diff --git a/Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json b/Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json index bc4a24547b9..e01d2191077 100644 --- a/Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json +++ b/Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json @@ -27,7 +27,7 @@ "displayName": "Alert Event ASIM parser", "category": "ASIM", "FunctionAlias": "ASimAlertEvent", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAlertEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimAlertEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(pack:bool=false){\nunion isfuzzy=true\n vimAlertEventEmpty,\n ASimAlertEventBitdefenderGravityZone (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventBitdefenderGravityZone' in (DisabledParsers))), pack=pack),\n ASimAlertEventMicrosoftDefenderXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventMicrosoftDefenderXDR' in (DisabledParsers)))),\n ASimAlertEventSentinelOneSingularity (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularity' in (DisabledParsers)))),\n ASimAlertEventCiscoSecureEndpoint (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack),\n ASimAlertEventPaloAltoXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack),\n ASimAlertEventNetskopeSecurityCloud (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack),\n ASimAlertEventCrowdStrikeFalcon (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n ASimAlertEventGoogleSecOps (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventGoogleSecOps' in (DisabledParsers))), pack=pack),\n ASimAlertEventGoogleThreatIntelligence (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventGoogleThreatIntelligence' in (DisabledParsers))), pack=pack)\n}; \nparser (pack=pack)\n", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAlertEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimAlertEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(pack:bool=false){\nunion isfuzzy=true\n vimAlertEventEmpty,\n ASimAlertEventBitdefenderGravityZone (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventBitdefenderGravityZone' in (DisabledParsers))), pack=pack),\n ASimAlertEventMicrosoftDefenderXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventMicrosoftDefenderXDR' in (DisabledParsers)))),\n ASimAlertEventSentinelOneSingularity (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularity' in (DisabledParsers)))),\n ASimAlertEventSentinelOneSingularityAlerts (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularityAlerts' in (DisabledParsers)))),\n ASimAlertEventCiscoSecureEndpoint (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack),\n ASimAlertEventPaloAltoXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack),\n ASimAlertEventNetskopeSecurityCloud (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack),\n ASimAlertEventCrowdStrikeFalcon (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n ASimAlertEventGoogleSecOps (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventGoogleSecOps' in (DisabledParsers))), pack=pack)\n}; \nparser (pack=pack)\n", "version": 1, "functionParameters": "pack:bool=False" } diff --git a/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/ASimAlertEventSentinelOneSingularityAlerts.json b/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/ASimAlertEventSentinelOneSingularityAlerts.json new file mode 100644 index 00000000000..40a962e15c0 --- /dev/null +++ b/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/ASimAlertEventSentinelOneSingularityAlerts.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/ASimAlertEventSentinelOneSingularityAlerts')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Alert Event ASIM parser for SentinelOne Singularity Alerts via CCF", + "category": "ASIM", + "FunctionAlias": "ASimAlertEventSentinelOneSingularityAlerts", + "query": "let AnalystVerdictArray = dynamic([\n \"true positive\",\n \"false positive\",\n \"benign positive\"\n]);\nlet EventSubTypeLookup = datatable(EventOriginalSubType: string, EventSubType: string)[\n \"malicious\", \"Threat\",\n \"suspicious\", \"Suspicious Activity\",\n \"undefined\", \"Anomaly\"\n];\nlet AlertStatusLookup = datatable(AlertOriginalStatus: string, AlertStatus: string)[\n \"unresolved\", \"Active\",\n \"in progress\", \"Active\",\n \"resolved\", \"Closed\"\n];\nlet SentinelOneAlertsParser = (\n disabled: bool = false,\n pack: bool = false\n)\n{\n SentinelOneAlerts_CL\n | where not(disabled)\n | extend \n SourceProcessInfoJson = parse_json(SourceProcessInfo),\n TargetProcessInfoJson = parse_json(TargetProcessInfo),\n SourceParentProcessInfoJson = parse_json(SourceParentProcessInfo),\n KubernetesInfoJson = parse_json(KubernetesInfo),\n ContainerInfoJson = parse_json(ContainerInfo),\n AlertInfoJson = parse_json(AlertInfo),\n RuleInfoJson = parse_json(RuleInfo),\n AgentDetectionInfoJson = parse_json(AgentDetectionInfo)\n //Early Extraction for Filter Columns\n | extend\n Username = \n tostring(coalesce(\n AlertInfoJson.loginsUserName,\n SourceProcessInfoJson.effectiveUser,\n SourceProcessInfoJson.loginUser,\n SourceProcessInfoJson.realUser,\n SourceProcessInfoJson.user,\n SourceParentProcessInfoJson.effectiveUser,\n SourceParentProcessInfoJson.loginUser,\n SourceParentProcessInfoJson.realUser,\n SourceParentProcessInfoJson.user\n )),\n AlertVerdict = iff(AlertInfoJson.analystVerdict in~ (AnalystVerdictArray), AlertInfoJson.analystVerdict, \"Unknown\"),\n EventSeverity = iff(RuleInfoJson.severity=~\"Critical\",\"High\",tostring(RuleInfoJson.severity)),\n AttackTactics = strcat_array(extract_all(@\">([\\S ]+) \\(TA0\\d{3}\\)<\",tostring(AlertInfoJson.indicatorDescription)),\", \"),\n AttackTechniques = extract_all(@\">(T\\d{4}.\\d{3}?)<.*>(.*):<\",dynamic([2,1]),tostring(AlertInfoJson.indicatorDescription))\n | extend\n //Inspection Fields\n AlertName = tostring(RuleInfoJson.name),\n AlertOriginalStatus = tolower(AlertInfoJson.incidentStatus),\n EventOriginalSubType = tolower(RuleInfoJson.treatAsThreat),\n EventOriginalType = tostring(AlertInfoJson.eventType),\n RuleNumber = toint(RuleInfoJson.id),\n RuleName = tostring(RuleInfoJson.name),\n RuleDescription = tostring(RuleInfoJson.description),\n ThreatOriginalCategory = tostring(AlertInfoJson.indicatorName),\n //User Fields\n OriginalUserType = AlertInfoJson.loginType,\n UsernameType = case(\n Username contains \"@\", \"UPN\",\n Username contains \"\\\\\", \"Windows\",\n Username contains \"OU=\", \"DN\",\n Username matches regex @\"^\\d{11}$\",\"AWSId\",\n \"Simple\"\n ),\n //Device fields\n DvcHostname = tostring(split(AgentDetectionInfoJson.name,\".\")[0]),\n DvcDescription = tostring(AgentDetectionInfoJson.machineType),\n DvcIpAddr = tostring(coalesce(AlertInfoJson.srcIp,AlertInfoJson.srcMachineIp)),\n DvcOs = tostring(AgentDetectionInfoJson.osFamily),\n DvcOsVersion = tostring(AgentDetectionInfoJson.osName),\n DvcId = tostring(AgentDetectionInfoJson.uuid),\n DvcIdType = \"Other\",\n //Common ASIM Fields\n EventUid = tostring(AlertInfoJson.alertId),\n EventType = \"Alert\",\n EventCount = int(1),\n EventStartTime = todatetime(AlertInfoJson.createdAt),\n EventEndTime = todatetime(AlertInfoJson.createdAt),\n EventProduct = \"Singularity\",\n EventVendor = \"SentinelOne\",\n EventResult = \"Success\",\n EventSchema = \"AlertEvent\",\n EventSchemaVersion=\"0.1\",\n EventOriginalSeverity = tostring(RuleInfoJson.severity),\n EventMessage = \n case(\n isnotempty(AlertInfoJson.indicatorDescription),\n extract(@\"(.*)\\n?\",1,tostring(AlertInfoJson.indicatorDescription)),\n AlertInfoJson.eventType =~ \"WINLOGONATTEMPT\" and AlertInfoJson.loginIsSuccessful =~ \"false\",\n strcat(AlertInfoJson.loginType, \" logon failed user - \", AlertInfoJson.loginsUserName),\n AlertInfoJson.eventType =~ \"WINLOGONATTEMPT\" and AlertInfoJson.loginIsSuccessful =~ \"true\",\n strcat(AlertInfoJson.loginType, \" logon successful user - \", AlertInfoJson.loginsUserName),\n AlertInfoJson.eventType =~ \"DNS\",\n strcat(\"DNS request for \", AlertInfoJson.dnsRequest , \" returned \", AlertInfoJson.dnsResponse),\n AlertInfoJson.eventType =~ \"REGVALUEMODIFIED\",\n strcat(\"A registry value has been modified\\n\",\"RegistryKey: \",AlertInfoJson.registryKeyPath, \"\\nRegistryOldValue: \",AlertInfoJson.registryOldValue, \"\\nRegistryNewValue: \",AlertInfoJson.registryValue),\n tostring(RuleInfoJson.description)\n )\n //Normalize Mitre Format\n | mv-apply AttackTechniques on \n (\n extend Technique = iff (isnotempty(AttackTechniques),strcat(AttackTechniques[0],\" (\",AttackTechniques[1],\")\"),\"\") \n | summarize AttackTechniques = strcat_array(make_set_if(Technique,isnotempty(Technique)),\", \")\n )\n | lookup AlertStatusLookup on AlertOriginalStatus\n | lookup EventSubTypeLookup on EventOriginalSubType\n | extend\n //Process Fields\n ProcessId = tostring(SourceProcessInfoJson.pid),\n ProcessCommandLine = tostring(SourceProcessInfoJson.commandline),\n ProcessName = tostring(SourceProcessInfoJson.filePath),\n ProcessFileCompany = tostring(SourceProcessInfoJson.fileSignerIdentity),\n //File Fields\n FileName = tostring(SourceProcessInfoJson.name),\n FilePath = tostring(SourceProcessInfoJson.filePath),\n FileSHA1 = tostring(SourceProcessInfoJson.fileHashSha1),\n FileSHA256 = tostring(SourceProcessInfoJson.fileHashSha256),\n FileMD5 = tostring(SourceProcessInfoJson.fileHashMd5),\n //Registry Fields\n RegistryKey = tostring(AlertInfoJson.registryPath),\n RegistryValue = tostring(split(AlertInfoJson.registryPath,\"\\\\\")[-1]),\n RegistryValueData = tostring(AlertInfoJson.registryValue)\n //Alias\n | extend \n IpAddr = DvcIpAddr,\n Hostname = DvcHostname,\n Dvc = DvcHostname,\n AlertId = EventUid,\n AlertDescription = EventMessage,\n Rule = RuleName,\n User = Username\n //AdditionalFields\n | extend\n DstIpAddr = tostring(AlertInfoJson.dstIp),\n DstPortNumber = tostring(AlertInfoJson.dstPort),\n SrcIpAddr = tostring(AlertInfoJson.srcIp),\n SrcMachineIp = tostring(AlertInfoJson.srcMachineIp),\n SrcPortNumber = tostring(AlertInfoJson.srcPort),\n LoginAccountDomain = tostring(AlertInfoJson.loginAccountDomain),\n LoginAccountSid = tostring(AlertInfoJson.loginAccountSid),\n LoginIsAdministratorEquivalent = tostring(AlertInfoJson.loginIsAdministratorEquivalent),\n ModulePath = tostring(AlertInfoJson.modulePath),\n ModuleSha1 = tostring(AlertInfoJson.moduleSha1),\n NetEventDirection = tostring(AlertInfoJson.netEventDirection),\n RegistryKeyPath = tostring(AlertInfoJson.registryKeyPath),\n RegistryOldValue = tostring(AlertInfoJson.registryOldValue),\n RegistryOldValueType = tostring(AlertInfoJson.registryOldValueType),\n TiIndicatorComparisonMethod = tostring(AlertInfoJson.tiIndicatorComparisonMethod),\n TiIndicatorSource = tostring(AlertInfoJson.tiIndicatorSource),\n TiIndicatorType = tostring(AlertInfoJson.tiIndicatorType),\n TiIndicatorValue = tostring(AlertInfoJson.tiIndicatorValue),\n Source = tostring(AlertInfoJson.source),\n ReportedAt = tostring(AlertInfoJson.reportedAt),\n UpdatedAt = tostring(AlertInfoJson.updatedAt),\n S1ql = tostring(RuleInfoJson.s1ql)\n | extend AdditionalFields = \n iff(pack == true,\n bag_pack(\n \"SourceProcessInfo\", SourceProcessInfo,\n \"SourceParentProcessInfo\", SourceParentProcessInfo,\n \"TargetProcessInfo\", TargetProcessInfo,\n \"ContainerInfo\", ContainerInfo,\n \"KubernetesInfo\", KubernetesInfo,\n \"DstIpAddr\", DstIpAddr,\n \"DstPortNumber\", DstPortNumber,\n \"SrcIpAddr\", SrcIpAddr,\n \"SrcMachineIp\", SrcMachineIp,\n \"SrcPortNumber\", SrcPortNumber,\n \"LoginAccountDomain\", LoginAccountDomain,\n \"LoginAccountSid\", LoginAccountSid,\n \"LoginIsAdministratorEquivalent\", LoginIsAdministratorEquivalent,\n \"ModulePath\", ModulePath,\n \"ModuleSha1\", ModuleSha1,\n \"NetEventDirection\", NetEventDirection,\n \"RegistryKeyPath\", RegistryKeyPath,\n \"RegistryOldValue\", RegistryOldValue,\n \"RegistryOldValueType\", RegistryOldValueType,\n \"TiIndicatorComparisonMethod\", TiIndicatorComparisonMethod,\n \"TiIndicatorSource\", TiIndicatorSource,\n \"TiIndicatorType\", TiIndicatorType,\n \"TiIndicatorValue\", TiIndicatorValue,\n \"Source\", Source,\n \"ReportedAt\", ReportedAt,\n \"UpdatedAt\", UpdatedAt,\n \"S1ql\", S1ql\n ),\n dynamic({}))\n | project\n TimeGenerated,\n AlertId,\n AlertName,\n AlertDescription,\n AlertVerdict,\n AlertStatus,\n AlertOriginalStatus,\n Dvc,\n DvcDescription,\n DvcIpAddr,\n DvcId,\n DvcIdType,\n DvcOs,\n DvcOsVersion,\n User,\n ProcessName,\n ProcessId,\n ProcessCommandLine,\n ProcessFileCompany,\n FileName,\n FilePath,\n FileSHA1,\n FileSHA256,\n FileMD5,\n //Url,\n RegistryKey,\n RegistryValue,\n RegistryValueData,\n //Email,\n EventUid,\n EventType,\n EventCount,\n EventSeverity,\n EventOriginalSeverity,\n EventMessage,\n EventOriginalType,\n EventSubType,\n EventOriginalSubType,\n EventStartTime,\n EventEndTime,\n EventProduct,\n EventVendor,\n EventResult,\n EventSchema,\n EventSchemaVersion,\n IpAddr,\n Username,\n UsernameType,\n Rule,\n RuleNumber,\n RuleName,\n RuleDescription,\n DvcHostname,\n Hostname,\n ThreatOriginalCategory,\n AttackTactics,\n AttackTechniques,\n Type,\n AdditionalFields\n};\nSentinelOneAlertsParser\n(\n disabled = disabled,\n pack = pack\n)", + "version": 1, + "functionParameters": "disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/README.md b/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/README.md new file mode 100644 index 00000000000..964337ca92a --- /dev/null +++ b/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/README.md @@ -0,0 +1,21 @@ +# SentinelOne ASIM AlertEvent Normalization Parser + +ARM template for ASIM AlertEvent schema parser for SentinelOne. + +This ASIM parser supports normalizing the SentinelOne Singularity Alerts ingested in SentinelOneAlerts_CL table (via Codeless Connector Framework) to the ASIM Alert normalized schema. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM AlertEvent normalization schema reference](https://aka.ms/ASimAlertEventDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventSentinelOneSingularityAlerts.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAlertEvent%2FARM%2FASimAlertEventSentinelOneSingularityAlerts%2FASimAlertEventSentinelOneSingularityAlerts.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAlertEvent%2FARM%2FASimAlertEventSentinelOneSingularityAlerts%2FASimAlertEventSentinelOneSingularityAlerts.json) diff --git a/Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json b/Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json index a263311f258..6b4215bb5e1 100644 --- a/Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json +++ b/Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json @@ -218,6 +218,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedASimAlertEventSentinelOneSingularityAlerts", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/ASimAlertEventSentinelOneSingularityAlerts.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", @@ -437,6 +457,26 @@ } } } + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedvimAlertEventSentinelOneSingularityAlerts", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/vimAlertEventSentinelOneSingularityAlerts.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } } ], "outputs": {} diff --git a/Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json b/Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json index 44cb32303cb..aacad841d7e 100644 --- a/Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json +++ b/Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json @@ -27,7 +27,7 @@ "displayName": "Alert Event ASIM filtering parser", "category": "ASIM", "FunctionAlias": "imAlertEvent", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAlertEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser | where isnotempty(SourceSpecificParser));\nlet vimBuiltInDisabled=toscalar('ExcludevimAlertEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(\n starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n ipaddr_has_any_prefix: dynamic=dynamic([]),\n hostname_has_any: dynamic=dynamic([]),\n username_has_any: dynamic=dynamic([]),\n attacktactics_has_any: dynamic=dynamic([]),\n attacktechniques_has_any: dynamic=dynamic([]),\n threatcategory_has_any: dynamic=dynamic([]),\n alertverdict_has_any: dynamic=dynamic([]),\n eventseverity_has_any: dynamic=dynamic([]),\n pack:bool=false)\n{\nunion isfuzzy=true\n vimAlertEventEmpty,\n vimAlertEventBitdefenderGravityZone (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertBitdefenderGravityZone' in (DisabledParsers))), pack=pack),\n vimAlertEventMicrosoftDefenderXDR (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertMicrosoftDefenderXDR' in (DisabledParsers)))),\n vimAlertEventSentinelOneSingularity (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertSentinelOneSingularity' in (DisabledParsers)))),\n vimAlertEventCiscoSecureEndpoint (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack),\n vimAlertEventPaloAltoXDR (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack),\n vimAlertEventNetskopeSecurityCloud (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack),\n vimAlertEventCrowdStrikeFalcon (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n vimAlertEventGoogleSecOps (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertGoogleSecOps' in (DisabledParsers))), pack=pack),\n vimAlertEventGoogleThreatIntelligence (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventGoogleThreatIntelligence' in (DisabledParsers))), pack=pack)\n};\nparser (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, pack=pack)\n", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAlertEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser | where isnotempty(SourceSpecificParser));\nlet vimBuiltInDisabled=toscalar('ExcludevimAlertEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(\n starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n ipaddr_has_any_prefix: dynamic=dynamic([]),\n hostname_has_any: dynamic=dynamic([]),\n username_has_any: dynamic=dynamic([]),\n attacktactics_has_any: dynamic=dynamic([]),\n attacktechniques_has_any: dynamic=dynamic([]),\n threatcategory_has_any: dynamic=dynamic([]),\n alertverdict_has_any: dynamic=dynamic([]),\n eventseverity_has_any: dynamic=dynamic([]),\n pack:bool=false)\n{\nunion isfuzzy=true\n vimAlertEventEmpty,\n vimAlertEventBitdefenderGravityZone (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertBitdefenderGravityZone' in (DisabledParsers))), pack=pack),\n vimAlertEventMicrosoftDefenderXDR (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertMicrosoftDefenderXDR' in (DisabledParsers)))),\n vimAlertEventSentinelOneSingularity (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertSentinelOneSingularity' in (DisabledParsers)))),\n vimAlertEventSentinelOneSingularityAlerts (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertSentinelOneSingularityAlerts' in (DisabledParsers)))),\n vimAlertEventCiscoSecureEndpoint (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack),\n vimAlertEventPaloAltoXDR (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack),\n vimAlertEventNetskopeSecurityCloud (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack),\n vimAlertEventCrowdStrikeFalcon (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n vimAlertEventGoogleSecOps (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertGoogleSecOps' in (DisabledParsers))), pack=pack)\n};\nparser (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),ipaddr_has_any_prefix:dynamic=dynamic([]),hostname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),attacktactics_has_any:dynamic=dynamic([]),attacktechniques_has_any:dynamic=dynamic([]),threatcategory_has_any:dynamic=dynamic([]),alertverdict_has_any:dynamic=dynamic([]),eventseverity_has_any:dynamic=dynamic([]),pack:bool=False" } diff --git a/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/README.md b/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/README.md new file mode 100644 index 00000000000..953f4785227 --- /dev/null +++ b/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/README.md @@ -0,0 +1,21 @@ +# SentinelOne ASIM AlertEvent Normalization Parser + +ARM template for ASIM AlertEvent schema parser for SentinelOne. + +This ASIM parser supports normalizing and filtering SentinelOne Singularity Alerts ingested in SentinelOneAlerts_CL table (via Codeless Connector Framework) to the ASIM Alert normalized schema. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM AlertEvent normalization schema reference](https://aka.ms/ASimAlertEventDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventSentinelOneSingularityAlerts.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAlertEvent%2FARM%2FvimAlertEventSentinelOneSingularityAlerts%2FvimAlertEventSentinelOneSingularityAlerts.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAlertEvent%2FARM%2FvimAlertEventSentinelOneSingularityAlerts%2FvimAlertEventSentinelOneSingularityAlerts.json) diff --git a/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/vimAlertEventSentinelOneSingularityAlerts.json b/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/vimAlertEventSentinelOneSingularityAlerts.json new file mode 100644 index 00000000000..0d8bd710971 --- /dev/null +++ b/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/vimAlertEventSentinelOneSingularityAlerts.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/vimAlertEventSentinelOneSingularityAlerts')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Alert Event ASIM filtering parser for SentinelOne Singularity Alerts via CCF", + "category": "ASIM", + "FunctionAlias": "vimAlertEventSentinelOneSingularityAlerts", + "query": "let AnalystVerdictArray = dynamic([\n \"true positive\",\n \"false positive\",\n \"benign positive\"\n]);\nlet EventSubTypeLookup = datatable(EventOriginalSubType: string, EventSubType: string)[\n \"malicious\", \"Threat\",\n \"suspicious\", \"Suspicious Activity\",\n \"undefined\", \"Anomaly\"\n];\nlet AlertStatusLookup = datatable(AlertOriginalStatus: string, AlertStatus: string)[\n \"unresolved\", \"Active\",\n \"in progress\", \"Active\",\n \"resolved\", \"Closed\"\n];\nlet SentinelOneAlertsParser = (\n starttime: datetime = datetime(null),\n endtime: datetime = datetime(null),\n ipaddr_has_any_prefix: dynamic = dynamic([]),\n hostname_has_any: dynamic = dynamic([]),\n username_has_any: dynamic = dynamic([]),\n attacktactics_has_any: dynamic = dynamic([]),\n attacktechniques_has_any: dynamic = dynamic([]),\n threatcategory_has_any: dynamic = dynamic([]),\n alertverdict_has_any: dynamic = dynamic([]),\n eventseverity_has_any: dynamic = dynamic([]),\n disabled: bool = false,\n pack: bool = false\n)\n{\n SentinelOneAlerts_CL\n | where not(disabled)\n //Time Filter\n | where (isnull(starttime) or TimeGenerated >= starttime)\n and (isnull(endtime) or TimeGenerated <= endtime)\n | extend \n SourceProcessInfoJson = parse_json(SourceProcessInfo),\n TargetProcessInfoJson = parse_json(TargetProcessInfo),\n SourceParentProcessInfoJson = parse_json(SourceParentProcessInfo),\n KubernetesInfoJson = parse_json(KubernetesInfo),\n ContainerInfoJson = parse_json(ContainerInfo),\n AlertInfoJson = parse_json(AlertInfo),\n RuleInfoJson = parse_json(RuleInfo),\n AgentDetectionInfoJson = parse_json(AgentDetectionInfo)\n //Filter for IpAddr and HostName\n | where (array_length(ipaddr_has_any_prefix) == 0\n or has_any_ipv4_prefix(AlertInfoJson.srcIp, ipaddr_has_any_prefix)\n or has_any_ipv4_prefix(AlertInfoJson.srcMachineIp, ipaddr_has_any_prefix))\n and (array_length(hostname_has_any) == 0 or AgentDetectionInfoJson.name has_any (hostname_has_any))\n and (array_length(threatcategory_has_any) == 0) // ThreatCategory for SentinlOneAlerts not available in source\n //Early Extraction for Filter Columns\n | extend\n Username = \n tostring(coalesce(\n AlertInfoJson.loginsUserName,\n SourceProcessInfoJson.effectiveUser,\n SourceProcessInfoJson.loginUser,\n SourceProcessInfoJson.realUser,\n SourceProcessInfoJson.user,\n SourceParentProcessInfoJson.effectiveUser,\n SourceParentProcessInfoJson.loginUser,\n SourceParentProcessInfoJson.realUser,\n SourceParentProcessInfoJson.user\n )),\n AlertVerdict = iff(AlertInfoJson.analystVerdict in~ (AnalystVerdictArray), AlertInfoJson.analystVerdict, \"Unknown\"),\n EventSeverity = iff(RuleInfoJson.severity=~\"Critical\",\"High\",tostring(RuleInfoJson.severity)),\n AttackTactics = strcat_array(extract_all(@\">([\\S ]+) \\(TA0\\d{3}\\)<\",tostring(AlertInfoJson.indicatorDescription)),\", \"),\n AttackTechniques = extract_all(@\">(T\\d{4}.\\d{3}?)<.*>(.*):<\",dynamic([2,1]),tostring(AlertInfoJson.indicatorDescription))\n //Filter for User, Alert Verdict and Event Severity\n | where array_length(username_has_any) == 0 or Username has_any (username_has_any)\n and (array_length(alertverdict_has_any) == 0 or AlertVerdict has_any (alertverdict_has_any))\n and (array_length(eventseverity_has_any) == 0 or EventSeverity has_any (eventseverity_has_any))\n and (array_length(attacktactics_has_any) == 0) or (AttackTactics has_any (attacktactics_has_any))\n and (array_length(attacktechniques_has_any) == 0) or (AttackTechniques has_any (attacktechniques_has_any))\n | extend\n //Inspection Fields\n AlertName = tostring(RuleInfoJson.name),\n AlertOriginalStatus = tolower(AlertInfoJson.incidentStatus),\n EventOriginalSubType = tolower(RuleInfoJson.treatAsThreat),\n EventOriginalType = tostring(AlertInfoJson.eventType),\n RuleNumber = toint(RuleInfoJson.id),\n RuleName = tostring(RuleInfoJson.name),\n RuleDescription = tostring(RuleInfoJson.description),\n ThreatOriginalCategory = tostring(AlertInfoJson.indicatorName),\n //User Fields\n OriginalUserType = AlertInfoJson.loginType,\n UsernameType = case(\n Username contains \"@\", \"UPN\",\n Username contains \"\\\\\", \"Windows\",\n Username contains \"OU=\", \"DN\",\n Username matches regex @\"^\\d{11}$\",\"AWSId\",\n \"Simple\"\n ),\n //Device fields\n DvcHostname = tostring(split(AgentDetectionInfoJson.name,\".\")[0]),\n DvcDescription = tostring(AgentDetectionInfoJson.machineType),\n DvcIpAddr = tostring(coalesce(AlertInfoJson.srcIp,AlertInfoJson.srcMachineIp)),\n DvcOs = tostring(AgentDetectionInfoJson.osFamily),\n DvcOsVersion = tostring(AgentDetectionInfoJson.osName),\n DvcId = tostring(AgentDetectionInfoJson.uuid),\n DvcIdType = \"Other\",\n //Common ASIM Fields\n EventUid = tostring(AlertInfoJson.alertId),\n EventType = \"Alert\",\n EventCount = int(1),\n EventStartTime = todatetime(AlertInfoJson.createdAt),\n EventEndTime = todatetime(AlertInfoJson.createdAt),\n EventProduct = \"Singularity\",\n EventVendor = \"SentinelOne\",\n EventResult = \"Success\",\n EventSchema = \"AlertEvent\",\n EventSchemaVersion=\"0.1\",\n EventOriginalSeverity = tostring(RuleInfoJson.severity),\n EventMessage = \n case(\n isnotempty(AlertInfoJson.indicatorDescription),\n extract(@\"(.*)\\n?