Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleHigh

Samsung Knox - Peripheral Access Detection with Camera Events

View on GitHub ↗Original file ↗

Description

When camera access has been detected on a Knox device, even though such access is disabled through an MDM device policy.
Rule type
NRT
Version
1.0.2
Declared status
Available

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SamsungDCDefinition

Data types

Samsung_Knox_System_CL

KQL query

Original query, unchanged.

Samsung_Knox_System_CL 
| where Name == "PERIPHERAL_ACCESS_THROUGH_POLICY_DETECTED_CAMERA" 
and MitreTtp has "KNOX.2"

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
cd526f4d-dbe9-4149-8a0a-9ec43c3abb16
Additional source files 2Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithCamera.yamlsource ↗Solutions/Samsung Knox Asset Intelligence/Data/Solution_Samsung.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.