Échangeons
← Sentinel Explorer
↳ Source GitHubSolution

FalconFriday

Voir sur GitHub ↗Fichier original ↗

Description

[FalconFriday](https://github.com/FalconForceTeam/FalconFriday/blob/master/README.md) is a blog post series by FalconForce providing the community with free detection content for various attacks seen and executed in the wild by FalconForce.
Version
3.0.1
Auteur / éditeur déclaré
FalconForce - info@falconforce.nl
Niveau de support
Partner

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques30
Access Token Manipulation - Create Process with TokenMediumASR Bypassing Writing Executable ContentMediumBeacon Traffic Based on Common User Agents Visiting Limited Number of DomainsMediumCertified Pre-Owned - backup of CA private key - rule 1MediumCertified Pre-Owned - backup of CA private key - rule 2MediumCertified Pre-Owned - TGTs requested with certificate authenticationMediumComponent Object Model Hijacking - Vault7 trickMediumDCOM Lateral MovementMediumDetect .NET runtime being loaded in JScript for code executionMediumDetecting UAC bypass - ChangePK and SLUI registry tamperingMediumDetecting UAC bypass - elevated COM interfaceMediumDetecting UAC bypass - modify Windows Store settingsMediumDisable or Modify Windows DefenderMediumExcessive share permissionsMediumExpired access credentials being used in AzureMediumHijack Execution Flow - DLL Side-LoadingMediumIngress Tool Transfer - CertutilLowMatch Legitimate Name or Location - 2MediumMicrosoft Entra ID Rare UserAgent App Sign-inMediumMicrosoft Entra ID UserAgent OS MissmatchMediumOffice ASR rule triggered from browser spawned office process.MediumOracle suspicious command executionMediumPassword SprayingMediumRemote Desktop Protocol - SharpRDPMediumRename System UtilitiesMediumSMB/Windows Admin SharesMediumSuspicious named pipesMediumSuspicious parentprocess relationship - Office child processes.MediumSuspicious Process Injection from Office applicationMediumTrusted Developer Utilities Proxy ExecutionMedium

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
falconfriday_content
Autres fichiers source 2Solutions/FalconFriday/Data/Solution_FalconFriday.jsonsolution-manifest ↗Solutions/FalconFriday/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.