\",1,tostring(AlertInfoJson.indicatorDescription)),\n AlertInfoJson.eventType =~ \"WINLOGONATTEMPT\" and AlertInfoJson.loginIsSuccessful =~ \"false\",\n strcat(AlertInfoJson.loginType, \" logon failed user - \", AlertInfoJson.loginsUserName),\n AlertInfoJson.eventType =~ \"WINLOGONATTEMPT\" and AlertInfoJson.loginIsSuccessful =~ \"true\",\n strcat(AlertInfoJson.loginType, \" logon successful user - \", AlertInfoJson.loginsUserName),\n AlertInfoJson.eventType =~ \"DNS\",\n strcat(\"DNS request for \", AlertInfoJson.dnsRequest , \" returned \", AlertInfoJson.dnsResponse),\n AlertInfoJson.eventType =~ \"REGVALUEMODIFIED\",\n strcat(\"A registry value has been modified\\n\",\"RegistryKey: \",AlertInfoJson.registryKeyPath, \"\\nRegistryOldValue: \",AlertInfoJson.registryOldValue, \"\\nRegistryNewValue: \",AlertInfoJson.registryValue),\n tostring(RuleInfoJson.description)\n )\n //Normalize Mitre Format\n | mv-apply AttackTechniques on \n (\n extend Technique = iff (isnotempty(AttackTechniques),strcat(AttackTechniques[0],\" (\",AttackTechniques[1],\")\"),\"\") \n | summarize AttackTechniques = strcat_array(make_set_if(Technique,isnotempty(Technique)),\", \")\n )\n | lookup AlertStatusLookup on AlertOriginalStatus\n | lookup EventSubTypeLookup on EventOriginalSubType\n | extend\n //Process Fields\n ProcessId = tostring(SourceProcessInfoJson.pid),\n ProcessCommandLine = tostring(SourceProcessInfoJson.commandline),\n ProcessName = tostring(SourceProcessInfoJson.filePath),\n ProcessFileCompany = tostring(SourceProcessInfoJson.fileSignerIdentity),\n //File Fields\n FileName = tostring(SourceProcessInfoJson.name),\n FilePath = tostring(SourceProcessInfoJson.filePath),\n FileSHA1 = tostring(SourceProcessInfoJson.fileHashSha1),\n FileSHA256 = tostring(SourceProcessInfoJson.fileHashSha256),\n FileMD5 = tostring(SourceProcessInfoJson.fileHashMd5),\n //Registry Fields\n RegistryKey = tostring(AlertInfoJson.registryPath),\n RegistryValue = tostring(split(AlertInfoJson.registryPath,\"\\\\\")[-1]),\n RegistryValueData = tostring(AlertInfoJson.registryValue)\n //Alias\n | extend \n IpAddr = DvcIpAddr,\n Hostname = DvcHostname,\n Dvc = DvcHostname,\n AlertId = EventUid,\n AlertDescription = EventMessage,\n Rule = RuleName,\n User = Username\n //AdditionalFields\n | extend\n DstIpAddr = tostring(AlertInfoJson.dstIp),\n DstPortNumber = tostring(AlertInfoJson.dstPort),\n SrcIpAddr = tostring(AlertInfoJson.srcIp),\n SrcMachineIp = tostring(AlertInfoJson.srcMachineIp),\n SrcPortNumber = tostring(AlertInfoJson.srcPort),\n LoginAccountDomain = tostring(AlertInfoJson.loginAccountDomain),\n LoginAccountSid = tostring(AlertInfoJson.loginAccountSid),\n LoginIsAdministratorEquivalent = tostring(AlertInfoJson.loginIsAdministratorEquivalent),\n ModulePath = tostring(AlertInfoJson.modulePath),\n ModuleSha1 = tostring(AlertInfoJson.moduleSha1),\n NetEventDirection = tostring(AlertInfoJson.netEventDirection),\n RegistryKeyPath = tostring(AlertInfoJson.registryKeyPath),\n RegistryOldValue = tostring(AlertInfoJson.registryOldValue),\n RegistryOldValueType = tostring(AlertInfoJson.registryOldValueType),\n TiIndicatorComparisonMethod = tostring(AlertInfoJson.tiIndicatorComparisonMethod),\n TiIndicatorSource = tostring(AlertInfoJson.tiIndicatorSource),\n TiIndicatorType = tostring(AlertInfoJson.tiIndicatorType),\n TiIndicatorValue = tostring(AlertInfoJson.tiIndicatorValue),\n Source = tostring(AlertInfoJson.source),\n ReportedAt = tostring(AlertInfoJson.reportedAt),\n UpdatedAt = tostring(AlertInfoJson.updatedAt),\n S1ql = tostring(RuleInfoJson.s1ql)\n | extend AdditionalFields = \n iff(pack == true,\n bag_pack(\n \"SourceProcessInfo\", SourceProcessInfo,\n \"SourceParentProcessInfo\", SourceParentProcessInfo,\n \"TargetProcessInfo\", TargetProcessInfo,\n \"ContainerInfo\", ContainerInfo,\n \"KubernetesInfo\", KubernetesInfo,\n \"DstIpAddr\", DstIpAddr,\n \"DstPortNumber\", DstPortNumber,\n \"SrcIpAddr\", SrcIpAddr,\n \"SrcMachineIp\", SrcMachineIp,\n \"SrcPortNumber\", SrcPortNumber,\n \"LoginAccountDomain\", LoginAccountDomain,\n \"LoginAccountSid\", LoginAccountSid,\n \"LoginIsAdministratorEquivalent\", LoginIsAdministratorEquivalent,\n \"ModulePath\", ModulePath,\n \"ModuleSha1\", ModuleSha1,\n \"NetEventDirection\", NetEventDirection,\n \"RegistryKeyPath\", RegistryKeyPath,\n \"RegistryOldValue\", RegistryOldValue,\n \"RegistryOldValueType\", RegistryOldValueType,\n \"TiIndicatorComparisonMethod\", TiIndicatorComparisonMethod,\n \"TiIndicatorSource\", TiIndicatorSource,\n \"TiIndicatorType\", TiIndicatorType,\n \"TiIndicatorValue\", TiIndicatorValue,\n \"Source\", Source,\n \"ReportedAt\", ReportedAt,\n \"UpdatedAt\", UpdatedAt,\n \"S1ql\", S1ql\n ),\n dynamic({}))\n | project\n TimeGenerated,\n AlertId,\n AlertName,\n AlertDescription,\n AlertVerdict,\n AlertStatus,\n AlertOriginalStatus,\n Dvc,\n DvcDescription,\n DvcIpAddr,\n DvcId,\n DvcIdType,\n DvcOs,\n DvcOsVersion,\n User,\n ProcessName,\n ProcessId,\n ProcessCommandLine,\n ProcessFileCompany,\n FileName,\n FilePath,\n FileSHA1,\n FileSHA256,\n FileMD5,\n //Url,\n RegistryKey,\n RegistryValue,\n RegistryValueData,\n //Email,\n EventUid,\n EventType,\n EventCount,\n EventSeverity,\n EventOriginalSeverity,\n EventMessage,\n EventOriginalType,\n EventSubType,\n EventOriginalSubType,\n EventStartTime,\n EventEndTime,\n EventProduct,\n EventVendor,\n EventResult,\n EventSchema,\n EventSchemaVersion,\n IpAddr,\n Username,\n UsernameType,\n Rule,\n RuleNumber,\n RuleName,\n RuleDescription,\n DvcHostname,\n Hostname,\n ThreatOriginalCategory,\n AttackTactics,\n AttackTechniques,\n Type,\n AdditionalFields\n};\nSentinelOneAlertsParser\n(\n starttime = starttime, \n endtime = endtime, \n ipaddr_has_any_prefix = ipaddr_has_any_prefix,\n hostname_has_any = hostname_has_any,\n username_has_any = username_has_any,\n attacktactics_has_any = attacktactics_has_any,\n attacktechniques_has_any = attacktechniques_has_any,\n threatcategory_has_any = threatcategory_has_any,\n alertverdict_has_any = alertverdict_has_any,\n eventseverity_has_any = eventseverity_has_any,\n disabled = disabled,\n pack = pack\n)", + "version": 1, + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),ipaddr_has_any_prefix:dynamic=dynamic([]),hostname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),attacktactics_has_any:dynamic=dynamic([]),attacktechniques_has_any:dynamic=dynamic([]),threatcategory_has_any:dynamic=dynamic([]),alertverdict_has_any:dynamic=dynamic([]),eventseverity_has_any:dynamic=dynamic([]),disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md b/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md index c6916ee3816..aa8b9234643 100644 --- a/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md +++ b/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md @@ -2,6 +2,7 @@ ## Version 0.1.7 +- (2026-07-28) Alert Schema Parsers - [PR #14771](https://github.com/Azure/Azure-Sentinel/pull/14771) - (2026-07-01) Google Threat Intelligence - AlertEvent ASIM Parser - [PR #14420](https://github.com/Azure/Azure-Sentinel/pull/14420) ## Version 0.1.6 diff --git a/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventSentinelOneSingularityAlerts.md b/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventSentinelOneSingularityAlerts.md new file mode 100644 index 00000000000..92879b09cc0 --- /dev/null +++ b/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventSentinelOneSingularityAlerts.md @@ -0,0 +1,6 @@ +# Changelog for ASimAlertEventSentinelOneSingularityAlerts.yaml + +## Version 0.1.0 + +- (2026-07-28) Alert Schema Parsers - [PR #14771](https://github.com/Azure/Azure-Sentinel/pull/14771) + diff --git a/Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md b/Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md index e4977d58c4a..ce9f43a4262 100644 --- a/Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md +++ b/Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md @@ -2,6 +2,7 @@ ## Version 0.1.7 +- (2026-07-28) Alert Schema Parsers - [PR #14771](https://github.com/Azure/Azure-Sentinel/pull/14771) - (2026-07-01) Google Threat Intelligence - AlertEvent ASIM Parser - [PR #14420](https://github.com/Azure/Azure-Sentinel/pull/14420) ## Version 0.1.6 diff --git a/Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventSentinelOneSingularityAlerts.md b/Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventSentinelOneSingularityAlerts.md new file mode 100644 index 00000000000..3cdeddd27b5 --- /dev/null +++ b/Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventSentinelOneSingularityAlerts.md @@ -0,0 +1,6 @@ +# Changelog for vimAlertEventSentinelOneSingularityAlerts.yaml + +## Version 0.1.0 + +- (2026-07-28) Alert Schema Parsers - [PR #14771](https://github.com/Azure/Azure-Sentinel/pull/14771) + diff --git a/Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml b/Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml index bca5a28a7e9..7e0730e67b1 100644 --- a/Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml +++ b/Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml @@ -1,7 +1,7 @@ Parser: Title: Alert Event ASIM parser Version: '0.1.7' - LastUpdated: Jul 01, 2026 + LastUpdated: Jul 28, 2026 Product: Name: Source agnostic Normalization: @@ -21,6 +21,7 @@ Parsers: - _ASim_AlertEvent_BitdefenderGravityZone - _ASim_AlertEvent_MicrosoftDefenderXDR - _ASim_AlertEvent_SentinelOneSingularity + - _ASim_AlertEvent_SentinelOneSingularityAlerts - _ASim_AlertEvent_CiscoSecureEndpoint - _ASim_AlertEvent_PaloAltoXDR - _ASim_AlertEvent_NetskopeSecurityCloud @@ -40,6 +41,7 @@ ParserQuery: | ASimAlertEventBitdefenderGravityZone (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventBitdefenderGravityZone' in (DisabledParsers))), pack=pack), ASimAlertEventMicrosoftDefenderXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventMicrosoftDefenderXDR' in (DisabledParsers)))), ASimAlertEventSentinelOneSingularity (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularity' in (DisabledParsers)))), + ASimAlertEventSentinelOneSingularityAlerts (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularityAlerts' in (DisabledParsers)))), ASimAlertEventCiscoSecureEndpoint (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack), ASimAlertEventPaloAltoXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack), ASimAlertEventNetskopeSecurityCloud (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack), diff --git a/Parsers/ASimAlertEvent/Parsers/ASimAlertEventSentinelOneSingularityAlerts.yaml b/Parsers/ASimAlertEvent/Parsers/ASimAlertEventSentinelOneSingularityAlerts.yaml new file mode 100644 index 00000000000..c9019e5dcf9 --- /dev/null +++ b/Parsers/ASimAlertEvent/Parsers/ASimAlertEventSentinelOneSingularityAlerts.yaml @@ -0,0 +1,282 @@ +Parser: + Title: Alert Event ASIM parser for SentinelOne Singularity Alerts via CCF + Version: '0.1.0' + LastUpdated: July 24, 2026 +Product: + Name: SentinelOne +Normalization: + Schema: AlertEvent + Version: '0.1' +References: +- Title: ASIM Alert Event Schema + Link: https://aka.ms/ASimAlertEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: Developer + Link: https://www.bluevoyant.com/ +Description: | + This ASIM parser supports normalizing the SentinelOne Singularity Alerts ingested in SentinelOneAlerts_CL table (via Codeless Connector Framework) to the ASIM Alert normalized schema. +ParserName: ASimAlertEventSentinelOneSingularityAlerts +EquivalentBuiltInParser: _ASim_AlertEvent_SentinelOneSingularityAlerts +ParserParams: + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let AnalystVerdictArray = dynamic([ + "true positive", + "false positive", + "benign positive" + ]); + let EventSubTypeLookup = datatable(EventOriginalSubType: string, EventSubType: string)[ + "malicious", "Threat", + "suspicious", "Suspicious Activity", + "undefined", "Anomaly" + ]; + let AlertStatusLookup = datatable(AlertOriginalStatus: string, AlertStatus: string)[ + "unresolved", "Active", + "in progress", "Active", + "resolved", "Closed" + ]; + let SentinelOneAlertsParser = ( + disabled: bool = false, + pack: bool = false + ) + { + SentinelOneAlerts_CL + | where not(disabled) + //parse columns accessed repeatedly for efficiency and readability + | extend + AlertInfoJson = parse_json(AlertInfo), + AgentDetectionInfoJson = parse_json(AgentDetectionInfo), + SourceProcessInfoJson = parse_json(SourceProcessInfo), + SourceParentProcessInfoJson = parse_json(SourceParentProcessInfo), + RuleInfoJson = parse_json(RuleInfo) + | extend + Username = + tostring(coalesce( + AlertInfoJson.loginsUserName, + SourceProcessInfoJson.effectiveUser, + SourceProcessInfoJson.loginUser, + SourceProcessInfoJson.realUser, + SourceProcessInfoJson.user, + SourceParentProcessInfoJson.effectiveUser, + SourceParentProcessInfoJson.loginUser, + SourceParentProcessInfoJson.realUser, + SourceParentProcessInfoJson.user + )), + AlertVerdict = iff(AlertInfoJson.analystVerdict in~ (AnalystVerdictArray), AlertInfoJson.analystVerdict, "Unknown"), + EventSeverity = iff(RuleInfoJson.severity=~"Critical","High",tostring(RuleInfoJson.severity)), + AttackTactics = strcat_array(extract_all(@">([\S ]+) \(TA0\d{3}\)<",tostring(AlertInfoJson.indicatorDescription)),", "), + AttackTechniques = extract_all(@">(T\d{4}.\d{3}?)<.*>(.*):<",dynamic([2,1]),tostring(AlertInfoJson.indicatorDescription)) + | extend + //Inspection Fields + AlertName = tostring(RuleInfoJson.name), + AlertOriginalStatus = tolower(AlertInfoJson.incidentStatus), + EventOriginalSubType = tolower(RuleInfoJson.treatAsThreat), + EventOriginalType = tostring(AlertInfoJson.eventType), + RuleNumber = toint(RuleInfoJson.id), + RuleName = tostring(RuleInfoJson.name), + RuleDescription = tostring(RuleInfoJson.description), + ThreatOriginalCategory = tostring(AlertInfoJson.indicatorName), + //User Fields + OriginalUserType = AlertInfoJson.loginType, + UsernameType = case( + Username contains "@", "UPN", + Username contains "\\", "Windows", + Username contains "OU=", "DN", + Username matches regex @"^\d{11}$","AWSId", + "Simple" + ), + //Device fields + DvcHostname = tostring(split(AgentDetectionInfoJson.name,".")[0]), + DvcDescription = tostring(AgentDetectionInfoJson.machineType), + DvcIpAddr = tostring(coalesce(AlertInfoJson.srcIp,AlertInfoJson.srcMachineIp)), + DvcOs = tostring(AgentDetectionInfoJson.osFamily), + DvcOsVersion = tostring(AgentDetectionInfoJson.osName), + DvcId = tostring(AgentDetectionInfoJson.uuid), + DvcIdType = "Other", + //Common ASIM Fields + EventUid = tostring(AlertInfoJson.alertId), + EventType = "Alert", + EventCount = int(1), + EventStartTime = todatetime(AlertInfoJson.createdAt), + EventEndTime = todatetime(AlertInfoJson.createdAt), + EventProduct = "Singularity", + EventVendor = "SentinelOne", + EventResult = "Success", + EventSchema = "AlertEvent", + EventSchemaVersion="0.1", + EventOriginalSeverity = tostring(RuleInfoJson.severity), + EventMessage = + case( + isnotempty(AlertInfoJson.indicatorDescription), + extract(@"(.*)\n?",1,tostring(AlertInfoJson.indicatorDescription)), + AlertInfoJson.eventType =~ "WINLOGONATTEMPT" and AlertInfoJson.loginIsSuccessful =~ "false", + strcat(AlertInfoJson.loginType, " logon failed user - ", AlertInfoJson.loginsUserName), + AlertInfoJson.eventType =~ "WINLOGONATTEMPT" and AlertInfoJson.loginIsSuccessful =~ "true", + strcat(AlertInfoJson.loginType, " logon successful user - ", AlertInfoJson.loginsUserName), + AlertInfoJson.eventType =~ "DNS", + strcat("DNS request for ", AlertInfoJson.dnsRequest , " returned ", AlertInfoJson.dnsResponse), + AlertInfoJson.eventType =~ "REGVALUEMODIFIED", + strcat("A registry value has been modified\n","RegistryKey: ",AlertInfoJson.registryKeyPath, "\nRegistryOldValue: ",AlertInfoJson.registryOldValue, "\nRegistryNewValue: ",AlertInfoJson.registryValue), + tostring(RuleInfoJson.description) + ) + //Normalize Mitre Format + | mv-apply AttackTechniques on + ( + extend Technique = iff (isnotempty(AttackTechniques),strcat(AttackTechniques[0]," (",AttackTechniques[1],")"),"") + | summarize AttackTechniques = strcat_array(make_set_if(Technique,isnotempty(Technique)),", ") + ) + | lookup AlertStatusLookup on AlertOriginalStatus + | lookup EventSubTypeLookup on EventOriginalSubType + | extend + //Process Fields + ProcessId = tostring(SourceProcessInfoJson.pid), + ProcessCommandLine = tostring(SourceProcessInfoJson.commandline), + ProcessName = tostring(SourceProcessInfoJson.filePath), + ProcessFileCompany = tostring(SourceProcessInfoJson.fileSignerIdentity), + //File Fields + FileName = tostring(SourceProcessInfoJson.name), + FilePath = tostring(SourceProcessInfoJson.filePath), + FileSHA1 = tostring(SourceProcessInfoJson.fileHashSha1), + FileSHA256 = tostring(SourceProcessInfoJson.fileHashSha256), + FileMD5 = tostring(SourceProcessInfoJson.fileHashMd5), + //Registry Fields + RegistryKey = tostring(AlertInfoJson.registryPath), + RegistryValue = tostring(split(AlertInfoJson.registryPath,"\\")[-1]), + RegistryValueData = tostring(AlertInfoJson.registryValue) + //Alias + | extend + IpAddr = DvcIpAddr, + Hostname = DvcHostname, + Dvc = DvcHostname, + AlertId = EventUid, + AlertDescription = EventMessage, + Rule = RuleName, + User = Username + //AdditionalFields + | extend + DstIpAddr = tostring(AlertInfoJson.dstIp), + DstPortNumber = tostring(AlertInfoJson.dstPort), + SrcIpAddr = tostring(AlertInfoJson.srcIp), + SrcMachineIp = tostring(AlertInfoJson.srcMachineIp), + SrcPortNumber = tostring(AlertInfoJson.srcPort), + LoginAccountDomain = tostring(AlertInfoJson.loginAccountDomain), + LoginAccountSid = tostring(AlertInfoJson.loginAccountSid), + LoginIsAdministratorEquivalent = tostring(AlertInfoJson.loginIsAdministratorEquivalent), + ModulePath = tostring(AlertInfoJson.modulePath), + ModuleSha1 = tostring(AlertInfoJson.moduleSha1), + NetEventDirection = tostring(AlertInfoJson.netEventDirection), + RegistryKeyPath = tostring(AlertInfoJson.registryKeyPath), + RegistryOldValue = tostring(AlertInfoJson.registryOldValue), + RegistryOldValueType = tostring(AlertInfoJson.registryOldValueType), + TiIndicatorComparisonMethod = tostring(AlertInfoJson.tiIndicatorComparisonMethod), + TiIndicatorSource = tostring(AlertInfoJson.tiIndicatorSource), + TiIndicatorType = tostring(AlertInfoJson.tiIndicatorType), + TiIndicatorValue = tostring(AlertInfoJson.tiIndicatorValue), + Source = tostring(AlertInfoJson.source), + ReportedAt = tostring(AlertInfoJson.reportedAt), + UpdatedAt = tostring(AlertInfoJson.updatedAt), + S1ql = tostring(RuleInfoJson.s1ql) + | extend AdditionalFields = + iff(pack == true, + bag_pack( + "SourceProcessInfo", SourceProcessInfo, + "SourceParentProcessInfo", SourceParentProcessInfo, + "TargetProcessInfo", TargetProcessInfo, + "ContainerInfo", ContainerInfo, + "KubernetesInfo", KubernetesInfo, + "DstIpAddr", DstIpAddr, + "DstPortNumber", DstPortNumber, + "SrcIpAddr", SrcIpAddr, + "SrcMachineIp", SrcMachineIp, + "SrcPortNumber", SrcPortNumber, + "LoginAccountDomain", LoginAccountDomain, + "LoginAccountSid", LoginAccountSid, + "LoginIsAdministratorEquivalent", LoginIsAdministratorEquivalent, + "ModulePath", ModulePath, + "ModuleSha1", ModuleSha1, + "NetEventDirection", NetEventDirection, + "RegistryKeyPath", RegistryKeyPath, + "RegistryOldValue", RegistryOldValue, + "RegistryOldValueType", RegistryOldValueType, + "TiIndicatorComparisonMethod", TiIndicatorComparisonMethod, + "TiIndicatorSource", TiIndicatorSource, + "TiIndicatorType", TiIndicatorType, + "TiIndicatorValue", TiIndicatorValue, + "Source", Source, + "ReportedAt", ReportedAt, + "UpdatedAt", UpdatedAt, + "S1ql", S1ql + ), + dynamic({})) + | project + TimeGenerated, + AlertId, + AlertName, + AlertDescription, + AlertVerdict, + AlertStatus, + AlertOriginalStatus, + Dvc, + DvcDescription, + DvcIpAddr, + DvcId, + DvcIdType, + DvcOs, + DvcOsVersion, + User, + ProcessName, + ProcessId, + ProcessCommandLine, + ProcessFileCompany, + FileName, + FilePath, + FileSHA1, + FileSHA256, + FileMD5, + //Url, + RegistryKey, + RegistryValue, + RegistryValueData, + //Email, + EventUid, + EventType, + EventCount, + EventSeverity, + EventOriginalSeverity, + EventMessage, + EventOriginalType, + EventSubType, + EventOriginalSubType, + EventStartTime, + EventEndTime, + EventProduct, + EventVendor, + EventResult, + EventSchema, + EventSchemaVersion, + IpAddr, + Username, + UsernameType, + Rule, + RuleNumber, + RuleName, + RuleDescription, + DvcHostname, + Hostname, + ThreatOriginalCategory, + AttackTactics, + AttackTechniques, + Type, + AdditionalFields + }; + SentinelOneAlertsParser + ( + disabled = disabled, + pack = pack + ) \ No newline at end of file diff --git a/Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml b/Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml index ebf0f9ba422..84f1dc71780 100644 --- a/Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml +++ b/Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml @@ -1,7 +1,7 @@ Parser: Title: Alert Event ASIM filtering parser Version: '0.1.7' - LastUpdated: Jul 01, 2026 + LastUpdated: Jul 28, 2026 Product: Name: Source agnostic Normalization: @@ -21,6 +21,7 @@ Parsers: - _Im_AlertEvent_BitdefenderGravityZone - _Im_AlertEvent_MicrosoftDefenderXDR - _Im_AlertEvent_SentinelOneSingularity + - _Im_AlertEvent_SentinelOneSingularityAlerts - _Im_AlertEvent_CiscoSecureEndpoint - _Im_AlertEvent_PaloAltoXDR - _Im_AlertEvent_NetskopeSecurityCloud @@ -82,6 +83,7 @@ ParserQuery: | vimAlertEventBitdefenderGravityZone (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertBitdefenderGravityZone' in (DisabledParsers))), pack=pack), vimAlertEventMicrosoftDefenderXDR (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertMicrosoftDefenderXDR' in (DisabledParsers)))), vimAlertEventSentinelOneSingularity (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertSentinelOneSingularity' in (DisabledParsers)))), + vimAlertEventSentinelOneSingularityAlerts (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertSentinelOneSingularityAlerts' in (DisabledParsers)))), vimAlertEventCiscoSecureEndpoint (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack), vimAlertEventPaloAltoXDR (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack), vimAlertEventNetskopeSecurityCloud (starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, hostname_has_any=hostname_has_any, username_has_any=username_has_any, attacktactics_has_any=attacktactics_has_any, attacktechniques_has_any=attacktechniques_has_any, threatcategory_has_any=threatcategory_has_any, alertverdict_has_any=alertverdict_has_any, eventseverity_has_any=eventseverity_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack), diff --git a/Parsers/ASimAlertEvent/Parsers/vimAlertEventSentinelOneSingularityAlerts.yaml b/Parsers/ASimAlertEvent/Parsers/vimAlertEventSentinelOneSingularityAlerts.yaml new file mode 100644 index 00000000000..3a53cff53ac --- /dev/null +++ b/Parsers/ASimAlertEvent/Parsers/vimAlertEventSentinelOneSingularityAlerts.yaml @@ -0,0 +1,349 @@ +Parser: + Title: Alert Event ASIM filtering parser for SentinelOne Singularity Alerts via CCF + Version: '0.1.0' + LastUpdated: July 28, 2026 +Product: + Name: SentinelOne +Normalization: + Schema: AlertEvent + Version: '0.1' +References: +- Title: ASIM Alert Event Schema + Link: https://aka.ms/ASimAlertEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: Developer + Link: https://www.bluevoyant.com/ +Description: | + This ASIM parser supports normalizing and filtering SentinelOne Singularity Alerts ingested in SentinelOneAlerts_CL table (via Codeless Connector Framework) to the ASIM Alert normalized schema. +ParserName: vimAlertEventSentinelOneSingularityAlerts +EquivalentBuiltInParser: _Im_AlertEvent_SentinelOneSingularityAlerts +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: ipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: hostname_has_any + Type: dynamic + Default: dynamic([]) + - Name: username_has_any + Type: dynamic + Default: dynamic([]) + - Name: attacktactics_has_any + Type: dynamic + Default: dynamic([]) + - Name: attacktechniques_has_any + Type: dynamic + Default: dynamic([]) + - Name: threatcategory_has_any + Type: dynamic + Default: dynamic([]) + - Name: alertverdict_has_any + Type: dynamic + Default: dynamic([]) + - Name: eventseverity_has_any + Type: dynamic + Default: dynamic([]) + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let AnalystVerdictArray = dynamic([ + "true positive", + "false positive", + "benign positive" + ]); + let EventSubTypeLookup = datatable(EventOriginalSubType: string, EventSubType: string)[ + "malicious", "Threat", + "suspicious", "Suspicious Activity", + "undefined", "Anomaly" + ]; + let AlertStatusLookup = datatable(AlertOriginalStatus: string, AlertStatus: string)[ + "unresolved", "Active", + "in progress", "Active", + "resolved", "Closed" + ]; + let SentinelOneAlertsParser = ( + starttime: datetime = datetime(null), + endtime: datetime = datetime(null), + ipaddr_has_any_prefix: dynamic = dynamic([]), + hostname_has_any: dynamic = dynamic([]), + username_has_any: dynamic = dynamic([]), + attacktactics_has_any: dynamic = dynamic([]), + attacktechniques_has_any: dynamic = dynamic([]), + threatcategory_has_any: dynamic = dynamic([]), + alertverdict_has_any: dynamic = dynamic([]), + eventseverity_has_any: dynamic = dynamic([]), + disabled: bool = false, + pack: bool = false + ) + { + SentinelOneAlerts_CL + | where not(disabled) + //Time Filter + | where (isnull(starttime) or TimeGenerated >= starttime) + and (isnull(endtime) or TimeGenerated <= endtime) + //parse columns accessed repeatedly for efficiency and readability + | extend + AlertInfoJson = parse_json(AlertInfo), + AgentDetectionInfoJson = parse_json(AgentDetectionInfo) + //Filter for IpAddr and HostName + | where (array_length(ipaddr_has_any_prefix) == 0 + or has_any_ipv4_prefix(AlertInfoJson.srcIp, ipaddr_has_any_prefix) + or has_any_ipv4_prefix(AlertInfoJson.srcMachineIp, ipaddr_has_any_prefix)) + and (array_length(hostname_has_any) == 0 or AgentDetectionInfoJson.name has_any (hostname_has_any)) + and (array_length(threatcategory_has_any) == 0) // ThreatCategory for SentinelOneAlerts not available in source + | extend + SourceProcessInfoJson = parse_json(SourceProcessInfo), + SourceParentProcessInfoJson = parse_json(SourceParentProcessInfo), + RuleInfoJson = parse_json(RuleInfo) + //Early Extraction for Filter Columns + | extend + Username = + tostring(coalesce( + AlertInfoJson.loginsUserName, + SourceProcessInfoJson.effectiveUser, + SourceProcessInfoJson.loginUser, + SourceProcessInfoJson.realUser, + SourceProcessInfoJson.user, + SourceParentProcessInfoJson.effectiveUser, + SourceParentProcessInfoJson.loginUser, + SourceParentProcessInfoJson.realUser, + SourceParentProcessInfoJson.user + )), + AlertVerdict = iff(AlertInfoJson.analystVerdict in~ (AnalystVerdictArray), AlertInfoJson.analystVerdict, "Unknown"), + EventSeverity = iff(RuleInfoJson.severity=~"Critical","High",tostring(RuleInfoJson.severity)), + AttackTactics = strcat_array(extract_all(@">([\S ]+) \(TA0\d{3}\)<",tostring(AlertInfoJson.indicatorDescription)),", "), + AttackTechniques = extract_all(@">(T\d{4}.\d{3}?)<.*>(.*):<",dynamic([2,1]),tostring(AlertInfoJson.indicatorDescription)) + //Filter for User, Alert Verdict and Event Severity + | where (array_length(username_has_any) == 0 or Username has_any (username_has_any)) + and (array_length(alertverdict_has_any) == 0 or AlertVerdict has_any (alertverdict_has_any)) + and (array_length(eventseverity_has_any) == 0 or EventSeverity has_any (eventseverity_has_any)) + and (array_length(attacktactics_has_any) == 0) or (AttackTactics has_any (attacktactics_has_any)) + and (array_length(attacktechniques_has_any) == 0) or (AttackTechniques has_any (attacktechniques_has_any)) + | extend + //Inspection Fields + AlertName = tostring(RuleInfoJson.name), + AlertOriginalStatus = tolower(AlertInfoJson.incidentStatus), + EventOriginalSubType = tolower(RuleInfoJson.treatAsThreat), + EventOriginalType = tostring(AlertInfoJson.eventType), + RuleNumber = toint(RuleInfoJson.id), + RuleName = tostring(RuleInfoJson.name), + RuleDescription = tostring(RuleInfoJson.description), + ThreatOriginalCategory = tostring(AlertInfoJson.indicatorName), + //User Fields + OriginalUserType = AlertInfoJson.loginType, + UsernameType = case( + Username contains "@", "UPN", + Username contains "\\", "Windows", + Username contains "OU=", "DN", + Username matches regex @"^\d{11}$","AWSId", + "Simple" + ), + //Device fields + DvcHostname = tostring(split(AgentDetectionInfoJson.name,".")[0]), + DvcDescription = tostring(AgentDetectionInfoJson.machineType), + DvcIpAddr = tostring(coalesce(AlertInfoJson.srcIp,AlertInfoJson.srcMachineIp)), + DvcOs = tostring(AgentDetectionInfoJson.osFamily), + DvcOsVersion = tostring(AgentDetectionInfoJson.osName), + DvcId = tostring(AgentDetectionInfoJson.uuid), + DvcIdType = "Other", + //Common ASIM Fields + EventUid = tostring(AlertInfoJson.alertId), + EventType = "Alert", + EventCount = int(1), + EventStartTime = todatetime(AlertInfoJson.createdAt), + EventEndTime = todatetime(AlertInfoJson.createdAt), + EventProduct = "Singularity", + EventVendor = "SentinelOne", + EventResult = "Success", + EventSchema = "AlertEvent", + EventSchemaVersion="0.1", + EventOriginalSeverity = tostring(RuleInfoJson.severity), + EventMessage = + case( + isnotempty(AlertInfoJson.indicatorDescription), + extract(@"(.