Attacker Tools Threat Protection Essentials
Note: Please refer to the following before installing the solution:
• Review the solution Release Notes
• There may be known issues pertaining to this Solution, please refer to them before installing.
The Attacker Tools Threat Protection Essentials solution contains security content that is relevant for detection of tools commonly used by attackers in various campaigns. These tools can be commercial, open-source, built-in or publicly available and have historically been seen used by adversaries in different phases of the ATTACK kill chain.
Pre-requisites:
This is a domain solution and does not include any data connectors. The content in this solution supports the connectors listed below. Install one or more of the listed solutions, to unlock the value provided by this solution.
- Windows Security Events
- Windows Server DNS
- Windows Forwarded Events
- Microsoft Entra ID
Keywords: attack tools, penetration testing, Impacket, Powercat, Nishang, Cobalt Strike, ADFind, Credential Dumping, PowerShell Empire
Analytic Rules: 4, Hunting Queries: 2
Learn more about Microsoft Sentinel | Learn more about Solutions