{
  "Name": "Attacker Tools Threat Protection Essentials",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The **Attacker Tools Threat Protection Essentials** solution contains security content that is relevant for detection of tools commonly used by attackers in various campaigns. These tools can be commercial, open-source, built-in or publicly available and have historically been seen used by adversaries in different phases of the ATTACK kill chain.  \r\n \r\n **Pre-requisites:** \r\n \r\n This is a [domain solution](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution supports the connectors listed below. Install one or more of the listed solutions, to unlock the value provided by this solution. \r\n \r\n 1. Windows Security Events \n 2. Windows Server DNS \n 3. Windows Forwarded Events \n 4. Microsoft Entra ID \n\n**Keywords:** attack tools, penetration testing, Impacket, Powercat, Nishang, Cobalt Strike, ADFind, Credential Dumping, PowerShell Empire  ",
  "Hunting Queries": [
    "Hunting Queries/CobaltDNSBeacon.yaml",
    "Hunting Queries/PotentialImpacketExecution.yaml"
  ],
  "Analytic Rules": [
    "Analytic Rules/AdFind_Usage.yaml",
    "Analytic Rules/CredentialDumpingServiceInstallation.yaml",
    "Analytic Rules/CredentialDumpingToolsFileArtifacts.yaml",
    "Analytic Rules/powershell_empire.yaml",
    "Analytic Rules/PowerShell-Abuse.yaml"
  ],
  "dependentDomainSolutionIds": [
    "azuresentinel.azure-sentinel-solution-securityevents",
    "azuresentinel.azure-sentinel-solution-dns",
    "azuresentinel.azure-sentinel-solution-windowsforwardedevents",
    "azuresentinel.azure-sentinel-solution-azureactivedirectory"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Attacker Tools Threat Protection Essentials",
  "Version": "3.0.4",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "StaticDataConnector": true
}