*)\n?",1,tostring(AlertInfoJson.indicatorDescription)), + AlertInfoJson.eventType =~ "WINLOGONATTEMPT" and AlertInfoJson.loginIsSuccessful =~ "false", + strcat(AlertInfoJson.loginType, " logon failed user - ", AlertInfoJson.loginsUserName), + AlertInfoJson.eventType =~ "WINLOGONATTEMPT" and AlertInfoJson.loginIsSuccessful =~ "true", + strcat(AlertInfoJson.loginType, " logon successful user - ", AlertInfoJson.loginsUserName), + AlertInfoJson.eventType =~ "DNS", + strcat("DNS request for ", AlertInfoJson.dnsRequest , " returned ", AlertInfoJson.dnsResponse), + AlertInfoJson.eventType =~ "REGVALUEMODIFIED", + strcat("A registry value has been modified\n","RegistryKey: ",AlertInfoJson.registryKeyPath, "\nRegistryOldValue: ",AlertInfoJson.registryOldValue, "\nRegistryNewValue: ",AlertInfoJson.registryValue), + tostring(RuleInfoJson.description) + ) + //Normalize Mitre Format + | mv-apply AttackTechniques on + ( + extend Technique = iff (isnotempty(AttackTechniques),strcat(AttackTechniques[0]," (",AttackTechniques[1],")"),"") + | summarize AttackTechniques = strcat_array(make_set_if(Technique,isnotempty(Technique)),", ") + ) + | lookup AlertStatusLookup on AlertOriginalStatus + | lookup EventSubTypeLookup on EventOriginalSubType + | extend + //Process Fields + ProcessId = tostring(SourceProcessInfoJson.pid), + ProcessCommandLine = tostring(SourceProcessInfoJson.commandline), + ProcessName = tostring(SourceProcessInfoJson.filePath), + ProcessFileCompany = tostring(SourceProcessInfoJson.fileSignerIdentity), + //File Fields + FileName = tostring(SourceProcessInfoJson.name), + FilePath = tostring(SourceProcessInfoJson.filePath), + FileSHA1 = tostring(SourceProcessInfoJson.fileHashSha1), + FileSHA256 = tostring(SourceProcessInfoJson.fileHashSha256), + FileMD5 = tostring(SourceProcessInfoJson.fileHashMd5), + //Registry Fields + RegistryKey = tostring(AlertInfoJson.registryPath), + RegistryValue = tostring(split(AlertInfoJson.registryPath,"\\")[-1]), + RegistryValueData = tostring(AlertInfoJson.registryValue) + //Alias + | extend + IpAddr = DvcIpAddr, + Hostname = DvcHostname, + Dvc = DvcHostname, + AlertId = EventUid, + AlertDescription = EventMessage, + Rule = RuleName, + User = Username + //AdditionalFields + | extend + DstIpAddr = tostring(AlertInfoJson.dstIp), + DstPortNumber = tostring(AlertInfoJson.dstPort), + SrcIpAddr = tostring(AlertInfoJson.srcIp), + SrcMachineIp = tostring(AlertInfoJson.srcMachineIp), + SrcPortNumber = tostring(AlertInfoJson.srcPort), + LoginAccountDomain = tostring(AlertInfoJson.loginAccountDomain), + LoginAccountSid = tostring(AlertInfoJson.loginAccountSid), + LoginIsAdministratorEquivalent = tostring(AlertInfoJson.loginIsAdministratorEquivalent), + ModulePath = tostring(AlertInfoJson.modulePath), + ModuleSha1 = tostring(AlertInfoJson.moduleSha1), + NetEventDirection = tostring(AlertInfoJson.netEventDirection), + RegistryKeyPath = tostring(AlertInfoJson.registryKeyPath), + RegistryOldValue = tostring(AlertInfoJson.registryOldValue), + RegistryOldValueType = tostring(AlertInfoJson.registryOldValueType), + TiIndicatorComparisonMethod = tostring(AlertInfoJson.tiIndicatorComparisonMethod), + TiIndicatorSource = tostring(AlertInfoJson.tiIndicatorSource), + TiIndicatorType = tostring(AlertInfoJson.tiIndicatorType), + TiIndicatorValue = tostring(AlertInfoJson.tiIndicatorValue), + Source = tostring(AlertInfoJson.source), + ReportedAt = tostring(AlertInfoJson.reportedAt), + UpdatedAt = tostring(AlertInfoJson.updatedAt), + S1ql = tostring(RuleInfoJson.s1ql) + | extend AdditionalFields = + iff(pack == true, + bag_pack( + "SourceProcessInfo", SourceProcessInfo, + "SourceParentProcessInfo", SourceParentProcessInfo, + "TargetProcessInfo", TargetProcessInfo, + "ContainerInfo", ContainerInfo, + "KubernetesInfo", KubernetesInfo, + "DstIpAddr", DstIpAddr, + "DstPortNumber", DstPortNumber, + "SrcIpAddr", SrcIpAddr, + "SrcMachineIp", SrcMachineIp, + "SrcPortNumber", SrcPortNumber, + "LoginAccountDomain", LoginAccountDomain, + "LoginAccountSid", LoginAccountSid, + "LoginIsAdministratorEquivalent", LoginIsAdministratorEquivalent, + "ModulePath", ModulePath, + "ModuleSha1", ModuleSha1, + "NetEventDirection", NetEventDirection, + "RegistryKeyPath", RegistryKeyPath, + "RegistryOldValue", RegistryOldValue, + "RegistryOldValueType", RegistryOldValueType, + "TiIndicatorComparisonMethod", TiIndicatorComparisonMethod, + "TiIndicatorSource", TiIndicatorSource, + "TiIndicatorType", TiIndicatorType, + "TiIndicatorValue", TiIndicatorValue, + "Source", Source, + "ReportedAt", ReportedAt, + "UpdatedAt", UpdatedAt, + "S1ql", S1ql + ), + dynamic({})) + | project + TimeGenerated, + AlertId, + AlertName, + AlertDescription, + AlertVerdict, + AlertStatus, + AlertOriginalStatus, + Dvc, + DvcDescription, + DvcIpAddr, + DvcId, + DvcIdType, + DvcOs, + DvcOsVersion, + User, + ProcessName, + ProcessId, + ProcessCommandLine, + ProcessFileCompany, + FileName, + FilePath, + FileSHA1, + FileSHA256, + FileMD5, + //Url, + RegistryKey, + RegistryValue, + RegistryValueData, + //Email, + EventUid, + EventType, + EventCount, + EventSeverity, + EventOriginalSeverity, + EventMessage, + EventOriginalType, + EventSubType, + EventOriginalSubType, + EventStartTime, + EventEndTime, + EventProduct, + EventVendor, + EventResult, + EventSchema, + EventSchemaVersion, + IpAddr, + Username, + UsernameType, + Rule, + RuleNumber, + RuleName, + RuleDescription, + DvcHostname, + Hostname, + ThreatOriginalCategory, + AttackTactics, + AttackTechniques, + Type, + AdditionalFields + }; + SentinelOneAlertsParser + ( + starttime = starttime, + endtime = endtime, + ipaddr_has_any_prefix = ipaddr_has_any_prefix, + hostname_has_any = hostname_has_any, + username_has_any = username_has_any, + attacktactics_has_any = attacktactics_has_any, + attacktechniques_has_any = attacktechniques_has_any, + threatcategory_has_any = threatcategory_has_any, + alertverdict_has_any = alertverdict_has_any, + eventseverity_has_any = eventseverity_has_any, + disabled = disabled, + pack = pack + ) \ No newline at end of file diff --git a/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_ASimAlertEvent_DataTest.csv b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_ASimAlertEvent_DataTest.csv new file mode 100644 index 00000000000..3d11176f58d --- /dev/null +++ b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_ASimAlertEvent_DataTest.csv @@ -0,0 +1,10 @@ +Result +"(2) Info: Empty value in 1 records (25.0%) in optional field [ProcessFileCompany] (Schema:AlertEvent)" +"(2) Info: Empty value in 1 records (25.0%) in optional field [RuleNumber] (Schema:AlertEvent)" +"(2) Info: Empty value in 1 records (25.0%) in optional field [ThreatOriginalCategory] (Schema:AlertEvent)" +"(2) Info: Empty value in 1 records (25.0%) in recommended field [AttackTactics] (Schema:AlertEvent)" +"(2) Info: Empty value in 1 records (25.0%) in recommended field [AttackTechniques] (Schema:AlertEvent)" +"(2) Info: Empty value in 3 records (75.0%) in recommended field [DvcIpAddr] (Schema:AlertEvent)" +"(2) Info: Empty value in 4 records (100.0%) in optional field [RegistryKey] (Schema:AlertEvent)" +"(2) Info: Empty value in 4 records (100.0%) in optional field [RegistryValueData] (Schema:AlertEvent)" +"(2) Info: Empty value in 4 records (100.0%) in optional field [RegistryValue] (Schema:AlertEvent)" diff --git a/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_ASimAlertEvent_SchemaTest.csv b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_ASimAlertEvent_SchemaTest.csv new file mode 100644 index 00000000000..921c0183fbf --- /dev/null +++ b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_ASimAlertEvent_SchemaTest.csv @@ -0,0 +1,41 @@ +Result +"(1) Warning: Missing recommended field [AttackRemediationSteps]" +"(1) Warning: Missing recommended field [EventResultDetails]" +"(1) Warning: Missing recommended field [IndicatorType]" +"(1) Warning: Missing recommended field [ThreatCategory]" +"(2) Info: Missing optional field [DetectionMethod]" +"(2) Info: Missing optional field [DvcAction]" +"(2) Info: Missing optional field [DvcDomain]" +"(2) Info: Missing optional field [DvcFQDN]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EmailMessageId]" +"(2) Info: Missing optional field [EmailSubject]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalUid]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [FileSize]" +"(2) Info: Missing optional field [IndicatorAssociation]" +"(2) Info: Missing optional field [OriginalUserType]" +"(2) Info: Missing optional field [RegistryValueType]" +"(2) Info: Missing optional field [ThreatConfidence]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalConfidence]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" +"(2) Info: Missing optional field [Url]" +"(2) Info: Missing optional field [UserId]" +"(2) Info: Missing optional field [UserScopeId]" +"(2) Info: Missing optional field [UserScope]" +"(2) Info: Missing optional field [UserSessionId]" +"(2) Info: Missing optional field [UserType]" diff --git a/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_vimAlertEvent_DataTest.csv b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_vimAlertEvent_DataTest.csv new file mode 100644 index 00000000000..8d74b4a483d --- /dev/null +++ b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_vimAlertEvent_DataTest.csv @@ -0,0 +1,19 @@ +Result +"(2) Info: Empty value in 20 records (4.29%) in optional field [FileSHA256] (Schema:AlertEvent)" +"(2) Info: Empty value in 21 records (4.51%) in optional field [ProcessFileCompany] (Schema:AlertEvent)" +"(2) Info: Empty value in 250 records (53.65%) in optional field [ThreatOriginalCategory] (Schema:AlertEvent)" +"(2) Info: Empty value in 29 records (6.22%) in optional field [EventMessage] (Schema:AlertEvent)" +"(2) Info: Empty value in 383 records (82.19%) in recommended field [AttackTactics] (Schema:AlertEvent)" +"(2) Info: Empty value in 391 records (83.91%) in recommended field [AttackTechniques] (Schema:AlertEvent)" +"(2) Info: Empty value in 404 records (86.7%) in recommended field [DvcIpAddr] (Schema:AlertEvent)" +"(2) Info: Empty value in 43 records (9.23%) in optional field [FileMD5] (Schema:AlertEvent)" +"(2) Info: Empty value in 452 records (97.0%) in optional field [RegistryKey] (Schema:AlertEvent)" +"(2) Info: Empty value in 452 records (97.0%) in optional field [RegistryValue] (Schema:AlertEvent)" +"(2) Info: Empty value in 461 records (98.93%) in optional field [RegistryValueData] (Schema:AlertEvent)" +"(2) Info: Empty value in 463 records (99.36%) in optional field [RuleNumber] (Schema:AlertEvent)" +"(2) Info: Empty value in 6 records (1.29%) in optional field [ProcessCommandLine] (Schema:AlertEvent)" +"(2) Info: Empty value in 67 records (14.38%) in optional field [RuleDescription] (Schema:AlertEvent)" +"(2) Info: Empty value in 7 records (1.5%) in optional field [FileName] (Schema:AlertEvent)" +"(2) Info: Empty value in 7 records (1.5%) in optional field [FilePath] (Schema:AlertEvent)" +"(2) Info: Empty value in 7 records (1.5%) in optional field [FileSHA1] (Schema:AlertEvent)" +"(2) Info: Empty value in 7 records (1.5%) in optional field [ProcessName] (Schema:AlertEvent)" diff --git a/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_vimAlertEvent_SchemaTest.csv b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_vimAlertEvent_SchemaTest.csv new file mode 100644 index 00000000000..921c0183fbf --- /dev/null +++ b/Parsers/ASimAlertEvent/Tests/SentinelOne_SingularityAlerts_vimAlertEvent_SchemaTest.csv @@ -0,0 +1,41 @@ +Result +"(1) Warning: Missing recommended field [AttackRemediationSteps]" +"(1) Warning: Missing recommended field [EventResultDetails]" +"(1) Warning: Missing recommended field [IndicatorType]" +"(1) Warning: Missing recommended field [ThreatCategory]" +"(2) Info: Missing optional field [DetectionMethod]" +"(2) Info: Missing optional field [DvcAction]" +"(2) Info: Missing optional field [DvcDomain]" +"(2) Info: Missing optional field [DvcFQDN]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EmailMessageId]" +"(2) Info: Missing optional field [EmailSubject]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalUid]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [FileSize]" +"(2) Info: Missing optional field [IndicatorAssociation]" +"(2) Info: Missing optional field [OriginalUserType]" +"(2) Info: Missing optional field [RegistryValueType]" +"(2) Info: Missing optional field [ThreatConfidence]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalConfidence]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" +"(2) Info: Missing optional field [Url]" +"(2) Info: Missing optional field [UserId]" +"(2) Info: Missing optional field [UserScopeId]" +"(2) Info: Missing optional field [UserScope]" +"(2) Info: Missing optional field [UserSessionId]" +"(2) Info: Missing optional field [UserType]" diff --git a/Sample Data/ASIM/SentinelOne_SingularityAlerts_AlertEvent_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_SingularityAlerts_AlertEvent_IngestedLogs.csv new file mode 100644 index 00000000000..364b0940c7c --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_SingularityAlerts_AlertEvent_IngestedLogs.csv @@ -0,0 +1,477 @@ +TimeGenerated [UTC],AlertId,AlertName,AlertDescription,AlertVerdict,AlertStatus,AlertOriginalStatus,Dvc,DvcDescription,DvcIpAddr,DvcId,DvcIdType,DvcOs,DvcOsVersion,User,ProcessName,ProcessId,ProcessCommandLine,FileName,EventUid,EventType,EventCount,EventSeverity,EventOriginalSeverity,EventMessage,EventOriginalType,EventSubType,EventOriginalSubType,EventStartTime [UTC],EventEndTime [UTC],EventProduct,EventVendor,EventResult,EventSchema,EventSchemaVersion,IpAddr,,Username,UsernameType,Rule,RuleNumber,RuleName,RuleDescription,DvcHostname,Hostname,ThreatOriginalCategory,AttackTactics,AttackTechniques,Type,AdditionalFields +"6/29/2026, 1:52:41.887 PM",2512491795104365212,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AWUxxxxUS1,server,10.0.0.8,f6ea2xxxxf6ea2,Other,windows,Windows Server 2016 Datacenter,FMBxxx@test.com,lsass.exe,812,lsass.exe,lsass.exe,2512491795104365212,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"6/29/2026, 1:52:41.887 PM","6/29/2026, 1:52:41.887 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,a00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,KNGxxxxG04,KNGxxxxG04,,,,SentinelOneAlerts_CL,{} +"6/12/2026, 2:19:48.735 PM",2500184254657827426,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.3,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2500184254657827426,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"6/12/2026, 2:19:48.735 PM","6/12/2026, 2:19:48.735 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,KNGxxxxG04,KNGxxxxG04,,,,SentinelOneAlerts_CL,{} +"6/20/2026, 6:41:26.475 PM",2506114142683146814,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.4,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2506114142683146814,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"6/20/2026, 6:41:26.475 PM","6/20/2026, 6:41:26.475 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/25/2026, 3:35:53.996 PM",2509644635319876512,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.12,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2509644635319876512,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"6/25/2026, 3:35:53.996 PM","6/25/2026, 3:35:53.996 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/26/2026, 7:05:53.991 PM",2510475107631739414,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.20,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2510475107631739414,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"6/26/2026, 7:05:53.991 PM","6/26/2026, 7:05:53.991 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 7:05:58.825 PM",2511199923762681338,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.17,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2511199923762681338,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"6/27/2026, 7:05:58.825 PM","6/27/2026, 7:05:58.825 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"7/1/2026, 11:45:22.685 AM",2513877264292021880,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.15,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2513877264292021880,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/1/2026, 11:45:22.685 AM","7/1/2026, 11:45:22.685 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,inxxx@test.com,UPN,attempted access to upload[.]ee detected,,attempted access to upload[.]ee detected,This website can be used to download nefarious items.,dcsxxxxs01,dcsxxxxs01,,,,SentinelOneAlerts_CL,{} +"7/14/2026, 11:49:24.448 AM",2523301376835454191,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.13,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2523301376835454191,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/14/2026, 11:49:24.448 AM","7/14/2026, 11:49:24.448 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 3:52:57.338 PM",2525598285826241346,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.10,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2988,svchost.exe,svchost.exe,2525598285826241346,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/17/2026, 3:52:57.338 PM","7/17/2026, 3:52:57.338 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"7/18/2026, 6:39:56.540 PM",2526407108726665170,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.5,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2988,svchost.exe,svchost.exe,2526407108726665170,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/18/2026, 6:39:56.540 PM","7/18/2026, 6:39:56.540 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,KF0xxx@test.com,UPN,System Keep Awake tool,1712111159,System Keep Awake tool,"This rule is defined to detect system keep awake tools, such as Mouse Jiggler, MoveMouse, Caffeine, Stay Awake, and DontSleep.",AEUxxxxUS1,AEUxxxxUS1,ProcessStartedFromLnk,"Execution, Stealth",Masquerade File Type (T1036.008),SentinelOneAlerts_CL,{} +"7/2/2026, 1:00:29.638 PM",2514639847078332084,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.18,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2514639847078332084,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/2/2026, 1:00:29.638 PM","7/2/2026, 1:00:29.638 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,THOxxx@test.com,UPN,Windows Event logs cleared,48051524,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/22/2026, 5:43:20.238 PM",2529277721406016685,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.9,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2988,svchost.exe,svchost.exe,2529277721406016685,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/22/2026, 5:43:20.238 PM","7/22/2026, 5:43:20.238 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,THOxxx@test.com,UPN,Windows Event logs cleared,48051524,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/24/2026, 5:34:31.794 PM",2530722839950322457,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.11,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2988,svchost.exe,svchost.exe,2530722839950322457,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/24/2026, 5:34:31.794 PM","7/24/2026, 5:34:31.794 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"7/9/2026, 8:31:08.858 PM",2519940098608050576,Service Account Logged in via RDP,REMOTE_INTERACTIVE logon successful,Unknown,Active,unresolved,AEUxxxxUS1,server,10.0.0.14,3b41axxxx3b41a,Other,windows,Windows Server 2022 Datacenter Azure Edition,serxxx@test.com,svchost.exe,2704,svchost.exe,svchost.exe,2519940098608050576,Alert,1,High,High,REMOTE_INTERACTIVE logon successful,WINLOGONATTEMPT,Suspicious Activity,suspicious,"7/9/2026, 8:31:08.858 PM","7/9/2026, 8:31:08.858 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/24/2026, 8:06:41.011 PM",2509056149445878503,Potential EFI backdoor C2 from winlogon,This rule triggers on traffic from the winlogon process and excludes known false positives such as comms to Microsoft IPs. This rule should have a 100% true positive ratio,Unknown,Active,unresolved,QZCxxxxC01,desktop,10.0.0.7,9db21xxxx9db21,Other,windows,Windows 11 Enterprise,THOxxx@test.com,winlogon.exe,11420,winlogon.exe,winlogon.exe,2509056149445878503,Alert,1,High,Critical,This rule triggers on traffic from the winlogon process and excludes known false positives such as comms to Microsoft IPs. This rule should have a 100% true positive ratio,TCPV4,Anomaly,undefined,"6/24/2026, 8:06:41.011 PM","6/24/2026, 8:06:41.011 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,10.0.0.0,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/17/2026, 5:20:31.188 AM",2503536698523390291,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,6556fxxxx6556f,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,732,lsass.exe,lsass.exe,2503536698523390291,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"6/17/2026, 5:20:31.188 AM","6/17/2026, 5:20:31.188 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/17/2026, 5:42:57.210 AM",2503547989766173547,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,GTMxxxxM01,server,10.0.0.1,2b44dxxxx2b44d,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,732,lsass.exe,lsass.exe,2503547989766173547,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"6/17/2026, 5:42:57.210 AM","6/17/2026, 5:42:57.210 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/17/2026, 9:12:02.746 AM",2503653238159637922,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,6030fxxxx6030f,Other,windows,Windows Server 2016 Standard,003xxx@test.com,lsass.exe,916,lsass.exe,lsass.exe,2503653238159637922,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"6/17/2026, 9:12:02.746 AM","6/17/2026, 9:12:02.746 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/23/2026, 10:41:57.704 AM",2508047139928778896,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,ELPxxxxP02,server,10.0.0.1,e214cxxxxe214c,Other,windows,Windows Server 2016 Standard,erxxx@test.com,lsass.exe,704,lsass.exe,lsass.exe,2508047139928778896,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"6/23/2026, 10:41:57.704 AM","6/23/2026, 10:41:57.704 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/24/2026, 5:21:54.179 PM",2508973212971895610,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,2c33dxxxx2c33d,Other,windows,Windows Server 2016 Standard,m00xxx@test.com,lsass.exe,732,lsass.exe,lsass.exe,2508973212971895610,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"6/24/2026, 5:21:54.179 PM","6/24/2026, 5:21:54.179 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,xxx@test.com,UPN,Monitor abnormal modification of SSH Authorization File,,Monitor abnormal modification of SSH Authorization File,,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"7/15/2026, 4:56:26.926 PM",2524180691498422367,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,MOHxxxxH01,server,10.0.0.1,2ca6cxxxx2ca6c,Other,windows,Windows Server 2016 Standard,h00xxx@test.com,lsass.exe,720,lsass.exe,lsass.exe,2524180691498422367,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/15/2026, 4:56:26.926 PM","7/15/2026, 4:56:26.926 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,Command Prompt opened by Sacsess,,Command Prompt opened by Sacsess,Sacsess is a remote access tool used in the Azure environment to run commands remotely into Azure vms.,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"7/23/2026, 2:10:50.738 PM",2529895546583345527,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,MOHxxxxH01,server,10.0.0.1,2ca6cxxxx2ca6c,Other,windows,Windows Server 2016 Standard,h00xxx@test.com,lsass.exe,720,lsass.exe,lsass.exe,2529895546583345527,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/23/2026, 2:10:50.738 PM","7/23/2026, 2:10:50.738 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/23/2026, 3:52:13.387 AM",2529584183676752876,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,QZCxxxxC01,server,10.0.0.1,aa896xxxxaa896,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,704,lsass.exe,lsass.exe,2529584183676752876,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/23/2026, 3:52:13.387 AM","7/23/2026, 3:52:13.387 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/9/2026, 4:39:23.063 AM",2519461060502387294,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,MZAxxxxA01,server,10.0.0.1,0afbdxxxx0afbd,Other,windows,Windows Server 2016 Standard,erxxx@test.com,lsass.exe,692,lsass.exe,lsass.exe,2519461060502387294,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/9/2026, 4:39:23.063 AM","7/9/2026, 4:39:23.063 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,m00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,MRKxxxxK01,MRKxxxxK01,,,,SentinelOneAlerts_CL,{} +"6/16/2026, 12:16:46.501 PM",2503021430895467970,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,6556fxxxx6556f,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,732,lsass.exe,lsass.exe,2503021430895467970,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/16/2026, 12:16:46.501 PM","6/16/2026, 12:16:46.501 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,xxx@test.com,UPN,Monitor new sudoer creation,,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,ainxxxxn05,ainxxxxn05,,,,SentinelOneAlerts_CL,{} +"6/17/2026, 10:24:56.642 AM",2503689920251156151,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,6030fxxxx6030f,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,912,lsass.exe,lsass.exe,2503689920251156151,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/17/2026, 10:24:56.642 AM","6/17/2026, 10:24:56.642 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DCSxxxxS01,DCSxxxxS01,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/17/2026, 5:42:57.209 AM",2503547989749396329,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,GTMxxxxM01,server,10.0.0.1,2b44dxxxx2b44d,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,732,lsass.exe,lsass.exe,2503547989749396329,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/17/2026, 5:42:57.209 AM","6/17/2026, 5:42:57.209 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"6/17/2026, 9:12:41.894 AM",2503653557740438216,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,6030fxxxx6030f,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,916,lsass.exe,lsass.exe,2503653557740438216,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/17/2026, 9:12:41.894 AM","6/17/2026, 9:12:41.894 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/22/2026, 5:43:02.438 PM",2507534300148719607,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,INBxxxxB01,server,10.0.0.1,69ecaxxxx69eca,Other,windows,Windows Server 2016 Standard,p00xxx@test.com,lsass.exe,684,lsass.exe,lsass.exe,2507534300148719607,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/22/2026, 5:43:02.438 PM","6/22/2026, 5:43:02.438 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,h00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,MOHxxxxH01,MOHxxxxH01,,,,SentinelOneAlerts_CL,{} +"6/23/2026, 2:26:33.347 PM",2508160181817142354,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,INBxxxxB01,server,10.0.0.1,69ecaxxxx69eca,Other,windows,Windows Server 2016 Standard,p00xxx@test.com,lsass.exe,684,lsass.exe,lsass.exe,2508160181817142354,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/23/2026, 2:26:33.347 PM","6/23/2026, 2:26:33.347 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,h00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,MOHxxxxH01,MOHxxxxH01,,,,SentinelOneAlerts_CL,{} +"6/23/2026, 3:11:27.018 PM",2508182777950773851,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,INBxxxxB01,server,10.0.0.1,69ecaxxxx69eca,Other,windows,Windows Server 2016 Standard,p00xxx@test.com,lsass.exe,716,lsass.exe,lsass.exe,2508182777950773851,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/23/2026, 3:11:27.018 PM","6/23/2026, 3:11:27.018 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/24/2026, 5:23:54.775 PM",2508974224310873495,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,2c33dxxxx2c33d,Other,windows,Windows Server 2016 Standard,m00xxx@test.com,lsass.exe,732,lsass.exe,lsass.exe,2508974224310873495,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/24/2026, 5:23:54.775 PM","6/24/2026, 5:23:54.775 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,xxx@test.com,UPN,Monitor new sudoer creation,,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,ainxxxxn06,ainxxxxn06,,,,SentinelOneAlerts_CL,{} +"6/26/2026, 6:26:05.644 PM",2510455072582097679,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,INBxxxxB01,server,10.0.0.1,69ecaxxxx69eca,Other,windows,Windows Server 2016 Standard,p00xxx@test.com,lsass.exe,704,lsass.exe,lsass.exe,2510455072582097679,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/26/2026, 6:26:05.644 PM","6/26/2026, 6:26:05.644 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,p00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,INBxxxxB01,INBxxxxB01,,,,SentinelOneAlerts_CL,{} +"7/16/2026, 4:08:08.135 AM",2524518762556610228,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,MRKxxxxK01,server,10.0.0.1,7c0a0xxxx7c0a0,Other,windows,Windows Server 2016 Standard,m00xxx@test.com,lsass.exe,688,lsass.exe,lsass.exe,2524518762556610228,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/16/2026, 4:08:08.135 AM","7/16/2026, 4:08:08.135 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,c00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,ELPxxxxP02,ELPxxxxP02,,,,SentinelOneAlerts_CL,{} +"7/19/2026, 10:44:21.993 AM",2526892519331951231,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,CUBxxxxB02,server,10.0.0.1,eecbcxxxxeecbc,Other,windows,Windows Server 2016 Standard,c00xxx@test.com,lsass.exe,716,lsass.exe,lsass.exe,2526892519331951231,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/19/2026, 10:44:21.993 AM","7/19/2026, 10:44:21.993 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,erxxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,ELPxxxxP02,ELPxxxxP02,,,,SentinelOneAlerts_CL,{} +"7/20/2026, 7:10:27.630 AM",2527509632618575901,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,CUBxxxxB02,server,10.0.0.1,eecbcxxxxeecbc,Other,windows,Windows Server 2016 Standard,erxxx@test.com,lsass.exe,696,lsass.exe,lsass.exe,2527509632618575901,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/20/2026, 7:10:27.630 AM","7/20/2026, 7:10:27.630 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/20/2026, 8:53:33.776 AM",2527561525770195372,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,CUBxxxxB02,server,10.0.0.1,eecbcxxxxeecbc,Other,windows,Windows Server 2016 Standard,erxxx@test.com,lsass.exe,704,lsass.exe,lsass.exe,2527561525770195372,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/20/2026, 8:53:33.776 AM","7/20/2026, 8:53:33.776 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,p00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,INBxxxxB01,INBxxxxB01,,,,SentinelOneAlerts_CL,{} +"7/21/2026, 9:15:07.720 AM",2528297155884597791,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,CLKxxxxK02,server,10.0.0.1,db1a7xxxxdb1a7,Other,windows,Windows Server 2016 Standard,erxxx@test.com,lsass.exe,688,lsass.exe,lsass.exe,2528297155884597791,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/21/2026, 9:15:07.720 AM","7/21/2026, 9:15:07.720 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/,MLAxxxxA01,MLAxxxxA01,MultipleHookRemovals,Defense Impairment,,SentinelOneAlerts_CL,{} +"7/21/2026, 9:27:31.962 AM",2528303399039336975,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,STJxxxxJ01,server,10.0.0.1,2ef80xxxx2ef80,Other,windows,Windows Server 2016 Standard,erxxx@test.com,lsass.exe,660,lsass.exe,lsass.exe,2528303399039336975,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/21/2026, 9:27:31.962 AM","7/21/2026, 9:27:31.962 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"7/22/2026, 7:42:22.912 AM",2528975250635669635,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,QZCxxxxC01,server,10.0.0.1,aa896xxxxaa896,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,lsass.exe,704,lsass.exe,lsass.exe,2528975250635669635,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/22/2026, 7:42:22.912 AM","7/22/2026, 7:42:22.912 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,p00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,INBxxxxB01,INBxxxxB01,,,,SentinelOneAlerts_CL,{} +"7/23/2026, 2:19:51.863 PM",2529900085860538170,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,MOHxxxxH01,server,10.0.0.1,2ca6cxxxx2ca6c,Other,windows,Windows Server 2016 Standard,h00xxx@test.com,lsass.exe,720,lsass.exe,lsass.exe,2529900085860538170,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/23/2026, 2:19:51.863 PM","7/23/2026, 2:19:51.863 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/27/2026, 9:09:48.645 AM",2532643133690245288,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,CUBxxxxB02,server,10.0.0.1,eecbcxxxxeecbc,Other,windows,Windows Server 2016 Standard,erxxx@test.com,lsass.exe,696,lsass.exe,lsass.exe,2532643133690245288,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/27/2026, 9:09:48.645 AM","7/27/2026, 9:09:48.645 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/9/2026, 4:39:23.063 AM",2519461060493998685,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,MZAxxxxA01,server,10.0.0.1,0afbdxxxx0afbd,Other,windows,Windows Server 2016 Standard,m00xxx@test.com,lsass.exe,692,lsass.exe,lsass.exe,2519461060493998685,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/9/2026, 4:39:23.063 AM","7/9/2026, 4:39:23.063 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,RevokedCert,Defense Impairment,Code Signing (T1553.002),SentinelOneAlerts_CL,{} +"7/1/2026, 5:10:05.727 AM",2513678312007210015,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,JAXxxxxX01,server,10.0.0.1,91798xxxx91798,Other,windows,Windows Server 2022 Standard,a00xxx@test.com,svchost.exe,2756,svchost.exe,svchost.exe,2513678312007210015,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/1/2026, 5:10:05.727 AM","7/1/2026, 5:10:05.727 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 2:02:25.819 PM",2514671020666381910,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,JAXxxxxX01,server,10.0.0.1,a2a2fxxxxa2a2f,Other,windows,Windows Server 2022 Standard,a00xxx@test.com,svchost.exe,2516,svchost.exe,svchost.exe,2514671020666381910,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/2/2026, 2:02:25.819 PM","7/2/2026, 2:02:25.819 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,p00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,INBxxxxB01,INBxxxxB01,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 2:14:55.170 PM",2514677306661838070,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,JAXxxxxX01,server,10.0.0.1,91798xxxx91798,Other,windows,Windows Server 2022 Standard,a00xxx@test.com,svchost.exe,2756,svchost.exe,svchost.exe,2514677306661838070,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/2/2026, 2:14:55.170 PM","7/2/2026, 2:14:55.170 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,RevokedCert,Defense Impairment,Code Signing (T1553.002),SentinelOneAlerts_CL,{} +"6/15/2026, 8:02:02.603 PM",2502530832410913569,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,PHDxxxxDC2,server,10.0.0.1,578b2xxxx578b2,Other,windows,Windows Server 2016 Standard,p00xxx@test.com,svchost.exe,944,svchost.exe,svchost.exe,2502530832410913569,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/15/2026, 8:02:02.603 PM","6/15/2026, 8:02:02.603 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,RevokedCert,Defense Impairment,Code Signing (T1553.002),SentinelOneAlerts_CL,{} +"6/17/2026, 5:24:14.384 AM",2503538570818824418,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,6556fxxxx6556f,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,svchost.exe,1140,svchost.exe,svchost.exe,2503538570818824418,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/17/2026, 5:24:14.384 AM","6/17/2026, 5:24:14.384 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"6/22/2026, 6:15:15.526 PM",2507550516066371950,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,INBxxxxB01,server,10.0.0.1,69ecaxxxx69eca,Other,windows,Windows Server 2016 Standard,p00xxx@test.com,svchost.exe,1112,svchost.exe,svchost.exe,2507550516066371950,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/22/2026, 6:15:15.526 PM","6/22/2026, 6:15:15.526 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/23/2026, 10:41:57.704 AM",2508047139928778895,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,ELPxxxxP02,server,10.0.0.1,e214cxxxxe214c,Other,windows,Windows Server 2016 Standard,c00xxx@test.com,svchost.exe,404,svchost.exe,svchost.exe,2508047139928778895,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"6/23/2026, 10:41:57.704 AM","6/23/2026, 10:41:57.704 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,erxxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,CUBxxxxB02,CUBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/15/2026, 4:56:26.926 PM",2524180691506810976,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,MOHxxxxH01,server,10.0.0.1,2ca6cxxxx2ca6c,Other,windows,Windows Server 2016 Standard,h00xxx@test.com,svchost.exe,1004,svchost.exe,svchost.exe,2524180691506810976,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/15/2026, 4:56:26.926 PM","7/15/2026, 4:56:26.926 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/16/2026, 9:44:00.458 PM",2525050200352916481,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,DCSxxxxS01,server,10.0.0.1,6030fxxxx6030f,Other,windows,Windows Server 2016 Standard,d00xxx@test.com,svchost.exe,856,svchost.exe,svchost.exe,2525050200352916481,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/16/2026, 9:44:00.458 PM","7/16/2026, 9:44:00.458 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 2:02:27.261 PM",2514671032745977999,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,JAXxxxxX01,server,10.0.0.1,a2a2fxxxxa2a2f,Other,windows,Windows Server 2022 Standard,a00xxx@test.com,svchost.exe,2516,svchost.exe,svchost.exe,2514671032745977999,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/2/2026, 2:02:27.261 PM","7/2/2026, 2:02:27.261 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 2:13:28.884 PM",2514676582850715452,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,JAXxxxxX01,server,10.0.0.1,91798xxxx91798,Other,windows,Windows Server 2022 Standard,a00xxx@test.com,svchost.exe,2756,svchost.exe,svchost.exe,2514676582850715452,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/2/2026, 2:13:28.884 PM","7/2/2026, 2:13:28.884 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/20/2026, 10:24:01.259 AM",2527607054791564988,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,ALBxxxxB01,server,10.0.0.1,465efxxxx465ef,Other,windows,Windows Server 2019 Standard,a00xxx@test.com,svchost.exe,3012,svchost.exe,svchost.exe,2527607054791564988,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/20/2026, 10:24:01.259 AM","7/20/2026, 10:24:01.259 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"7/23/2026, 5:07:13.597 AM",2529621934166436644,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,QZCxxxxC01,server,10.0.0.1,aa896xxxxaa896,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,svchost.exe,1044,svchost.exe,svchost.exe,2529621934166436644,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/23/2026, 5:07:13.597 AM","7/23/2026, 5:07:13.597 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,c00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,CUBxxxxB02,CUBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/14/2026, 4:16:55.537 AM",2523073635256739895,Failed Login to server via VSPHERE,INTERACTIVE logon failed,Unknown,Active,unresolved,KNGxxxxG04,server,10.0.0.1,7de48xxxx7de48,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,,668,,,2523073635256739895,Alert,1,Medium,Medium,INTERACTIVE logon failed,WINLOGONATTEMPT,Anomaly,undefined,"7/14/2026, 4:16:55.537 AM","7/14/2026, 4:16:55.537 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"7/14/2026, 4:22:55.490 AM",2523076654761377774,Successful Login to server via VSPHERE,INTERACTIVE logon successful,Unknown,Active,unresolved,KNGxxxxG04,server,10.0.0.1,7de48xxxx7de48,Other,windows,Windows Server 2016 Standard,a00xxx@test.com,,668,,,2523076654761377774,Alert,1,Medium,Medium,INTERACTIVE logon successful,WINLOGONATTEMPT,Anomaly,undefined,"7/14/2026, 4:22:55.490 AM","7/14/2026, 4:22:55.490 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,127.0.0.1,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,ShimmedApplication,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"6/18/2026, 7:52:15.463 AM",2504337846432734117,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,JE8xxxx82U,laptop,10.0.0.6,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2504337846432734117,Alert,1,High,High,,TCPV4,Threat,malicious,"6/18/2026, 7:52:15.463 AM","6/18/2026, 7:52:15.463 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,192.0.0.0,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/21/2026, 4:31:57.327 PM",2506773746078105514,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,JE8xxxx82U,laptop,10.0.0.6,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2506773746078105514,Alert,1,High,High,,TCPV4,Threat,malicious,"6/21/2026, 4:31:57.327 PM","6/21/2026, 4:31:57.327 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,192.0.0.0,,THOxxx@test.com,UPN,attempted access to upload[.]ee detected,,attempted access to upload[.]ee detected,This website can be used to download nefarious items.,LAPxxxxPTO,LAPxxxxPTO,,,,SentinelOneAlerts_CL,{} +"7/11/2026, 8:47:41.988 PM",2521397981037373024,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,10.0.0.16,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2521397981037373024,Alert,1,High,High,,TCPV4,Threat,malicious,"7/11/2026, 8:47:41.988 PM","7/11/2026, 8:47:41.988 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,192.0.0.0,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/10/2026, 5:32:39.967 PM",2520575041662318870,Potential EFI backdoor C2 from winlogon,This rule triggers on traffic from the winlogon process and excludes known false positives such as comms to Microsoft IPs. This rule should have a 100% true positive ratio,Unknown,Active,unresolved,WAHxxxxHCV,desktop,10.0.0.19,72647xxxx72647,Other,windows,Windows 11 Enterprise,THOxxx@test.com,winlogon.exe,904,winlogon.exe,winlogon.exe,2520575041662318870,Alert,1,High,Critical,This rule triggers on traffic from the winlogon process and excludes known false positives such as comms to Microsoft IPs. This rule should have a 100% true positive ratio,TCPV4,Anomaly,undefined,"7/10/2026, 5:32:39.967 PM","7/10/2026, 5:32:39.967 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,192.0.0.0,,MY0xxx@test.com,UPN,Putty Running Out of Downloads Folder,,Putty Running Out of Downloads Folder,Verify if this is legitimate activity or not.,AWUxxxxUS1,AWUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/30/2026, 9:12:12.703 PM",2513437785260420214,Monitor abnormal modification of SSH Authorization File,,Unknown,Active,unresolved,DCSxxxxS01,server,,704f8xxxx704f8,Other,linux,Linux,xxx@test.com,/usr/bin/podman,136445,/usr/bin/podman,podman,2513437785260420214,Alert,1,Medium,Medium,,FILECREATION,Suspicious Activity,suspicious,"6/30/2026, 9:12:12.703 PM","6/30/2026, 9:12:12.703 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/12/2026, 10:47:29.147 PM",2500439775109249862,attempted access to upload[.]ee detected,DNS requested,Unknown,Active,unresolved,dcsxxxxs01,server,,99e8exxxx99e8e,Other,linux,Linux,inxxx@test.com,/usr/bin/resperf,468968,/usr/bin/resperf,resperf,2500439775109249862,Alert,1,High,High,DNS requested,DNS,Suspicious Activity,suspicious,"6/12/2026, 10:47:29.147 PM","6/12/2026, 10:47:29.147 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/24/2026, 4:53:39.912 PM",2530702272081469532,Monitor abnormal modification of SSH Authorization File,,Unknown,Active,unresolved,dcsxxxxs01,server,,fa35dxxxxfa35d,Other,linux,Linux,dmxxx@test.com,/usr/bin/vi,11721,/usr/bin/vi,vi,2530702272081469532,Alert,1,Medium,Medium,,FILEMODIFICATION,Suspicious Activity,suspicious,"7/24/2026, 4:53:39.912 PM","7/24/2026, 4:53:39.912 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/16/2026, 10:20:16.884 AM",2524706069681980233,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,Unknown,Active,unresolved,ainxxxxn06,server,,63e31xxxx63e31,Other,linux,Linux,xxx@test.com,/usr/sbin/visudo,1476249,/usr/sbin/visudo,visudo,2524706069681980233,Alert,1,High,High,This rule will trigger if the Sudoer file is accessed using visudo,FILERENAME,Suspicious Activity,suspicious,"7/16/2026, 10:20:16.884 AM","7/16/2026, 10:20:16.884 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/16/2026, 10:40:59.115 AM",2524716490262656996,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,Unknown,Active,unresolved,ainxxxxn05,server,,638d7xxxx638d7,Other,linux,Linux,xxx@test.com,/usr/sbin/visudo,1587528,/usr/sbin/visudo,visudo,2524716490262656996,Alert,1,High,High,This rule will trigger if the Sudoer file is accessed using visudo,FILERENAME,Suspicious Activity,suspicious,"7/16/2026, 10:40:59.115 AM","7/16/2026, 10:40:59.115 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,WARNING!! Invoke-SMBExec was executed.,,WARNING!! Invoke-SMBExec was executed.,"This query looks for unique services installs which are a result of running Invoke-SMBExec. +_REMCOMM_",AEUxxxxUS1,AEUxxxxUS1,ServiceCreate,"Privilege Escalation, Persistence, Execution","Windows Service (T1543.003), Registry Run Keys / Startup Folder (T1547.001), Service Execution (T1569.002)",SentinelOneAlerts_CL,{} +"7/16/2026, 11:26:08.695 AM",2524739219867401707,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,Unknown,Active,unresolved,ainxxxxn06,server,,551c6xxxx551c6,Other,linux,Linux,xxx@test.com,/usr/sbin/visudo,325222,/usr/sbin/visudo,visudo,2524739219867401707,Alert,1,High,High,This rule will trigger if the Sudoer file is accessed using visudo,FILERENAME,Suspicious Activity,suspicious,"7/16/2026, 11:26:08.695 AM","7/16/2026, 11:26:08.695 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/22/2026, 8:24:26.307 AM",2528996418415859245,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,Unknown,Active,unresolved,DCSxxxxS01,server,,596efxxxx596ef,Other,linux,Linux,xxx@test.com,/usr/sbin/visudo,2011846,/usr/sbin/visudo,visudo,2528996418415859245,Alert,1,High,High,This rule will trigger if the Sudoer file is accessed using visudo,FILECREATION,Suspicious Activity,suspicious,"7/22/2026, 8:24:26.307 AM","7/22/2026, 8:24:26.307 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,m00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"7/22/2026, 8:24:26.308 AM",2528996418415859246,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,Unknown,Active,unresolved,DCSxxxxS01,server,,596efxxxx596ef,Other,linux,Linux,xxx@test.com,/usr/sbin/visudo,2011812,/usr/sbin/visudo,visudo,2528996418415859246,Alert,1,High,High,This rule will trigger if the Sudoer file is accessed using visudo,FILECREATION,Suspicious Activity,suspicious,"7/22/2026, 8:24:26.308 AM","7/22/2026, 8:24:26.308 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,m00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"7/9/2026, 10:35:34.395 AM",2519640336202410680,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,Unknown,Active,unresolved,ainxxxxn07,server,,63396xxxx63396,Other,linux,Linux,xxx@test.com,/usr/sbin/visudo,545973,/usr/sbin/visudo,visudo,2519640336202410680,Alert,1,High,High,This rule will trigger if the Sudoer file is accessed using visudo,FILECREATION,Suspicious Activity,suspicious,"7/9/2026, 10:35:34.395 AM","7/9/2026, 10:35:34.395 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/9/2026, 11:07:26.890 AM",2519656379373884862,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,Unknown,Active,unresolved,ainxxxxn03,server,,543e2xxxx543e2,Other,linux,Linux,xxx@test.com,/usr/sbin/visudo,2568375,/usr/sbin/visudo,visudo,2519656379373884862,Alert,1,High,High,This rule will trigger if the Sudoer file is accessed using visudo,FILERENAME,Suspicious Activity,suspicious,"7/9/2026, 11:07:26.890 AM","7/9/2026, 11:07:26.890 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/,EGYxxxxY01,EGYxxxxY01,MultipleHookRemovals,Defense Impairment,,SentinelOneAlerts_CL,{} +"6/22/2026, 2:08:21.705 AM",2507063860879625733,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,EGYxxxxY01,desktop,,3f08cxxxx3f08c,Other,windows,Windows 11 Enterprise,AR0xxx@test.com,Assistant_130.0.5847.41_Setup.exe_sfx.exe,2072,Assistant_130.0.5847.41_Setup.exe_sfx.exe,Assistant_130.0.5847.41_Setup.exe_sfx.exe,2507063860879625733,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"6/22/2026, 2:08:21.705 AM","6/22/2026, 2:08:21.705 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.160 AM",2525293878563690991,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,Assistant_130.0.5847.41_Setup.exe_sfx.exe,16580,Assistant_130.0.5847.41_Setup.exe_sfx.exe,Assistant_130.0.5847.41_Setup.exe_sfx.exe,2525293878563690991,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"7/17/2026, 5:48:09.160 AM","7/17/2026, 5:48:09.160 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Potential EFI backdoor C2 from winlogon,,Potential EFI backdoor C2 from winlogon,This rule triggers on traffic from the winlogon process and excludes known false positives such as comms to Microsoft IPs. This rule should have a 100% true positive ratio,QZCxxxxC01,QZCxxxxC01,,,,SentinelOneAlerts_CL,{} +"6/22/2026, 2:08:21.705 AM",2507063860879625734,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,EGYxxxxY01,desktop,,3f08cxxxx3f08c,Other,windows,Windows 11 Enterprise,AR0xxx@test.com,assistant_installer.exe,9352,assistant_installer.exe,assistant_installer.exe,2507063860879625734,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/22/2026, 2:08:21.705 AM","6/22/2026, 2:08:21.705 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.162 AM",2525293879067007486,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,assistant_installer.exe,17776,assistant_installer.exe,assistant_installer.exe,2525293879067007486,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.162 AM","7/17/2026, 5:48:09.162 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.040 PM",2501612350621668024,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave_installer.exe,15764,brave_installer.exe,brave_installer.exe,2501612350621668024,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"6/14/2026, 1:37:11.040 PM","6/14/2026, 1:37:11.040 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.294 AM",2510658065775075111,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave_installer.exe,20192,brave_installer.exe,brave_installer.exe,2510658065775075111,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"6/27/2026, 1:09:24.294 AM","6/27/2026, 1:09:24.294 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,erxxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,CUBxxxxB02,CUBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.891 PM",2515643856699873400,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave_installer.exe,16732,brave_installer.exe,brave_installer.exe,2515643856699873400,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"7/3/2026, 10:15:16.891 PM","7/3/2026, 10:15:16.891 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,erxxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,CUBxxxxB02,CUBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953725351333,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,3844,brave.exe,brave.exe,2502464953725351333,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953733739942,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,9580,brave.exe,brave.exe,2502464953733739942,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,ALBxxxxB01,ALBxxxxB01,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953733739943,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,5056,brave.exe,brave.exe,2502464953733739943,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953733739944,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,17312,brave.exe,brave.exe,2502464953733739944,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953733739945,Detect Unapproved Browser (Opera and Brave),Process started from shortcut file,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,11036,brave.exe,brave.exe,2502464953733739945,Alert,1,Medium,Medium,Process started from shortcut file,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953742128554,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,17068,brave.exe,brave.exe,2502464953742128554,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953742128555,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,7928,brave.exe,brave.exe,2502464953742128555,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953742128556,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,13492,brave.exe,brave.exe,2502464953742128556,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953742128557,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,3200,brave.exe,brave.exe,2502464953742128557,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953918289326,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,2332,brave.exe,brave.exe,2502464953918289326,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953926677936,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,3300,brave.exe,brave.exe,2502464953926677936,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.251 PM",2502464953926677938,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,5004,brave.exe,brave.exe,2502464953926677938,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.251 PM","6/15/2026, 5:51:09.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.252 PM",2502464953926677935,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,7508,brave.exe,brave.exe,2502464953926677935,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.252 PM","6/15/2026, 5:51:09.252 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.252 PM",2502464953926677937,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,2168,brave.exe,brave.exe,2502464953926677937,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.252 PM","6/15/2026, 5:51:09.252 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.252 PM",2502464953935066547,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,12240,brave.exe,brave.exe,2502464953935066547,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DUPLICATEPROCESS,Threat,malicious,"6/15/2026, 5:51:09.252 PM","6/15/2026, 5:51:09.252 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.252 PM",2502464953977009588,Detect Unapproved Browser (Opera and Brave),Code injection to other process memory space during the target process's initialization,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,14064,brave.exe,brave.exe,2502464953977009588,Alert,1,Medium,Medium,Code injection to other process memory space during the target process's initialization,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.252 PM","6/15/2026, 5:51:09.252 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.252 PM",2502464953977009589,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,3736,brave.exe,brave.exe,2502464953977009589,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.252 PM","6/15/2026, 5:51:09.252 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:51:09.252 PM",2502464953993786806,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,5936,brave.exe,brave.exe,2502464953993786806,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:51:09.252 PM","6/15/2026, 5:51:09.252 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,RCExxx@test.com,UPN,Suspicious WMIC Usage V2,,Suspicious WMIC Usage V2,Generic Ransomware Identification.,mktxxxxtpw,mktxxxxtpw,RawVolumeAccess,"Discovery, Stealth",,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.523 PM",2502466457576398375,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,15816,brave.exe,brave.exe,2502466457576398375,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.523 PM","6/15/2026, 5:54:08.523 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.523 PM",2502466457584786985,Detect Unapproved Browser (Opera and Brave),Code injection to other process memory space during the target process's initialization,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,1424,brave.exe,brave.exe,2502466457584786985,Alert,1,Medium,Medium,Code injection to other process memory space during the target process's initialization,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.523 PM","6/15/2026, 5:54:08.523 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.523 PM",2502466457584786986,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,8104,brave.exe,brave.exe,2502466457584786986,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.523 PM","6/15/2026, 5:54:08.523 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457593175595,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,17352,brave.exe,brave.exe,2502466457593175595,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,FMBxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AWUxxxxUS1,AWUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457593175596,Detect Unapproved Browser (Opera and Brave),A registry value has been modified,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,9284,brave.exe,brave.exe,2502466457593175596,Alert,1,Medium,Medium,A registry value has been modified,REGVALUEMODIFIED,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457593175598,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,8460,brave.exe,brave.exe,2502466457593175598,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,P-5xxx@test.com,UPN,Unapproved PenTest tool detected,,Unapproved PenTest tool detected,,LAPxxxxPTO,LAPxxxxPTO,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457593175599,Detect Unapproved Browser (Opera and Brave),Process started from shortcut file,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,3476,brave.exe,brave.exe,2502466457593175599,Alert,1,Medium,Medium,Process started from shortcut file,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,P-5xxx@test.com,UPN,Unapproved PenTest tool detected,,Unapproved PenTest tool detected,,LAPxxxxPTO,LAPxxxxPTO,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457601564208,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,3196,brave.exe,brave.exe,2502466457601564208,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DCSxxxxS01,DCSxxxxS01,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457601564209,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,7872,brave.exe,brave.exe,2502466457601564209,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457769336388,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,16516,brave.exe,brave.exe,2502466457769336388,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 5:54:08.524 PM",2502466457769336389,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,brave.exe,8688,brave.exe,brave.exe,2502466457769336389,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 5:54:08.524 PM","6/15/2026, 5:54:08.524 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.293 AM",2510658065607302940,Detect Unapproved Browser (Opera and Brave),Process started from shortcut file,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,18580,brave.exe,brave.exe,2510658065607302940,Alert,1,Medium,Medium,Process started from shortcut file,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.293 AM","6/27/2026, 1:09:24.293 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.293 AM",2510658065607302941,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,11176,brave.exe,brave.exe,2510658065607302941,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.293 AM","6/27/2026, 1:09:24.293 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.293 AM",2510658065607302942,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,14700,brave.exe,brave.exe,2510658065607302942,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.293 AM","6/27/2026, 1:09:24.293 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.293 AM",2510658065615691553,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,17396,brave.exe,brave.exe,2510658065615691553,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.293 AM","6/27/2026, 1:09:24.293 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.293 AM",2510658065615691554,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,13608,brave.exe,brave.exe,2510658065615691554,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.293 AM","6/27/2026, 1:09:24.293 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,QZCxxxxC01,QZCxxxxC01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.294 AM",2510658065615691551,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,3716,brave.exe,brave.exe,2510658065615691551,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.294 AM","6/27/2026, 1:09:24.294 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,DM0xxx@test.com,UPN,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/,TZNxxxxN01,TZNxxxxN01,MultipleHookRemovals,Defense Impairment,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.294 AM",2510658065615691552,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,4904,brave.exe,brave.exe,2510658065615691552,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.294 AM","6/27/2026, 1:09:24.294 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,QZCxxxxC01,QZCxxxxC01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.294 AM",2510658065775075108,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,13744,brave.exe,brave.exe,2510658065775075108,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.294 AM","6/27/2026, 1:09:24.294 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.294 AM",2510658065775075114,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,22016,brave.exe,brave.exe,2510658065775075114,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.294 AM","6/27/2026, 1:09:24.294 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.294 AM",2510658065783463724,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,17584,brave.exe,brave.exe,2510658065783463724,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.294 AM","6/27/2026, 1:09:24.294 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.295 AM",2510658065775075109,Detect Unapproved Browser (Opera and Brave),Code injection to other process memory space during the target process's initialization,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,16528,brave.exe,brave.exe,2510658065775075109,Alert,1,Medium,Medium,Code injection to other process memory space during the target process's initialization,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.295 AM","6/27/2026, 1:09:24.295 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.295 AM",2510658065775075113,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,11632,brave.exe,brave.exe,2510658065775075113,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.295 AM","6/27/2026, 1:09:24.295 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.295 AM",2510658065775075115,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,10036,brave.exe,brave.exe,2510658065775075115,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.295 AM","6/27/2026, 1:09:24.295 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.295 AM",2510658065909292845,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,19188,brave.exe,brave.exe,2510658065909292845,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.295 AM","6/27/2026, 1:09:24.295 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,Monitor new sudoer creation,,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,ainxxxxn03,ainxxxxn03,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.295 AM",2510658065917681458,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,20684,brave.exe,brave.exe,2510658065917681458,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DUPLICATEPROCESS,Threat,malicious,"6/27/2026, 1:09:24.295 AM","6/27/2026, 1:09:24.295 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658065917681454,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,2068,brave.exe,brave.exe,2510658065917681454,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658065917681456,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,20296,brave.exe,brave.exe,2510658065917681456,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,m00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,MZAxxxxA01,MZAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658065917681459,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,5424,brave.exe,brave.exe,2510658065917681459,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,erxxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,MZAxxxxA01,MZAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658065917681460,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,3400,brave.exe,brave.exe,2510658065917681460,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,Monitor new sudoer creation,,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,ainxxxxn07,ainxxxxn07,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658065917681461,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,15048,brave.exe,brave.exe,2510658065917681461,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.297 AM",2510658066035121977,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,4872,brave.exe,brave.exe,2510658066035121977,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.297 AM","6/27/2026, 1:09:24.297 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,erxxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,STJxxxxJ01,STJxxxxJ01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.297 AM",2510658066035121979,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,21600,brave.exe,brave.exe,2510658066035121979,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.297 AM","6/27/2026, 1:09:24.297 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,erxxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,CLKxxxxK02,CLKxxxxK02,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.297 AM",2510658066043510588,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,2612,brave.exe,brave.exe,2510658066043510588,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.297 AM","6/27/2026, 1:09:24.297 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,AD0xxx@test.com,UPN,System Keep Awake tool,,System Keep Awake tool,"This rule is defined to detect system keep awake tools, such as Mouse Jiggler, MoveMouse, Caffeine, Stay Awake, and DontSleep.",ALBxxxxB01,ALBxxxxB01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454721275446,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,8768,brave.exe,brave.exe,2510658454721275446,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454729664055,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,19320,brave.exe,brave.exe,2510658454729664055,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454729664056,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,16752,brave.exe,brave.exe,2510658454729664056,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454729664057,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,6248,brave.exe,brave.exe,2510658454729664057,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,dmxxx@test.com,UPN,Monitor abnormal modification of SSH Authorization File,,Monitor abnormal modification of SSH Authorization File,,dcsxxxxs01,dcsxxxxs01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454729664058,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,13196,brave.exe,brave.exe,2510658454729664058,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454729664059,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,20036,brave.exe,brave.exe,2510658454729664059,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454738052668,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,564,brave.exe,brave.exe,2510658454738052668,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454738052669,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,5216,brave.exe,brave.exe,2510658454738052669,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.684 AM",2510658454746441278,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,1184,brave.exe,brave.exe,2510658454746441278,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.684 AM","6/27/2026, 1:10:10.684 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.685 AM",2510658454855493183,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,21624,brave.exe,brave.exe,2510658454855493183,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.685 AM","6/27/2026, 1:10:10.685 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:10:10.685 AM",2510658454914213440,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,brave.exe,20968,brave.exe,brave.exe,2510658454914213440,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:10:10.685 AM","6/27/2026, 1:10:10.685 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.889 PM",2515643856523712623,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,16880,brave.exe,brave.exe,2515643856523712623,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.889 PM","7/3/2026, 10:15:16.889 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,AV0xxx@test.com,UPN,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/,CEBxxxxB01,CEBxxxxB01,MultipleHookRemovals,Defense Impairment,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.889 PM",2515643856532101233,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,7504,brave.exe,brave.exe,2515643856532101233,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.889 PM","7/3/2026, 10:15:16.889 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,JAXxxxxX01,JAXxxxxX01,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.890 PM",2515643856532101232,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,19020,brave.exe,brave.exe,2515643856532101232,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.890 PM","7/3/2026, 10:15:16.890 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.890 PM",2515643856532101234,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,13988,brave.exe,brave.exe,2515643856532101234,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.890 PM","7/3/2026, 10:15:16.890 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,ShimmedApplication,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.890 PM",2515643856540489843,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,12328,brave.exe,brave.exe,2515643856540489843,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.890 PM","7/3/2026, 10:15:16.890 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.890 PM",2515643856540489844,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,18924,brave.exe,brave.exe,2515643856540489844,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.890 PM","7/3/2026, 10:15:16.890 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.890 PM",2515643856540489845,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,17088,brave.exe,brave.exe,2515643856540489845,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.890 PM","7/3/2026, 10:15:16.890 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.891 PM",2515643856548878454,Detect Unapproved Browser (Opera and Brave),Process started from shortcut file,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,15664,brave.exe,brave.exe,2515643856548878454,Alert,1,Medium,Medium,Process started from shortcut file,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.891 PM","7/3/2026, 10:15:16.891 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,Monitor abnormal modification of SSH Authorization File,,Monitor abnormal modification of SSH Authorization File,,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.891 PM",2515643856548878455,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,19132,brave.exe,brave.exe,2515643856548878455,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.891 PM","7/3/2026, 10:15:16.891 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.891 PM",2515643856708262016,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,7608,brave.exe,brave.exe,2515643856708262016,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DUPLICATEPROCESS,Threat,malicious,"7/3/2026, 10:15:16.891 PM","7/3/2026, 10:15:16.891 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.892 PM",2515643856699873402,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,19212,brave.exe,brave.exe,2515643856699873402,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.892 PM","7/3/2026, 10:15:16.892 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.892 PM",2515643856699873403,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,4216,brave.exe,brave.exe,2515643856699873403,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.892 PM","7/3/2026, 10:15:16.892 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.892 PM",2515643856699873404,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,18840,brave.exe,brave.exe,2515643856699873404,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.892 PM","7/3/2026, 10:15:16.892 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.892 PM",2515643856708262014,Detect Unapproved Browser (Opera and Brave),Code injection to other process memory space during the target process's initialization,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,brave.exe,4612,brave.exe,brave.exe,2515643856708262014,Alert,1,Medium,Medium,Code injection to other process memory space during the target process's initialization,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.892 PM","7/3/2026, 10:15:16.892 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/12/2026, 11:02:48.350 AM",2500085098071771754,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2500085098071771754,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/12/2026, 11:02:48.350 AM","6/12/2026, 11:02:48.350 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/12/2026, 5:51:37.920 PM",2500290867013804344,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2500290867013804344,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/12/2026, 5:51:37.920 PM","6/12/2026, 5:51:37.920 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,WARNING!! Invoke-SMBExec was executed.,,WARNING!! Invoke-SMBExec was executed.,"This query looks for unique services installs which are a result of running Invoke-SMBExec. +_REMCOMM_",CUBxxxxB02,CUBxxxxB02,ServiceCreate,"Privilege Escalation, Persistence, Execution","Windows Service (T1543.003), Registry Run Keys / Startup Folder (T1547.001), Service Execution (T1569.002)",SentinelOneAlerts_CL,{} +"6/13/2026, 12:02:35.741 PM",2500839967015452466,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2500839967015452466,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/13/2026, 12:02:35.741 PM","6/13/2026, 12:02:35.741 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,LAPxxxxPTO,LAPxxxxPTO,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"6/14/2026, 1:02:21.805 PM",2501594824846626735,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2501594824846626735,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/14/2026, 1:02:21.805 PM","6/14/2026, 1:02:21.805 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,LAPxxxxPTO,LAPxxxxPTO,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.040 PM",2501612350613279413,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,10416,BraveUpdate.exe,BraveUpdate.exe,2501612350613279413,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/14/2026, 1:37:11.040 PM","6/14/2026, 1:37:11.040 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,LAPxxxxPTO,LAPxxxxPTO,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.041 PM",2501612350621668025,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,14340,BraveUpdate.exe,BraveUpdate.exe,2501612350621668025,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/14/2026, 1:37:11.041 PM","6/14/2026, 1:37:11.041 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.041 PM",2501612350621668026,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,2264,BraveUpdate.exe,BraveUpdate.exe,2501612350621668026,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"6/14/2026, 1:37:11.041 PM","6/14/2026, 1:37:11.041 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.041 PM",2501612350621668029,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2501612350621668029,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"6/14/2026, 1:37:11.041 PM","6/14/2026, 1:37:11.041 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 1:42:08.290 PM",2502339619863620548,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2502339619863620548,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/15/2026, 1:42:08.290 PM","6/15/2026, 1:42:08.290 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 12:00:07.292 PM",2502288273232132576,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,6696,BraveUpdate.exe,BraveUpdate.exe,2502288273232132576,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/15/2026, 12:00:07.292 PM","6/15/2026, 12:00:07.292 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 12:27:08.332 PM",2502301871469116780,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,5400,BraveUpdate.exe,BraveUpdate.exe,2502301871469116780,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/15/2026, 12:27:08.332 PM","6/15/2026, 12:27:08.332 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 12:27:08.332 PM",2502301871469116781,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,10716,BraveUpdate.exe,BraveUpdate.exe,2502301871469116781,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILEDELETION,Threat,malicious,"6/15/2026, 12:27:08.332 PM","6/15/2026, 12:27:08.332 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"6/16/2026, 1:44:48.662 PM",2503065740875754242,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2503065740875754242,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/16/2026, 1:44:48.662 PM","6/16/2026, 1:44:48.662 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,ET0xxx@test.com,UPN,"Warning User made active by ""net"" command",,"Warning User made active by ""net"" command",Creates an alert that a user was activated using the net command,ELPxxxxP02,ELPxxxxP02,,,,SentinelOneAlerts_CL,{} +"6/16/2026, 11:43:04.477 AM",2503004468935951210,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2503004468935951210,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/16/2026, 11:43:04.477 AM","6/16/2026, 11:43:04.477 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"6/17/2026, 2:03:23.392 AM",2503437479786142032,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2503437479786142032,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/17/2026, 2:03:23.392 AM","6/17/2026, 2:03:23.392 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,003xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"6/17/2026, 2:43:16.125 PM",2503819939350869815,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2503819939350869815,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/17/2026, 2:43:16.125 PM","6/17/2026, 2:43:16.125 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"6/18/2026, 11:01:52.315 AM",2504433282402402533,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2504433282402402533,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/18/2026, 11:01:52.315 AM","6/18/2026, 11:01:52.315 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,ShimmedApplication,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"6/18/2026, 12:09:32.940 PM",2504467345402707446,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2504467345402707446,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/18/2026, 12:09:32.940 PM","6/18/2026, 12:09:32.940 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/18/2026, 2:43:52.142 PM",2504545017211869953,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2504545017211869953,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/18/2026, 2:43:52.142 PM","6/18/2026, 2:43:52.142 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/19/2026, 1:09:33.238 PM",2505222323263257756,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2505222323263257756,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/19/2026, 1:09:33.238 PM","6/19/2026, 1:09:33.238 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,GTMxxxxM01,GTMxxxxM01,,,,SentinelOneAlerts_CL,{} +"6/19/2026, 11:03:39.738 AM",2505158959265871466,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2505158959265871466,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/19/2026, 11:03:39.738 AM","6/19/2026, 11:03:39.738 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,GTMxxxxM01,GTMxxxxM01,,,,SentinelOneAlerts_CL,{} +"6/19/2026, 3:42:49.772 PM",2505299468737312529,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Enterprise,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2505299468737312529,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/19/2026, 3:42:49.772 PM","6/19/2026, 3:42:49.772 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"6/20/2026, 12:02:38.058 PM",2505913416578604390,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2505913416578604390,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/20/2026, 12:02:38.058 PM","6/20/2026, 12:02:38.058 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,ShimmedApplication,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"6/20/2026, 2:09:27.290 PM",2505977247435792220,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2505977247435792220,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/20/2026, 2:09:27.290 PM","6/20/2026, 2:09:27.290 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/21/2026, 12:02:56.774 PM",2506638349303179208,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2506638349303179208,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/21/2026, 12:02:56.774 PM","6/21/2026, 12:02:56.774 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"6/22/2026, 12:44:23.020 PM",2507383981190261354,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Enterprise,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2507383981190261354,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/22/2026, 12:44:23.020 PM","6/22/2026, 12:44:23.020 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/23/2026, 1:43:53.831 PM",2508138711048836508,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Enterprise,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2508138711048836508,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/23/2026, 1:43:53.831 PM","6/23/2026, 1:43:53.831 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/23/2026, 12:09:37.299 PM",2508091260626823624,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2508091260626823624,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/23/2026, 12:09:37.299 PM","6/23/2026, 12:09:37.299 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/24/2026, 1:11:27.310 PM",2508847158179561700,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2508847158179561700,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/24/2026, 1:11:27.310 PM","6/24/2026, 1:11:27.310 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DCSxxxxS01,DCSxxxxS01,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/24/2026, 11:02:04.083 AM",2508782035510510699,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2508782035510510699,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/24/2026, 11:02:04.083 AM","6/24/2026, 11:02:04.083 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,AH0xxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,INBxxxxB01,INBxxxxB01,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/24/2026, 2:43:20.556 PM",2508893406631571961,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Enterprise,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2508893406631571961,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/24/2026, 2:43:20.556 PM","6/24/2026, 2:43:20.556 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/25/2026, 11:03:52.886 AM",2509507723940617308,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2509507723940617308,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/25/2026, 11:03:52.886 AM","6/25/2026, 11:03:52.886 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/25/2026, 2:08:41.168 PM",2509600739201631494,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2509600739201631494,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/25/2026, 2:08:41.168 PM","6/25/2026, 2:08:41.168 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/25/2026, 3:43:09.250 PM",2509648286688061784,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Enterprise,pa0xxx@test.com,BraveUpdate.exe,10456,BraveUpdate.exe,BraveUpdate.exe,2509648286688061784,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/25/2026, 3:43:09.250 PM","6/25/2026, 3:43:09.250 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/26/2026, 12:01:13.199 PM",2510261359119080288,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2510261359119080288,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/26/2026, 12:01:13.199 PM","6/26/2026, 12:01:13.199 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:08:08.854 AM",2510657432745547787,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2510657432745547787,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"6/27/2026, 1:08:08.854 AM","6/27/2026, 1:08:08.854 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,LAPxxxxPTO,LAPxxxxPTO,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.292 AM",2510658065598914330,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,12848,BraveUpdate.exe,BraveUpdate.exe,2510658065598914330,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/27/2026, 1:09:24.292 AM","6/27/2026, 1:09:24.292 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,LAPxxxxPTO,LAPxxxxPTO,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.295 AM",2510658065917681457,Detect Unapproved Browser (Opera and Brave),DNS requested,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,11180,BraveUpdate.exe,BraveUpdate.exe,2510658065917681457,Alert,1,Medium,Medium,DNS requested,DNS,Threat,malicious,"6/27/2026, 1:09:24.295 AM","6/27/2026, 1:09:24.295 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658065917681455,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,14932,BraveUpdate.exe,BraveUpdate.exe,2510658065917681455,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.297 AM",2510658066035121976,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,19436,BraveUpdate.exe,BraveUpdate.exe,2510658066035121976,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/27/2026, 1:09:24.297 AM","6/27/2026, 1:09:24.297 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:13:11.823 AM",2510659974225356839,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,18332,BraveUpdate.exe,BraveUpdate.exe,2510659974225356839,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/27/2026, 1:13:11.823 AM","6/27/2026, 1:13:11.823 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:16:11.987 AM",2510661485550542188,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,4656,BraveUpdate.exe,BraveUpdate.exe,2510661485550542188,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILEDELETION,Threat,malicious,"6/27/2026, 1:16:11.987 AM","6/27/2026, 1:16:11.987 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:16:11.988 AM",2510661485550542189,Detect Unapproved Browser (Opera and Brave),DNS requested,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,13992,BraveUpdate.exe,BraveUpdate.exe,2510661485550542189,Alert,1,Medium,Medium,DNS requested,DNS,Threat,malicious,"6/27/2026, 1:16:11.988 AM","6/27/2026, 1:16:11.988 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/,CLKxxxxK03,CLKxxxxK03,MultipleHookRemovals,Defense Impairment,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:16:11.988 AM",2510661485567319406,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,1192,BraveUpdate.exe,BraveUpdate.exe,2510661485567319406,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/27/2026, 1:16:11.988 AM","6/27/2026, 1:16:11.988 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 12:03:51.730 PM",2510987464688692708,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2510987464688692708,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/27/2026, 12:03:51.730 PM","6/27/2026, 12:03:51.730 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/28/2026, 1:01:42.166 PM",2511741352567813039,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2511741352567813039,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/28/2026, 1:01:42.166 PM","6/28/2026, 1:01:42.166 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/29/2026, 10:49:25.661 AM",2512399552059685647,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2512399552059685647,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/29/2026, 10:49:25.661 AM","6/29/2026, 10:49:25.661 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DCSxxxxS01,DCSxxxxS01,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"6/30/2026, 7:14:23.200 PM",2513378481986498063,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2513378481986498063,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/30/2026, 7:14:23.200 PM","6/30/2026, 7:14:23.200 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/30/2026, 7:25:23.283 PM",2513384019155740044,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2513384019155740044,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"6/30/2026, 7:25:23.283 PM","6/30/2026, 7:25:23.283 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/1/2026, 12:01:22.224 PM",2513885313471910399,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2513885313471910399,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/1/2026, 12:01:22.224 PM","7/1/2026, 12:01:22.224 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/1/2026, 8:09:42.594 PM",2514131102785844668,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2514131102785844668,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/1/2026, 8:09:42.594 PM","7/1/2026, 8:09:42.594 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/,MLAxxxxA01,MLAxxxxA01,MultipleHookRemovals,Defense Impairment,,SentinelOneAlerts_CL,{} +"7/10/2026, 1:01:32.386 PM",2520438579278587716,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2520438579278587716,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/10/2026, 1:01:32.386 PM","7/10/2026, 1:01:32.386 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/11/2026, 1:01:57.618 PM",2521163566684105660,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2521163566684105660,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/11/2026, 1:01:57.618 PM","7/11/2026, 1:01:57.618 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/12/2026, 2:01:36.368 PM",2521918363147953700,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2521918363147953700,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/12/2026, 2:01:36.368 PM","7/12/2026, 2:01:36.368 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/13/2026, 12:07:32.055 PM",2522585724615833178,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2522585724615833178,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/13/2026, 12:07:32.055 PM","7/13/2026, 12:07:32.055 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/14/2026, 1:08:59.622 PM",2523341433892103506,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2523341433892103506,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/14/2026, 1:08:59.622 PM","7/14/2026, 1:08:59.622 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/15/2026, 11:03:39.296 AM",2524003124576130447,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2524003124576130447,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/15/2026, 11:03:39.296 AM","7/15/2026, 11:03:39.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/15/2026, 12:01:46.183 PM",2524032374696300638,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,15344,BraveUpdate.exe,BraveUpdate.exe,2524032374696300638,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/15/2026, 12:01:46.183 PM","7/15/2026, 12:01:46.183 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/15/2026, 2:08:32.929 PM",2524096184707612384,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2524096184707612384,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/15/2026, 2:08:32.929 PM","7/15/2026, 2:08:32.929 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/16/2026, 12:03:36.394 PM",2524758074941849931,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2524758074941849931,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/16/2026, 12:03:36.394 PM","7/16/2026, 12:03:36.394 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/16/2026, 3:07:27.519 PM",2524850610726699594,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2524850610726699594,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/16/2026, 3:07:27.519 PM","7/16/2026, 3:07:27.519 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 1:01:05.314 PM",2525511782306365668,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2525511782306365668,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/17/2026, 1:01:05.314 PM","7/17/2026, 1:01:05.314 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,P-5xxx@test.com,UPN,Unapproved PenTest tool detected,,Unapproved PenTest tool detected,,LAPxxxxPTO,LAPxxxxPTO,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 11:57:58.586 AM",2525480016929145702,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,15344,BraveUpdate.exe,BraveUpdate.exe,2525480016929145702,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/17/2026, 11:57:58.586 AM","7/17/2026, 11:57:58.586 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 3:09:17.519 PM",2525576309199675073,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2525576309199675073,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/17/2026, 3:09:17.519 PM","7/17/2026, 3:09:17.519 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,P-5xxx@test.com,UPN,Unapproved PenTest tool detected,,Unapproved PenTest tool detected,,LAPxxxxPTO,LAPxxxxPTO,,,,SentinelOneAlerts_CL,{} +"7/18/2026, 1:03:56.625 PM",2526237995108673853,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2526237995108673853,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/18/2026, 1:03:56.625 PM","7/18/2026, 1:03:56.625 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/18/2026, 12:04:06.807 PM",2526207881515561299,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,15344,BraveUpdate.exe,BraveUpdate.exe,2526207881515561299,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/18/2026, 12:04:06.807 PM","7/18/2026, 12:04:06.807 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/18/2026, 3:09:19.987 PM",2526301105635633857,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2526301105635633857,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/18/2026, 3:09:19.987 PM","7/18/2026, 3:09:19.987 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,h00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,MOHxxxxH01,MOHxxxxH01,,,,SentinelOneAlerts_CL,{} +"7/19/2026, 2:01:52.942 PM",2526991932296756368,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2526991932296756368,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/19/2026, 2:01:52.942 PM","7/19/2026, 2:01:52.942 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,h00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,MOHxxxxH01,MOHxxxxH01,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 12:02:24.736 PM",2514610613582596110,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2514610613582596110,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/2/2026, 12:02:24.736 PM","7/2/2026, 12:02:24.736 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 7:19:57.143 AM",2514468446874130578,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2514468446874130578,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/2/2026, 7:19:57.143 AM","7/2/2026, 7:19:57.143 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/21/2026, 1:03:02.147 AM",2528049477428891830,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2528049477428891830,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/21/2026, 1:03:02.147 AM","7/21/2026, 1:03:02.147 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,HM0xxx@test.com,UPN,"Warning User made active by ""net"" command",,"Warning User made active by ""net"" command",Creates an alert that a user was activated using the net command,DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/22/2026, 11:55:09.236 AM",2529102474968128426,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,15344,BraveUpdate.exe,BraveUpdate.exe,2529102474968128426,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/22/2026, 11:55:09.236 AM","7/22/2026, 11:55:09.236 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/22/2026, 12:07:16.661 PM",2529108578116814246,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2529108578116814246,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/22/2026, 12:07:16.661 PM","7/22/2026, 12:07:16.661 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,AR0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",EGYxxxxY01,EGYxxxxY01,,,,SentinelOneAlerts_CL,{} +"7/22/2026, 2:03:00.631 AM",2528804439448425308,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2528804439448425308,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/22/2026, 2:03:00.631 AM","7/22/2026, 2:03:00.631 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/23/2026, 12:02:13.961 PM",2529830813554164272,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,15344,BraveUpdate.exe,BraveUpdate.exe,2529830813554164272,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/23/2026, 12:02:13.961 PM","7/23/2026, 12:02:13.961 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/23/2026, 12:07:54.871 PM",2529833673314552711,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2529833673314552711,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/23/2026, 12:07:54.871 PM","7/23/2026, 12:07:54.871 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,AR0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",EGYxxxxY01,EGYxxxxY01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/23/2026, 4:07:46.909 AM",2529592014610157700,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2529592014610157700,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/23/2026, 4:07:46.909 AM","7/23/2026, 4:07:46.909 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,AR0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",EGYxxxxY01,EGYxxxxY01,,,,SentinelOneAlerts_CL,{} +"7/24/2026, 11:01:58.019 AM",2530525256553635914,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2530525256553635914,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/24/2026, 11:01:58.019 AM","7/24/2026, 11:01:58.019 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,AR0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",EGYxxxxY01,EGYxxxxY01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/25/2026, 12:02:56.519 PM",2531280722026094336,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2531280722026094336,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/25/2026, 12:02:56.519 PM","7/25/2026, 12:02:56.519 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/25/2026, 7:43:40.145 PM",2531512613555899537,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,15344,BraveUpdate.exe,BraveUpdate.exe,2531512613555899537,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/25/2026, 7:43:40.145 PM","7/25/2026, 7:43:40.145 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/25/2026, 8:09:05.592 PM",2531525409941698671,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2531525409941698671,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/25/2026, 8:09:05.592 PM","7/25/2026, 8:09:05.592 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/26/2026, 1:01:06.793 PM",2532034776325090036,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2532034776325090036,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/26/2026, 1:01:06.793 PM","7/26/2026, 1:01:06.793 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 1:03:49.783 PM",2515366301739772381,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2515366301739772381,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/3/2026, 1:03:49.783 PM","7/3/2026, 1:03:49.783 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:12:18.034 PM",2515642356380501671,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,1552,BraveUpdate.exe,BraveUpdate.exe,2515642356380501671,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/3/2026, 10:12:18.034 PM","7/3/2026, 10:12:18.034 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:12:18.034 PM",2515642356397278890,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,14740,BraveUpdate.exe,BraveUpdate.exe,2515642356397278890,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"7/3/2026, 10:12:18.034 PM","7/3/2026, 10:12:18.034 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:12:18.034 PM",2515642356397278891,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,17264,BraveUpdate.exe,BraveUpdate.exe,2515642356397278891,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/3/2026, 10:12:18.034 PM","7/3/2026, 10:12:18.034 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:12:18.035 PM",2515642356397278892,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,7736,BraveUpdate.exe,BraveUpdate.exe,2515642356397278892,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"7/3/2026, 10:12:18.035 PM","7/3/2026, 10:12:18.035 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:18:17.194 PM",2515645369014923087,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,16100,BraveUpdate.exe,BraveUpdate.exe,2515645369014923087,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/3/2026, 10:18:17.194 PM","7/3/2026, 10:18:17.194 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:18:17.195 PM",2515645369023311696,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,15996,BraveUpdate.exe,BraveUpdate.exe,2515645369023311696,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILEDELETION,Threat,malicious,"7/3/2026, 10:18:17.195 PM","7/3/2026, 10:18:17.195 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:18:17.195 PM",2515645369023311698,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,2404,BraveUpdate.exe,BraveUpdate.exe,2515645369023311698,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/3/2026, 10:18:17.195 PM","7/3/2026, 10:18:17.195 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 12:07:07.535 PM",2515337761613756126,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2515337761613756126,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/3/2026, 12:07:07.535 PM","7/3/2026, 12:07:07.535 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 7:27:51.117 AM",2515197198602124238,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2515197198602124238,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/3/2026, 7:27:51.117 AM","7/3/2026, 7:27:51.117 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/4/2026, 12:07:22.104 PM",2516062659564324869,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2516062659564324869,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/4/2026, 12:07:22.104 PM","7/4/2026, 12:07:22.104 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/4/2026, 2:01:36.928 PM",2516120161982919948,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2516120161982919948,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/4/2026, 2:01:36.928 PM","7/4/2026, 2:01:36.928 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/5/2026, 2:02:51.404 PM",2516845562471496629,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2516845562471496629,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/5/2026, 2:02:51.404 PM","7/5/2026, 2:02:51.404 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/6/2026, 2:01:14.099 PM",2517569521952836626,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,14740,BraveUpdate.exe,BraveUpdate.exe,2517569521952836626,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"7/6/2026, 2:01:14.099 PM","7/6/2026, 2:01:14.099 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/6/2026, 2:15:20.328 PM",2517576620627919123,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2517576620627919123,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/6/2026, 2:15:20.328 PM","7/6/2026, 2:15:20.328 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/7/2026, 12:08:17.070 PM",2518237447839855514,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2518237447839855514,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/7/2026, 12:08:17.070 PM","7/7/2026, 12:08:17.070 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/7/2026, 2:18:18.992 PM",2518302895108881505,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,14740,BraveUpdate.exe,BraveUpdate.exe,2518302895108881505,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/7/2026, 2:18:18.992 PM","7/7/2026, 2:18:18.992 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/7/2026, 3:14:05.708 PM",2518330969390342344,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2518330969390342344,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/7/2026, 3:14:05.708 PM","7/7/2026, 3:14:05.708 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,ProcessStartedFromLnk,"Execution, Stealth",Masquerade File Type (T1036.008),SentinelOneAlerts_CL,{} +"7/8/2026, 1:07:35.232 PM",2518992071579844120,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2518992071579844120,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/8/2026, 1:07:35.232 PM","7/8/2026, 1:07:35.232 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/8/2026, 11:02:19.708 AM",2518929026813371132,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2518929026813371132,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/8/2026, 11:02:19.708 AM","7/8/2026, 11:02:19.708 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/8/2026, 2:18:19.736 PM",2519027677071179075,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdate.exe,14740,BraveUpdate.exe,BraveUpdate.exe,2519027677071179075,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/8/2026, 2:18:19.736 PM","7/8/2026, 2:18:19.736 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/8/2026, 3:16:02.394 PM",2519056723961375206,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdate.exe,16636,BraveUpdate.exe,BraveUpdate.exe,2519056723961375206,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/8/2026, 3:16:02.394 PM","7/8/2026, 3:16:02.394 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/9/2026, 1:08:33.221 PM",2519717333787554635,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,8992,BraveUpdate.exe,BraveUpdate.exe,2519717333787554635,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/9/2026, 1:08:33.221 PM","7/9/2026, 1:08:33.221 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/9/2026, 12:01:33.587 PM",2519683614643561435,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DESxxxxSKT,desktop,,819a2xxxx819a2,Other,windows,Windows 10 Pro,OP-xxx@test.com,BraveUpdate.exe,11132,BraveUpdate.exe,BraveUpdate.exe,2519683614643561435,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",SCHEDTASKTRIGGER,Threat,malicious,"7/9/2026, 12:01:33.587 PM","7/9/2026, 12:01:33.587 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.041 PM",2501612350621668023,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdateComRegisterShell64.exe,13364,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2501612350621668023,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYDELETE,Threat,malicious,"6/14/2026, 1:37:11.041 PM","6/14/2026, 1:37:11.041 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.041 PM",2501612350621668027,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdateComRegisterShell64.exe,12536,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2501612350621668027,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYCREATE,Threat,malicious,"6/14/2026, 1:37:11.041 PM","6/14/2026, 1:37:11.041 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,PreloadInjection,"Stealth, Privilege Escalation",Process Hollowing (T1055.012),SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.041 PM",2501612350621668028,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdateComRegisterShell64.exe,14012,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2501612350621668028,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYDELETE,Threat,malicious,"6/14/2026, 1:37:11.041 PM","6/14/2026, 1:37:11.041 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.293 AM",2510658065607302939,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdateComRegisterShell64.exe,9496,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2510658065607302939,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYCREATE,Threat,malicious,"6/27/2026, 1:09:24.293 AM","6/27/2026, 1:09:24.293 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658066035121974,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdateComRegisterShell64.exe,11448,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2510658066035121974,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYDELETE,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.297 AM",2510658066035121975,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdateComRegisterShell64.exe,10532,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2510658066035121975,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYDELETE,Threat,malicious,"6/27/2026, 1:09:24.297 AM","6/27/2026, 1:09:24.297 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:12:18.033 PM",2515642356380501670,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdateComRegisterShell64.exe,17620,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2515642356380501670,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYDELETE,Threat,malicious,"7/3/2026, 10:12:18.033 PM","7/3/2026, 10:12:18.033 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,JC0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",WAHxxxxHPA,WAHxxxxHPA,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:12:18.033 PM",2515642356388890280,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdateComRegisterShell64.exe,5408,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2515642356388890280,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYDELETE,Threat,malicious,"7/3/2026, 10:12:18.033 PM","7/3/2026, 10:12:18.033 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,Monitor new sudoer creation,,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:12:18.034 PM",2515642356388890281,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,BraveUpdateComRegisterShell64.exe,13280,BraveUpdateComRegisterShell64.exe,BraveUpdateComRegisterShell64.exe,2515642356388890281,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",REGKEYCREATE,Threat,malicious,"7/3/2026, 10:12:18.034 PM","7/3/2026, 10:12:18.034 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,Monitor new sudoer creation,,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 12:00:07.293 PM",2502288273232132577,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,BraveUpdateCore.exe,9148,BraveUpdateCore.exe,BraveUpdateCore.exe,2502288273232132577,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",PROCESSCREATION,Threat,malicious,"6/15/2026, 12:00:07.293 PM","6/15/2026, 12:00:07.293 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/30/2026, 7:19:04.902 PM",2513380845090961036,Detect Unapproved Browser (Opera and Brave),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,BraveUpdateCore.exe,16848,BraveUpdateCore.exe,BraveUpdateCore.exe,2513380845090961036,Alert,1,Medium,Medium,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"6/30/2026, 7:19:04.902 PM","6/30/2026, 7:19:04.902 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,LAPxxxxPTO,LAPxxxxPTO,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"7/15/2026, 12:01:46.182 PM",2524032374687912029,Detect Unapproved Browser (Opera and Brave),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,DESxxxxSKT,desktop,,c57a2xxxxc57a2,Other,windows,Windows 11 Pro,OP-xxx@test.com,BraveUpdateCore.exe,8140,BraveUpdateCore.exe,BraveUpdateCore.exe,2524032374687912029,Alert,1,Medium,Medium,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"7/15/2026, 12:01:46.182 PM","7/15/2026, 12:01:46.182 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,QZCxxxxC01,QZCxxxxC01,,,,SentinelOneAlerts_CL,{} +"7/27/2026, 11:29:43.757 AM",2532713556997139736,System Keep Awake tool,Process started from shortcut file,Unknown,Active,unresolved,AEUxxxxUS1,desktop,,42a4dxxxx42a4d,Other,windows,Windows 10 Enterprise,KF0xxx@test.com,caffeine.exe,13964,caffeine.exe,caffeine.exe,2532713556997139736,Alert,1,High,Critical,Process started from shortcut file,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/27/2026, 11:29:43.757 AM","7/27/2026, 11:29:43.757 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,LAPxxxxPTO,LAPxxxxPTO,PossibleDllHijackingByKnownLibrary,"Privilege Escalation, Stealth","Dynamic-link Library Injection (T1055.001), DLL (T1574.001), Match Legitimate Resource Name or Location (T1036.005)",SentinelOneAlerts_CL,{} +"7/21/2026, 10:25:25.937 AM",2528332540854543109,System Keep Awake tool,A registry value has been modified,Unknown,Active,unresolved,ALBxxxxB01,laptop,,b3071xxxxb3071,Other,windows,Windows 11 Enterprise,AD0xxx@test.com,caffeine32.exe,22436,caffeine32.exe,caffeine32.exe,2528332540854543109,Alert,1,High,Critical,A registry value has been modified,REGVALUEMODIFIED,Suspicious Activity,suspicious,"7/21/2026, 10:25:25.937 AM","7/21/2026, 10:25:25.937 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,p00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,PHDxxxxDC2,PHDxxxxDC2,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 2:35:27.669 PM",2502366458284569586,Proxy Changed via netsh,"Detects the proxy being changed by the netsh command. +Verify of the activity is legitimate or not. Take further action +of needed.",Unknown,Active,unresolved,QZCxxxxC01,laptop,,d2b46xxxxd2b46,Other,windows,Windows 11 Enterprise,THOxxx@test.com,cmd.exe,10884,cmd.exe,cmd.exe,2502366458284569586,Alert,1,High,High,"Detects the proxy being changed by the netsh command. +Verify of the activity is legitimate or not. Take further action +of needed.",PROCESSCREATION,Suspicious Activity,suspicious,"6/15/2026, 2:35:27.669 PM","6/15/2026, 2:35:27.669 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,MH0xxx@test.com,UPN,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/,WAHxxxxH01,WAHxxxxH01,MultipleHookRemovals,Defense Impairment,,SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:46.657 PM",2501612649381997804,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,file.exe,11540,file.exe,file.exe,2501612649381997804,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILEDELETION,Threat,malicious,"6/14/2026, 1:37:46.657 PM","6/14/2026, 1:37:46.657 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,JE8xxxx82U,JE8xxxx82U,,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.295 AM",2510658065775075112,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,file.exe,15180,file.exe,file.exe,2510658065775075112,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILEDELETION,Threat,malicious,"6/27/2026, 1:09:24.295 AM","6/27/2026, 1:09:24.295 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.891 PM",2515643856699873401,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,file.exe,5528,file.exe,file.exe,2515643856699873401,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILEDELETION,Threat,malicious,"7/3/2026, 10:15:16.891 PM","7/3/2026, 10:15:16.891 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/22/2026, 2:08:21.705 AM",2507063860879625732,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,EGYxxxxY01,desktop,,3f08cxxxx3f08c,Other,windows,Windows 11 Enterprise,AR0xxx@test.com,installer.exe,5864,installer.exe,installer.exe,2507063860879625732,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/22/2026, 2:08:21.705 AM","6/22/2026, 2:08:21.705 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/22/2026, 2:11:16.435 AM",2507065326604329551,Detect Unapproved Browser (Opera and Brave),A registry value has been modified,Unknown,Active,unresolved,EGYxxxxY01,desktop,,3f08cxxxx3f08c,Other,windows,Windows 11 Enterprise,AR0xxx@test.com,installer.exe,12924,installer.exe,installer.exe,2507065326604329551,Alert,1,Medium,Medium,A registry value has been modified,REGVALUEMODIFIED,Threat,malicious,"6/22/2026, 2:11:16.435 AM","6/22/2026, 2:11:16.435 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Proxy Changed via netsh,,Proxy Changed via netsh,"Detects the proxy being changed by the netsh command. +Verify of the activity is legitimate or not. Take further action +of needed.",QZCxxxxC01,QZCxxxxC01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.160 AM",2525293878563690989,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,installer.exe,15052,installer.exe,installer.exe,2525293878563690989,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.160 AM","7/17/2026, 5:48:09.160 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,WARNING!! Invoke-SMBExec was executed.,,WARNING!! Invoke-SMBExec was executed.,"This query looks for unique services installs which are a result of running Invoke-SMBExec. +_REMCOMM_",AWUxxxxUS1,AWUxxxxUS1,ServiceCreate,"Privilege Escalation, Persistence, Execution","Windows Service (T1543.003), Registry Run Keys / Startup Folder (T1547.001), Service Execution (T1569.002)",SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.161 AM",2525293878572079600,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,installer.exe,17724,installer.exe,installer.exe,2525293878572079600,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.161 AM","7/17/2026, 5:48:09.161 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.162 AM",2525293879067007484,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,installer.exe,14052,installer.exe,installer.exe,2525293879067007484,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.162 AM","7/17/2026, 5:48:09.162 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/9/2026, 3:42:47.593 PM",2519794965070002292,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,INBxxxxB01,laptop,,d7e94xxxxd7e94,Other,windows,Windows 11 Enterprise,AH0xxx@test.com,mmc.exe,2488,mmc.exe,mmc.exe,2519794965070002292,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/9/2026, 3:42:47.593 PM","7/9/2026, 3:42:47.593 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"6/16/2026, 12:37:51.860 AM",2502669657637231174,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),Multiple functions were unhooked,Unknown,Active,unresolved,WAHxxxxH01,desktop,,a2ee2xxxxa2ee2,Other,windows,Windows 11 Enterprise,MH0xxx@test.com,msedgewebview2.exe,10868,msedgewebview2.exe,msedgewebview2.exe,2502669657637231174,Alert,1,High,High,Multiple functions were unhooked,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/16/2026, 12:37:51.860 AM","6/16/2026, 12:37:51.860 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,DNS changed via netsh command,,DNS changed via netsh command,This rule detects the DNS server a system uses being changed via netsh ,QZCxxxxC01,QZCxxxxC01,,,,SentinelOneAlerts_CL,{} +"6/29/2026, 6:03:46.981 PM",2512618170266274051,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DCSxxxxS01,server,,a27d1xxxxa27d1,Other,windows,Windows Server 2016 Standard,THOxxx@test.com,MSExchangeHMWorker.exe,19352,MSExchangeHMWorker.exe,MSExchangeHMWorker.exe,2512618170266274051,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/29/2026, 6:03:46.981 PM","6/29/2026, 6:03:46.981 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/1/2026, 2:26:17.163 PM",2513958251925957004,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DCSxxxxS01,server,,51a75xxxx51a75,Other,windows,Windows Server 2016 Standard,THOxxx@test.com,MSExchangeHMWorker.exe,532,MSExchangeHMWorker.exe,MSExchangeHMWorker.exe,2513958251925957004,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/1/2026, 2:26:17.163 PM","7/1/2026, 2:26:17.163 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/16/2026, 3:23:42.067 AM",2524496397956881995,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DCSxxxxS01,server,,51a75xxxx51a75,Other,windows,Windows Server 2016 Standard,THOxxx@test.com,MSExchangeHMWorker.exe,18100,MSExchangeHMWorker.exe,MSExchangeHMWorker.exe,2524496397956881995,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/16/2026, 3:23:42.067 AM","7/16/2026, 3:23:42.067 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/3/2026, 7:35:37.225 AM",2515201108608128025,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DCSxxxxS01,server,,51a75xxxx51a75,Other,windows,Windows Server 2016 Standard,THOxxx@test.com,MSExchangeHMWorker.exe,19044,MSExchangeHMWorker.exe,MSExchangeHMWorker.exe,2515201108608128025,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/3/2026, 7:35:37.225 AM","7/3/2026, 7:35:37.225 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/9/2026, 1:46:08.034 PM",2519736248514526808,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DCSxxxxS01,server,,a27d1xxxxa27d1,Other,windows,Windows Server 2016 Standard,THOxxx@test.com,MSExchangeHMWorker.exe,19200,MSExchangeHMWorker.exe,MSExchangeHMWorker.exe,2519736248514526808,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/9/2026, 1:46:08.034 PM","7/9/2026, 1:46:08.034 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,ProcessStartedFromLnk,"Execution, Stealth",Masquerade File Type (T1036.008),SentinelOneAlerts_CL,{} +"6/16/2026, 2:48:33.118 PM",2503097822898120775,"Warning User made active by ""net"" command",Creates an alert that a user was activated using the net command,Unknown,Active,unresolved,ELPxxxxP02,laptop,,73b30xxxx73b30,Other,windows,Windows 11 Enterprise,ET0xxx@test.com,net.exe,2092,net.exe,net.exe,2503097822898120775,Alert,1,Medium,Medium,Creates an alert that a user was activated using the net command,PROCESSCREATION,Suspicious Activity,suspicious,"6/16/2026, 2:48:33.118 PM","6/16/2026, 2:48:33.118 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/23/2026, 5:18:16.213 PM",2529989880458253151,"Warning User made active by ""net"" command",Creates an alert that a user was activated using the net command,Unknown,Active,unresolved,DVAxxxxA01,laptop,,52c79xxxx52c79,Other,windows,Windows 11 Enterprise,HM0xxx@test.com,net.exe,9156,net.exe,net.exe,2529989880458253151,Alert,1,Medium,Medium,Creates an alert that a user was activated using the net command,PROCESSCREATION,Suspicious Activity,suspicious,"7/23/2026, 5:18:16.213 PM","7/23/2026, 5:18:16.213 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 2:33:34.940 PM",2502365512561267608,DNS changed via netsh command,A registry value has been modified,Unknown,Active,unresolved,QZCxxxxC01,laptop,,d2b46xxxxd2b46,Other,windows,Windows 11 Enterprise,THOxxx@test.com,netsh.exe,18168,netsh.exe,netsh.exe,2502365512561267608,Alert,1,High,High,A registry value has been modified,REGVALUEMODIFIED,Threat,malicious,"6/15/2026, 2:33:34.940 PM","6/15/2026, 2:33:34.940 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/12/2026, 3:44:36.195 AM",2521607815442316484,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),Multiple functions were unhooked,Unknown,Active,unresolved,MLAxxxxA01,desktop,,b9aabxxxxb9aab,Other,windows,Windows 11 Enterprise,THOxxx@test.com,NETSTAT.EXE,11532,NETSTAT.EXE,NETSTAT.EXE,2521607815442316484,Alert,1,High,High,Multiple functions were unhooked,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/12/2026, 3:44:36.195 AM","7/12/2026, 3:44:36.195 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/28/2026, 4:16:59.497 AM",2511477256792030229,Unapproved PenTest tool detected,,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,2adc2xxxx2adc2,Other,windows,Windows 11 Home Single Language,P-5xxx@test.com,node.exe,20024,node.exe,node.exe,2511477256792030229,Alert,1,High,Critical,,FILECREATION,Suspicious Activity,suspicious,"6/28/2026, 4:16:59.497 AM","6/28/2026, 4:16:59.497 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/29/2026, 6:26:04.933 PM",2512629393812931581,Unapproved PenTest tool detected,,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,2adc2xxxx2adc2,Other,windows,Windows 11 Home Single Language,P-5xxx@test.com,node.exe,20984,node.exe,node.exe,2512629393812931581,Alert,1,High,Critical,,FILECREATION,Suspicious Activity,suspicious,"6/29/2026, 6:26:04.933 PM","6/29/2026, 6:26:04.933 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.963 AM",2525294648772130088,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera_autoupdate.exe,17008,opera_autoupdate.exe,opera_autoupdate.exe,2525294648772130088,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.963 AM","7/17/2026, 5:49:40.963 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.964 AM",2525294648788907308,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera_autoupdate.exe,17672,opera_autoupdate.exe,opera_autoupdate.exe,2525294648788907308,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.964 AM","7/17/2026, 5:49:40.964 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.965 AM",2525294648897959216,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera_autoupdate.exe,16812,opera_autoupdate.exe,opera_autoupdate.exe,2525294648897959216,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.965 AM","7/17/2026, 5:49:40.965 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.162 AM",2525293879067007482,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera_crashreporter.exe,12784,opera_crashreporter.exe,opera_crashreporter.exe,2525293879067007482,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",OPENPROCESS,Threat,malicious,"7/17/2026, 5:48:09.162 AM","7/17/2026, 5:48:09.162 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.978 AM",2525294649426441558,Detect Unapproved Browser (Opera and Brave),A registry value has been modified,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera_gx_splash.exe,4868,opera_gx_splash.exe,opera_gx_splash.exe,2525294649426441558,Alert,1,Medium,Medium,A registry value has been modified,REGVALUEMODIFIED,Threat,malicious,"7/17/2026, 5:49:40.978 AM","7/17/2026, 5:49:40.978 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,PreloadInjection,"Stealth, Privilege Escalation",Process Hollowing (T1055.012),SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.159 AM",2525293878555302374,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,12548,opera.exe,opera.exe,2525293878555302374,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.159 AM","7/17/2026, 5:48:09.159 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.159 AM",2525293878555302376,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16472,opera.exe,opera.exe,2525293878555302376,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.159 AM","7/17/2026, 5:48:09.159 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.160 AM",2525293878563690988,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16692,opera.exe,opera.exe,2525293878563690988,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.160 AM","7/17/2026, 5:48:09.160 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.160 AM",2525293878563690990,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,3972,opera.exe,opera.exe,2525293878563690990,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.160 AM","7/17/2026, 5:48:09.160 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,PreloadInjection,"Stealth, Privilege Escalation",Process Hollowing (T1055.012),SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.161 AM",2525293878555302379,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17284,opera.exe,opera.exe,2525293878555302379,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.161 AM","7/17/2026, 5:48:09.161 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.161 AM",2525293879058618871,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16816,opera.exe,opera.exe,2525293879058618871,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.161 AM","7/17/2026, 5:48:09.161 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.161 AM",2525293879058618872,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,11540,opera.exe,opera.exe,2525293879058618872,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.161 AM","7/17/2026, 5:48:09.161 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.161 AM",2525293879067007485,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,10428,opera.exe,opera.exe,2525293879067007485,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.161 AM","7/17/2026, 5:48:09.161 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.162 AM",2525293879067007481,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16572,opera.exe,opera.exe,2525293879067007481,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.162 AM","7/17/2026, 5:48:09.162 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,ProcessStartedFromLnk,"Execution, Stealth",Masquerade File Type (T1036.008),SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.162 AM",2525293879067007483,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16740,opera.exe,opera.exe,2525293879067007483,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:48:09.162 AM","7/17/2026, 5:48:09.162 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.962 AM",2525294648763741476,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,14372,opera.exe,opera.exe,2525294648763741476,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.962 AM","7/17/2026, 5:49:40.962 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.962 AM",2525294648772130086,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,224,opera.exe,opera.exe,2525294648772130086,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.962 AM","7/17/2026, 5:49:40.962 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.963 AM",2525294648772130085,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17608,opera.exe,opera.exe,2525294648772130085,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.963 AM","7/17/2026, 5:49:40.963 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,pa0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",ALBxxxxB02,ALBxxxxB02,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.963 AM",2525294648772130087,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,7304,opera.exe,opera.exe,2525294648772130087,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.963 AM","7/17/2026, 5:49:40.963 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.964 AM",2525294648772130089,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,15924,opera.exe,opera.exe,2525294648772130089,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.964 AM","7/17/2026, 5:49:40.964 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,JAXxxxxX01,JAXxxxxX01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.964 AM",2525294648772130090,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,12484,opera.exe,opera.exe,2525294648772130090,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.964 AM","7/17/2026, 5:49:40.964 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,JAXxxxxX01,JAXxxxxX01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.964 AM",2525294648788907307,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,2040,opera.exe,opera.exe,2525294648788907307,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.964 AM","7/17/2026, 5:49:40.964 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,WARNING!! Invoke-SMBExec was executed.,,WARNING!! Invoke-SMBExec was executed.,"This query looks for unique services installs which are a result of running Invoke-SMBExec. +_REMCOMM_",CLKxxxxK03,CLKxxxxK03,ServiceCreate,"Privilege Escalation, Persistence, Execution","Windows Service (T1543.003), Registry Run Keys / Startup Folder (T1547.001), Service Execution (T1569.002)",SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.965 AM",2525294648897959213,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,6372,opera.exe,opera.exe,2525294648897959213,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.965 AM","7/17/2026, 5:49:40.965 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.965 AM",2525294648897959214,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,6656,opera.exe,opera.exe,2525294648897959214,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.965 AM","7/17/2026, 5:49:40.965 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DCSxxxxS01,DCSxxxxS01,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.965 AM",2525294648897959215,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,3068,opera.exe,opera.exe,2525294648897959215,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.965 AM","7/17/2026, 5:49:40.965 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.965 AM",2525294648897959217,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,5656,opera.exe,opera.exe,2525294648897959217,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.965 AM","7/17/2026, 5:49:40.965 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.966 AM",2525294648948290866,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,13920,opera.exe,opera.exe,2525294648948290866,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.966 AM","7/17/2026, 5:49:40.966 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.966 AM",2525294648948290868,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16720,opera.exe,opera.exe,2525294648948290868,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.966 AM","7/17/2026, 5:49:40.966 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.968 AM",2525294648948290869,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,8600,opera.exe,opera.exe,2525294648948290869,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.968 AM","7/17/2026, 5:49:40.968 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.969 AM",2525294648948290867,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,14880,opera.exe,opera.exe,2525294648948290867,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.969 AM","7/17/2026, 5:49:40.969 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,JAXxxxxX01,JAXxxxxX01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.969 AM",2525294649023788343,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16460,opera.exe,opera.exe,2525294649023788343,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.969 AM","7/17/2026, 5:49:40.969 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,a00xxx@test.com,UPN,Failed Login to server via VSPHERE,,Failed Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,JAXxxxxX01,JAXxxxxX01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.969 AM",2525294649023788346,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,18008,opera.exe,opera.exe,2525294649023788346,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.969 AM","7/17/2026, 5:49:40.969 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.970 AM",2525294649023788342,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16280,opera.exe,opera.exe,2525294649023788342,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.970 AM","7/17/2026, 5:49:40.970 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Potential EFI backdoor C2 from winlogon,,Potential EFI backdoor C2 from winlogon,This rule triggers on traffic from the winlogon process and excludes known false positives such as comms to Microsoft IPs. This rule should have a 100% true positive ratio,WAHxxxxHCV,WAHxxxxHCV,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.970 AM",2525294649023788344,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,10064,opera.exe,opera.exe,2525294649023788344,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.970 AM","7/17/2026, 5:49:40.970 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.970 AM",2525294649023788345,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,11212,opera.exe,opera.exe,2525294649023788345,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.970 AM","7/17/2026, 5:49:40.970 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,d00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,DCSxxxxS01,DCSxxxxS01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.970 AM",2525294649074119998,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,3296,opera.exe,opera.exe,2525294649074119998,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.970 AM","7/17/2026, 5:49:40.970 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.971 AM",2525294649074119995,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,5612,opera.exe,opera.exe,2525294649074119995,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.971 AM","7/17/2026, 5:49:40.971 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,xxx@test.com,UPN,Monitor new sudoer creation,,Monitor new sudoer creation,This rule will trigger if the Sudoer file is accessed using visudo,ainxxxxn06,ainxxxxn06,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.971 AM",2525294649074119996,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,10520,opera.exe,opera.exe,2525294649074119996,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.971 AM","7/17/2026, 5:49:40.971 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.971 AM",2525294649074119997,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16488,opera.exe,opera.exe,2525294649074119997,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.971 AM","7/17/2026, 5:49:40.971 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.971 AM",2525294649141228863,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,3240,opera.exe,opera.exe,2525294649141228863,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.971 AM","7/17/2026, 5:49:40.971 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.971 AM",2525294649141228864,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,5516,opera.exe,opera.exe,2525294649141228864,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.971 AM","7/17/2026, 5:49:40.971 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.971 AM",2525294649141228866,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,9620,opera.exe,opera.exe,2525294649141228866,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.971 AM","7/17/2026, 5:49:40.971 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.972 AM",2525294649141228865,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,13556,opera.exe,opera.exe,2525294649141228865,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.972 AM","7/17/2026, 5:49:40.972 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.972 AM",2525294649141228867,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,8272,opera.exe,opera.exe,2525294649141228867,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.972 AM","7/17/2026, 5:49:40.972 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.972 AM",2525294649199949125,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17964,opera.exe,opera.exe,2525294649199949125,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.972 AM","7/17/2026, 5:49:40.972 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.972 AM",2525294649199949127,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,7968,opera.exe,opera.exe,2525294649199949127,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.972 AM","7/17/2026, 5:49:40.972 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.973 AM",2525294649199949124,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17028,opera.exe,opera.exe,2525294649199949124,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.973 AM","7/17/2026, 5:49:40.973 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.973 AM",2525294649199949126,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,10340,opera.exe,opera.exe,2525294649199949126,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.973 AM","7/17/2026, 5:49:40.973 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.973 AM",2525294649258669384,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,18004,opera.exe,opera.exe,2525294649258669384,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.973 AM","7/17/2026, 5:49:40.973 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.975 AM",2525294649258669385,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,13108,opera.exe,opera.exe,2525294649258669385,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.975 AM","7/17/2026, 5:49:40.975 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.976 AM",2525294649258669386,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17776,opera.exe,opera.exe,2525294649258669386,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.976 AM","7/17/2026, 5:49:40.976 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.976 AM",2525294649300612427,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,16440,opera.exe,opera.exe,2525294649300612427,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.976 AM","7/17/2026, 5:49:40.976 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.976 AM",2525294649300612428,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,4240,opera.exe,opera.exe,2525294649300612428,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.976 AM","7/17/2026, 5:49:40.976 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.976 AM",2525294649300612429,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,10668,opera.exe,opera.exe,2525294649300612429,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.976 AM","7/17/2026, 5:49:40.976 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.977 AM",2525294649350944078,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,10040,opera.exe,opera.exe,2525294649350944078,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.977 AM","7/17/2026, 5:49:40.977 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.977 AM",2525294649350944079,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17852,opera.exe,opera.exe,2525294649350944079,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.977 AM","7/17/2026, 5:49:40.977 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.977 AM",2525294649350944080,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,14388,opera.exe,opera.exe,2525294649350944080,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.977 AM","7/17/2026, 5:49:40.977 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.977 AM",2525294649350944081,Detect Unapproved Browser (Opera and Brave),Process loaded unknown shim module,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,9524,opera.exe,opera.exe,2525294649350944081,Alert,1,Medium,Medium,Process loaded unknown shim module,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.977 AM","7/17/2026, 5:49:40.977 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.977 AM",2525294649426441554,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,8492,opera.exe,opera.exe,2525294649426441554,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.977 AM","7/17/2026, 5:49:40.977 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.977 AM",2525294649426441555,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,10444,opera.exe,opera.exe,2525294649426441555,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.977 AM","7/17/2026, 5:49:40.977 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.978 AM",2525294649426441556,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,620,opera.exe,opera.exe,2525294649426441556,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.978 AM","7/17/2026, 5:49:40.978 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.978 AM",2525294649426441557,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17052,opera.exe,opera.exe,2525294649426441557,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.978 AM","7/17/2026, 5:49:40.978 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.978 AM",2525294649476773208,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,5760,opera.exe,opera.exe,2525294649476773208,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.978 AM","7/17/2026, 5:49:40.978 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.979 AM",2525294649476773207,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,2396,opera.exe,opera.exe,2525294649476773207,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.979 AM","7/17/2026, 5:49:40.979 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.979 AM",2525294649476773209,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17928,opera.exe,opera.exe,2525294649476773209,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.979 AM","7/17/2026, 5:49:40.979 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:49:40.979 AM",2525294649476773210,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,opera.exe,17564,opera.exe,opera.exe,2525294649476773210,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/17/2026, 5:49:40.979 AM","7/17/2026, 5:49:40.979 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/25/2026, 12:14:16.389 AM",2509180765549703319,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),Multiple functions were unhooked,Unknown,Active,unresolved,EGYxxxxY01,desktop,,801e1xxxx801e1,Other,windows,Windows 11 Enterprise,THOxxx@test.com,powershell.exe,51924,powershell.exe,powershell.exe,2509180765549703319,Alert,1,High,High,Multiple functions were unhooked,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/25/2026, 12:14:16.389 AM","6/25/2026, 12:14:16.389 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/1/2026, 5:44:45.592 PM",2514058147064896881,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),Multiple functions were unhooked,Unknown,Active,unresolved,CLKxxxxK03,desktop,,18208xxxx18208,Other,windows,Windows 11 Enterprise,THOxxx@test.com,powershell.exe,57696,powershell.exe,powershell.exe,2514058147064896881,Alert,1,High,High,Multiple functions were unhooked,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/1/2026, 5:44:45.592 PM","7/1/2026, 5:44:45.592 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/17/2026, 8:51:26.697 PM",2504005248494483658,Putty Running Out of Downloads Folder,Verify if this is legitimate activity or not.,Unknown,Active,unresolved,AWUxxxxUS1,server,,1e6a3xxxx1e6a3,Other,windows,Windows 11 Enterprise multi-session,MY0xxx@test.com,putty.exe,7396,putty.exe,putty.exe,2504005248494483658,Alert,1,Medium,Medium,Verify if this is legitimate activity or not.,PROCESSCREATION,Threat,malicious,"6/17/2026, 8:51:26.697 PM","6/17/2026, 8:51:26.697 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"6/28/2026, 4:56:06.939 AM",2511496948714070222,Unapproved PenTest tool detected,,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,2adc2xxxx2adc2,Other,windows,Windows 11 Home Single Language,P-5xxx@test.com,python.exe,13540,python.exe,python.exe,2511496948714070222,Alert,1,High,Critical,,FILEDELETION,Suspicious Activity,suspicious,"6/28/2026, 4:56:06.939 AM","6/28/2026, 4:56:06.939 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/29/2026, 7:31:25.871 PM",2512662285001265309,Unapproved PenTest tool detected,,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,2adc2xxxx2adc2,Other,windows,Windows 11 Home Single Language,P-5xxx@test.com,python.exe,5412,python.exe,python.exe,2512662285001265309,Alert,1,High,Critical,,FILEDELETION,Suspicious Activity,suspicious,"6/29/2026, 7:31:25.871 PM","6/29/2026, 7:31:25.871 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/17/2026, 5:48:09.158 AM",2525293878546913765,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",Unknown,Active,unresolved,MKCxxxxC01,desktop,,1b159xxxx1b159,Other,windows,Windows 11 Enterprise,KG0xxx@test.com,recommend_installer.exe,3384,recommend_installer.exe,recommend_installer.exe,2525293878546913765,Alert,1,Medium,Medium,"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",FILECREATION,Threat,malicious,"7/17/2026, 5:48:09.158 AM","7/17/2026, 5:48:09.158 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"6/19/2026, 3:22:28.594 PM",2505289224745183563,Command Prompt opened by Sacsess,Sacsess is a remote access tool used in the Azure environment to run commands remotely into Azure vms.,Unknown,Active,unresolved,AEUxxxxUS1,server,,4cd6bxxxx4cd6b,Other,windows,Windows 11 Enterprise multi-session,THOxxx@test.com,sacsess.exe,27044,sacsess.exe,sacsess.exe,2505289224745183563,Alert,1,Medium,Medium,Sacsess is a remote access tool used in the Azure environment to run commands remotely into Azure vms.,PROCESSCREATION,Suspicious Activity,suspicious,"6/19/2026, 3:22:28.594 PM","6/19/2026, 3:22:28.594 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/11/2026, 11:13:56.251 PM",2499728312968702167,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2499728312968702167,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/11/2026, 11:13:56.251 PM","6/11/2026, 11:13:56.251 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/12/2026, 11:40:47.176 PM",2500466602112912205,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2500466602112912205,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/12/2026, 11:40:47.176 PM","6/12/2026, 11:40:47.176 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/14/2026, 3:33:33.589 AM",2501308536838071999,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2501308536838071999,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/14/2026, 3:33:33.589 AM","6/14/2026, 3:33:33.589 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 3:12:45.501 AM",2502022842625416879,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,4692,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2502022842625416879,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/15/2026, 3:12:45.501 AM","6/15/2026, 3:12:45.501 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 4:21:00.375 AM",2502057193180897531,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2502057193180897531,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/15/2026, 4:21:00.375 AM","6/15/2026, 4:21:00.375 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/16/2026, 3:25:20.032 AM",2502753947808380311,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,4692,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2502753947808380311,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/16/2026, 3:25:20.032 AM","6/16/2026, 3:25:20.032 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/16/2026, 5:43:15.280 AM",2502823365607052678,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2502823365607052678,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/16/2026, 5:43:15.280 AM","6/16/2026, 5:43:15.280 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/17/2026, 3:55:23.444 PM",2503856239517425046,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,4692,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2503856239517425046,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/17/2026, 3:55:23.444 PM","6/17/2026, 3:55:23.444 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/17/2026, 7:26:16.248 AM",2503599991066956183,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2503599991066956183,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/17/2026, 7:26:16.248 AM","6/17/2026, 7:26:16.248 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/18/2026, 3:18:53.570 AM",2504200257387906794,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,2276,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2504200257387906794,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/18/2026, 3:18:53.570 AM","6/18/2026, 3:18:53.570 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/18/2026, 3:18:53.570 AM",2504200257387906795,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5292,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2504200257387906795,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/18/2026, 3:18:53.570 AM","6/18/2026, 3:18:53.570 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/19/2026, 11:01:56.225 AM",2505158090927495711,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2505158090927495711,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/19/2026, 11:01:56.225 AM","6/19/2026, 11:01:56.225 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/20/2026, 12:02:19.295 PM",2505913259325758356,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2505913259325758356,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/20/2026, 12:02:19.295 PM","6/20/2026, 12:02:19.295 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/22/2026, 5:38:33.537 PM",2507532044451981341,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2507532044451981341,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/22/2026, 5:38:33.537 PM","6/22/2026, 5:38:33.537 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/23/2026, 11:34:40.752 PM",2508436061361535014,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5032,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2508436061361535014,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/23/2026, 11:34:40.752 PM","6/23/2026, 11:34:40.752 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/23/2026, 11:48:58.300 PM",2508443254995666069,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5292,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2508443254995666069,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/23/2026, 11:48:58.300 PM","6/23/2026, 11:48:58.300 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/23/2026, 11:49:48.876 PM",2508443679249517885,File Signed by Connectwise Detected (ScreenConnect),A revoked certificate was used,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5408,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2508443679249517885,Alert,1,High,High,A revoked certificate was used,BEHAVIORALINDICATORS,Threat,malicious,"6/23/2026, 11:49:48.876 PM","6/23/2026, 11:49:48.876 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/23/2026, 11:51:14.740 PM",2508444399528960876,File Signed by Connectwise Detected (ScreenConnect),A revoked certificate was used,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5268,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2508444399528960876,Alert,1,High,High,A revoked certificate was used,BEHAVIORALINDICATORS,Threat,malicious,"6/23/2026, 11:51:14.740 PM","6/23/2026, 11:51:14.740 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/23/2026, 11:52:48.790 PM",2508445188477569288,File Signed by Connectwise Detected (ScreenConnect),A revoked certificate was used,Unknown,Active,unresolved,JE8xxxx82U,laptop,,281c2xxxx281c2,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5144,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2508445188477569288,Alert,1,High,High,A revoked certificate was used,BEHAVIORALINDICATORS,Threat,malicious,"6/23/2026, 11:52:48.790 PM","6/23/2026, 11:52:48.790 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/25/2026, 12:15:44.159 AM",2509181501650064817,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5292,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2509181501650064817,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/25/2026, 12:15:44.159 AM","6/25/2026, 12:15:44.159 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/26/2026, 12:36:11.456 AM",2509916572696166023,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5292,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2509916572696166023,Alert,1,High,High,,DUPLICATEPROCESS,Threat,malicious,"6/26/2026, 12:36:11.456 AM","6/26/2026, 12:36:11.456 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/26/2026, 4:32:15.509 AM",2510035389377484904,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,2276,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2510035389377484904,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/26/2026, 4:32:15.509 AM","6/26/2026, 4:32:15.509 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/26/2026, 4:32:20.354 AM",2510035430028679428,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5532,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2510035430028679428,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/26/2026, 4:32:20.354 AM","6/26/2026, 4:32:20.354 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/27/2026, 6:38:02.706 AM",2510823475587852307,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,2276,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2510823475587852307,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/27/2026, 6:38:02.706 AM","6/27/2026, 6:38:02.706 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/27/2026, 6:38:07.716 AM",2510823517606389861,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2510823517606389861,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/27/2026, 6:38:07.716 AM","6/27/2026, 6:38:07.716 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/28/2026, 5:06:47.773 PM",2511864712392346392,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2511864712392346392,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"6/28/2026, 5:06:47.773 PM","6/28/2026, 5:06:47.773 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/29/2026, 5:16:43.072 PM",2512594481598959477,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2512594481598959477,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/29/2026, 5:16:43.072 PM","6/29/2026, 5:16:43.072 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,UnknownShimModuleLoaded,"Persistence, Privilege Escalation",Application Shimming (T1546.011),SentinelOneAlerts_CL,{} +"6/29/2026, 6:32:16.177 AM",2512270120166607483,File Signed by Connectwise Detected (ScreenConnect),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,73419xxxx73419,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,6076,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2512270120166607483,Alert,1,High,High,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"6/29/2026, 6:32:16.177 AM","6/29/2026, 6:32:16.177 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/29/2026, 6:33:51.224 AM",2512270917478648263,File Signed by Connectwise Detected (ScreenConnect),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,73419xxxx73419,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,4684,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2512270917478648263,Alert,1,High,High,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"6/29/2026, 6:33:51.224 AM","6/29/2026, 6:33:51.224 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/30/2026, 7:46:59.921 PM",2513394896143986942,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2513394896143986942,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"6/30/2026, 7:46:59.921 PM","6/30/2026, 7:46:59.921 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/1/2026, 8:18:26.551 PM",2514135498240677479,File Signed by Connectwise Detected (ScreenConnect),DNS requested,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2514135498240677479,Alert,1,High,High,DNS requested,DNS,Threat,malicious,"7/1/2026, 8:18:26.551 PM","7/1/2026, 8:18:26.551 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/15/2026, 2:44:51.054 AM",2523752068281561648,File Signed by Connectwise Detected (ScreenConnect),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,73419xxxx73419,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,4480,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2523752068281561648,Alert,1,High,High,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"7/15/2026, 2:44:51.054 AM","7/15/2026, 2:44:51.054 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,,,,SentinelOneAlerts_CL,{} +"7/15/2026, 7:07:12.138 AM",2523884114049807256,File Signed by Connectwise Detected (ScreenConnect),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,73419xxxx73419,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5564,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2523884114049807256,Alert,1,High,High,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"7/15/2026, 7:07:12.138 AM","7/15/2026, 7:07:12.138 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/15/2026, 7:08:37.240 AM",2523884827945520436,File Signed by Connectwise Detected (ScreenConnect),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,73419xxxx73419,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,4428,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2523884827945520436,Alert,1,High,High,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"7/15/2026, 7:08:37.240 AM","7/15/2026, 7:08:37.240 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/15/2026, 8:51:29.956 PM",2524298996299129581,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2524298996299129581,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"7/15/2026, 8:51:29.956 PM","7/15/2026, 8:51:29.956 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/19/2026, 6:07:28.432 PM",2527115542546836894,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2527115542546836894,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"7/19/2026, 6:07:28.432 PM","7/19/2026, 6:07:28.432 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,KG0xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",MKCxxxxC01,MKCxxxxC01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/21/2026, 12:38:55.767 PM",2528399732187989938,File Signed by Connectwise Detected (ScreenConnect),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,73419xxxx73419,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5644,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2528399732187989938,Alert,1,High,High,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"7/21/2026, 12:38:55.767 PM","7/21/2026, 12:38:55.767 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/21/2026, 12:40:21.730 PM",2528400453297917857,File Signed by Connectwise Detected (ScreenConnect),Application was hijacked by signed and known DLL,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,73419xxxx73419,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,4512,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2528400453297917857,Alert,1,High,High,Application was hijacked by signed and known DLL,BEHAVIORALINDICATORS,Threat,malicious,"7/21/2026, 12:40:21.730 PM","7/21/2026, 12:40:21.730 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/24/2026, 4:24:47.258 AM",2530325349655207622,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2530325349655207622,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"7/24/2026, 4:24:47.258 AM","7/24/2026, 4:24:47.258 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,serxxx@test.com,UPN,Service Account Logged in via RDP,,Service Account Logged in via RDP,,AEUxxxxUS1,AEUxxxxUS1,,,,SentinelOneAlerts_CL,{} +"7/3/2026, 9:32:05.658 PM",2515622119684974414,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2515622119684974414,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"7/3/2026, 9:32:05.658 PM","7/3/2026, 9:32:05.658 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/5/2026, 3:41:26.190 AM",2516532791426826658,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2516532791426826658,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"7/5/2026, 3:41:26.190 AM","7/5/2026, 3:41:26.190 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,Windows Event logs cleared,,Windows Event logs cleared,This rule triggers when a windows event log is cleared,DESxxxxSKT,DESxxxxSKT,WindowsEventLogCleared,Defense Impairment,"Clear Windows Event Logs (T1685.005), Disable or Modify Windows Event Log (T1685.001)",SentinelOneAlerts_CL,{} +"7/6/2026, 3:48:25.281 AM",2517261082755170918,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2517261082755170918,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"7/6/2026, 3:48:25.281 AM","7/6/2026, 3:48:25.281 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/8/2026, 12:41:46.855 AM",2518616694997747445,File Signed by Connectwise Detected (ScreenConnect),,Unknown,Active,unresolved,DESxxxxSKT,laptop,,d4e13xxxxd4e13,Other,windows,Windows 11 Home,THOxxx@test.com,ScreenConnect.ClientService.exe,5012,ScreenConnect.ClientService.exe,ScreenConnect.ClientService.exe,2518616694997747445,Alert,1,High,High,,PROCESSCREATION,Threat,malicious,"7/8/2026, 12:41:46.855 AM","7/8/2026, 12:41:46.855 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:11.040 PM",2501612350613279414,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,setup.exe,5608,setup.exe,setup.exe,2501612350613279414,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/14/2026, 1:37:11.040 PM","6/14/2026, 1:37:11.040 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/14/2026, 1:37:46.657 PM",2501612649381997805,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,setup.exe,12716,setup.exe,setup.exe,2501612649381997805,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/14/2026, 1:37:46.657 PM","6/14/2026, 1:37:46.657 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,ProcessStartedFromLnk,"Execution, Stealth",Masquerade File Type (T1036.008),SentinelOneAlerts_CL,{} +"6/16/2026, 12:31:17.332 PM",2503028735972350233,Detect Unapproved Browser (Opera and Brave),Process is shimmed by an unknown fix,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,setup.exe,13276,setup.exe,setup.exe,2503028735972350233,Alert,1,Medium,Medium,Process is shimmed by an unknown fix,BEHAVIORALINDICATORS,Threat,malicious,"6/16/2026, 12:31:17.332 PM","6/16/2026, 12:31:17.332 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/17/2026, 12:03:58.358 PM",2503739762996891601,Detect Unapproved Browser (Opera and Brave),Process is shimmed by an unknown fix,Unknown,Active,unresolved,ALBxxxxB02,desktop,,3d358xxxx3d358,Other,windows,Windows 11 Pro,pa0xxx@test.com,setup.exe,16400,setup.exe,setup.exe,2503739762996891601,Alert,1,Medium,Medium,Process is shimmed by an unknown fix,BEHAVIORALINDICATORS,Threat,malicious,"6/17/2026, 12:03:58.358 PM","6/17/2026, 12:03:58.358 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.294 AM",2510658065775075110,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,setup.exe,21660,setup.exe,setup.exe,2510658065775075110,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.294 AM","6/27/2026, 1:09:24.294 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/27/2026, 1:09:24.296 AM",2510658066035121978,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,setup.exe,4280,setup.exe,setup.exe,2510658066035121978,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"6/27/2026, 1:09:24.296 AM","6/27/2026, 1:09:24.296 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/30/2026, 7:14:47.757 PM",2513378687977163100,Detect Unapproved Browser (Opera and Brave),Process is shimmed by an unknown fix,Unknown,Active,unresolved,DVAxxxxA01,laptop,,81dd1xxxx81dd1,Other,windows,Windows 11 Enterprise,OUPxxx@test.com,setup.exe,13476,setup.exe,setup.exe,2513378687977163100,Alert,1,Medium,Medium,Process is shimmed by an unknown fix,BEHAVIORALINDICATORS,Threat,malicious,"6/30/2026, 7:14:47.757 PM","6/30/2026, 7:14:47.757 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.892 PM",2515643856699873405,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,setup.exe,6484,setup.exe,setup.exe,2515643856699873405,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.892 PM","7/3/2026, 10:15:16.892 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/3/2026, 10:15:16.892 PM",2515643856708262015,Detect Unapproved Browser (Opera and Brave),Detects the registration of a vectored exception handler,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,setup.exe,2832,setup.exe,setup.exe,2515643856708262015,Alert,1,Medium,Medium,Detects the registration of a vectored exception handler,BEHAVIORALINDICATORS,Threat,malicious,"7/3/2026, 10:15:16.892 PM","7/3/2026, 10:15:16.892 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/6/2026, 2:11:06.925 PM",2517574494946211471,Detect Unapproved Browser (Opera and Brave),Process is shimmed by an unknown fix,Unknown,Active,unresolved,WAHxxxxHPA,desktop,,b2b78xxxxb2b78,Other,windows,Windows 11 Enterprise,JC0xxx@test.com,setup.exe,13300,setup.exe,setup.exe,2517574494946211471,Alert,1,Medium,Medium,Process is shimmed by an unknown fix,BEHAVIORALINDICATORS,Threat,malicious,"7/6/2026, 2:11:06.925 PM","7/6/2026, 2:11:06.925 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,PreloadInjection,"Stealth, Privilege Escalation",Process Hollowing (T1055.012),SentinelOneAlerts_CL,{} +"6/19/2026, 8:22:52.045 AM",2505078028558648795,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),Multiple functions were unhooked,Unknown,Active,unresolved,CEBxxxxB01,desktop,,115c8xxxx115c8,Other,windows,Windows 11 Enterprise,AV0xxx@test.com,tt_crash_reporter.exe,30056,tt_crash_reporter.exe,tt_crash_reporter.exe,2505078028558648795,Alert,1,High,High,Multiple functions were unhooked,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/19/2026, 8:22:52.045 AM","6/19/2026, 8:22:52.045 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/23/2026, 8:28:24.905 AM",2529723195638761249,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),Multiple functions were unhooked,Unknown,Active,unresolved,TZNxxxxN01,desktop,,ba755xxxxba755,Other,windows,Windows 11 Enterprise,DM0xxx@test.com,tt_crash_reporter.exe,13132,tt_crash_reporter.exe,tt_crash_reporter.exe,2529723195638761249,Alert,1,High,High,Multiple functions were unhooked,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/23/2026, 8:28:24.905 AM","7/23/2026, 8:28:24.905 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/23/2026, 5:45:11.253 AM",2507897768606323552,Detected multiple C2 implants behaviors including Core Impact framework (Fin7),Multiple functions were unhooked,Unknown,Active,unresolved,MLAxxxxA01,desktop,,1a200xxxx1a200,Other,windows,Windows 11 Enterprise,THOxxx@test.com,WerFault.exe,9544,WerFault.exe,WerFault.exe,2507897768606323552,Alert,1,High,High,Multiple functions were unhooked,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/23/2026, 5:45:11.253 AM","6/23/2026, 5:45:11.253 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 8:03:59.742 AM",2502169427178239974,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7720,wevtutil.exe,wevtutil.exe,2502169427178239974,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/15/2026, 8:03:59.742 AM","6/15/2026, 8:03:59.742 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 8:03:59.742 AM",2502169427178239976,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7736,wevtutil.exe,wevtutil.exe,2502169427178239976,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/15/2026, 8:03:59.742 AM","6/15/2026, 8:03:59.742 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 8:16:40.855 AM",2502175811840246544,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,4496,wevtutil.exe,wevtutil.exe,2502175811840246544,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/15/2026, 8:16:40.855 AM","6/15/2026, 8:16:40.855 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/15/2026, 8:16:40.855 AM",2502175811848635153,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,6612,wevtutil.exe,wevtutil.exe,2502175811848635153,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/15/2026, 8:16:40.855 AM","6/15/2026, 8:16:40.855 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/19/2026, 1:14:54.203 PM",2505225015058539087,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8048,wevtutil.exe,wevtutil.exe,2505225015058539087,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/19/2026, 1:14:54.203 PM","6/19/2026, 1:14:54.203 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/19/2026, 1:14:54.203 PM",2505225015066927696,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7980,wevtutil.exe,wevtutil.exe,2505225015066927696,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/19/2026, 1:14:54.203 PM","6/19/2026, 1:14:54.203 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/21/2026, 2:26:42.688 PM",2506710708942922395,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7388,wevtutil.exe,wevtutil.exe,2506710708942922395,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/21/2026, 2:26:42.688 PM","6/21/2026, 2:26:42.688 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/21/2026, 2:26:42.688 PM",2506710708942922396,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7368,wevtutil.exe,wevtutil.exe,2506710708942922396,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/21/2026, 2:26:42.688 PM","6/21/2026, 2:26:42.688 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/22/2026, 7:26:31.652 AM",2507223998949753415,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7496,wevtutil.exe,wevtutil.exe,2507223998949753415,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/22/2026, 7:26:31.652 AM","6/22/2026, 7:26:31.652 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/22/2026, 7:26:31.653 AM",2507223998949753416,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7520,wevtutil.exe,wevtutil.exe,2507223998949753416,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/22/2026, 7:26:31.653 AM","6/22/2026, 7:26:31.653 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/26/2026, 8:52:44.243 PM",2510528880572700553,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,6312,wevtutil.exe,wevtutil.exe,2510528880572700553,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/26/2026, 8:52:44.243 PM","6/26/2026, 8:52:44.243 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"6/26/2026, 8:52:44.243 PM",2510528880581089162,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,5712,wevtutil.exe,wevtutil.exe,2510528880581089162,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/26/2026, 8:52:44.243 PM","6/26/2026, 8:52:44.243 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/12/2026, 1:26:15.686 PM",2521900573580508741,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,5612,wevtutil.exe,wevtutil.exe,2521900573580508741,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/12/2026, 1:26:15.686 PM","7/12/2026, 1:26:15.686 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/12/2026, 1:26:15.687 PM",2521900573580508742,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8044,wevtutil.exe,wevtutil.exe,2521900573580508742,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/12/2026, 1:26:15.687 PM","7/12/2026, 1:26:15.687 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 10:21:49.620 AM",2525431623334135204,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,2220,wevtutil.exe,wevtutil.exe,2525431623334135204,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/17/2026, 10:21:49.620 AM","7/17/2026, 10:21:49.620 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/17/2026, 10:21:49.620 AM",2525431623334135205,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,3932,wevtutil.exe,wevtutil.exe,2525431623334135205,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/17/2026, 10:21:49.620 AM","7/17/2026, 10:21:49.620 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 10:53:37.282 AM",2514575990011086676,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8044,wevtutil.exe,wevtutil.exe,2514575990011086676,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/2/2026, 10:53:37.282 AM","7/2/2026, 10:53:37.282 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/2/2026, 10:53:37.282 AM",2514575990011086677,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8020,wevtutil.exe,wevtutil.exe,2514575990011086677,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/2/2026, 10:53:37.282 AM","7/2/2026, 10:53:37.282 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/2/2026, 11:51:27.441 PM",2514967487673087034,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7976,wevtutil.exe,wevtutil.exe,2514967487673087034,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/2/2026, 11:51:27.441 PM","7/2/2026, 11:51:27.441 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/2/2026, 11:51:27.442 PM",2514967487673087036,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8008,wevtutil.exe,wevtutil.exe,2514967487673087036,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/2/2026, 11:51:27.442 PM","7/2/2026, 11:51:27.442 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/2/2026, 8:00:54.438 PM",2514851448034475078,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,2104,wevtutil.exe,wevtutil.exe,2514851448034475078,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/2/2026, 8:00:54.438 PM","7/2/2026, 8:00:54.438 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/2/2026, 8:00:54.439 PM",2514851448042863687,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7420,wevtutil.exe,wevtutil.exe,2514851448042863687,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/2/2026, 8:00:54.439 PM","7/2/2026, 8:00:54.439 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/20/2026, 3:57:47.620 AM",2527412660458889812,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8168,wevtutil.exe,wevtutil.exe,2527412660458889812,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/20/2026, 3:57:47.620 AM","7/20/2026, 3:57:47.620 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/20/2026, 3:57:47.620 AM",2527412660458889813,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7404,wevtutil.exe,wevtutil.exe,2527412660458889813,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/20/2026, 3:57:47.620 AM","7/20/2026, 3:57:47.620 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/22/2026, 3:13:04.209 PM",2529202089471435123,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,4200,wevtutil.exe,wevtutil.exe,2529202089471435123,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/22/2026, 3:13:04.209 PM","7/22/2026, 3:13:04.209 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/22/2026, 3:13:04.209 PM",2529202089471435124,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,2764,wevtutil.exe,wevtutil.exe,2529202089471435124,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/22/2026, 3:13:04.209 PM","7/22/2026, 3:13:04.209 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/24/2026, 11:53:31.913 AM",2530551211108439315,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7264,wevtutil.exe,wevtutil.exe,2530551211108439315,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/24/2026, 11:53:31.913 AM","7/24/2026, 11:53:31.913 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/24/2026, 11:53:31.960 AM",2530551211116827924,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,7288,wevtutil.exe,wevtutil.exe,2530551211116827924,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/24/2026, 11:53:31.960 AM","7/24/2026, 11:53:31.960 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/27/2026, 12:46:43.107 PM",2532752306924062136,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,2404,wevtutil.exe,wevtutil.exe,2532752306924062136,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/27/2026, 12:46:43.107 PM","7/27/2026, 12:46:43.107 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/27/2026, 12:46:43.107 PM",2532752306932450745,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,5892,wevtutil.exe,wevtutil.exe,2532752306932450745,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/27/2026, 12:46:43.107 PM","7/27/2026, 12:46:43.107 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/7/2026, 1:01:25.014 PM",2518264190245444853,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8104,wevtutil.exe,wevtutil.exe,2518264190245444853,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/7/2026, 1:01:25.014 PM","7/7/2026, 1:01:25.014 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,AddVehHandler,,,SentinelOneAlerts_CL,{} +"7/7/2026, 1:01:25.014 PM",2518264190253833463,Windows Event logs cleared,The windows event log has been cleared,Unknown,Active,unresolved,DESxxxxSKT,desktop,,ffde7xxxxffde7,Other,windows,Windows 10 Pro,THOxxx@test.com,wevtutil.exe,8060,wevtutil.exe,wevtutil.exe,2518264190253833463,Alert,1,Medium,Medium,The windows event log has been cleared,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"7/7/2026, 1:01:25.014 PM","7/7/2026, 1:01:25.014 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"6/17/2026, 10:02:45.338 PM",2504041140346579198,attempted access to upload[.]ee detected,DNS requested,Unknown,Active,unresolved,LAPxxxxPTO,laptop,,11ab7xxxx11ab7,Other,windows,Windows 11 Home Single Language,THOxxx@test.com,wire.exe,13068,wire.exe,wire.exe,2504041140346579198,Alert,1,High,High,DNS requested,DNS,Suspicious Activity,suspicious,"6/17/2026, 10:02:45.338 PM","6/17/2026, 10:02:45.338 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,p00xxx@test.com,UPN,Successful Login to server via VSPHERE,,Successful Login to server via VSPHERE,Login from VSPHERE. THIS IS RARE verify an admin is using it. Should never be regular user.,INBxxxxB01,INBxxxxB01,,,,SentinelOneAlerts_CL,{} +"6/14/2026, 2:50:07.542 PM",2501649063368834684,Suspicious WMIC Usage V2,Identified attempt to access a raw volume,Unknown,Active,unresolved,mktxxxxtpw,server,,4d54exxxx4d54e,Other,windows,Windows Server 2019 Standard,RCExxx@test.com,WMIC.exe,5528,WMIC.exe,WMIC.exe,2501649063368834684,Alert,1,Low,Low,Identified attempt to access a raw volume,BEHAVIORALINDICATORS,Suspicious Activity,suspicious,"6/14/2026, 2:50:07.542 PM","6/14/2026, 2:50:07.542 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OP-xxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/19/2026, 2:15:47.391 PM",2505255660229536852,Monitor abnormal modification of SSH Authorization File,,Unknown,Active,unresolved,DCSxxxxS01,server,,704f8xxxx704f8,Other,linux,Linux,xxx@test.com,,1407730,,,2505255660229536852,Alert,1,Medium,Medium,,FILECREATION,Suspicious Activity,suspicious,"6/19/2026, 2:15:47.391 PM","6/19/2026, 2:15:47.391 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/15/2026, 11:57:04.803 PM",2502649130226355234,WARNING!! Invoke-SMBExec was executed.,Application registered itself to become persistent via service,Unknown,Active,unresolved,AWUxxxxUS1,server,,04fcexxxx04fce,Other,windows,Windows Server 2016 Datacenter,xxx@test.com,,2136,,,2502649130226355234,Alert,1,High,Critical,Application registered itself to become persistent via service,BEHAVIORALINDICATORS,Threat,malicious,"6/15/2026, 11:57:04.803 PM","6/15/2026, 11:57:04.803 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,THOxxx@test.com,UPN,File Signed by Connectwise Detected (ScreenConnect),,File Signed by Connectwise Detected (ScreenConnect),,DESxxxxSKT,DESxxxxSKT,,,,SentinelOneAlerts_CL,{} +"6/25/2026, 5:55:42.515 AM",2509352615464555215,WARNING!! Invoke-SMBExec was executed.,Application registered itself to become persistent via service,Unknown,Active,unresolved,AEUxxxxUS1,server,,03a0exxxx03a0e,Other,windows,Windows Server 2016 Datacenter,xxx@test.com,,2312,,,2509352615464555215,Alert,1,High,Critical,Application registered itself to become persistent via service,BEHAVIORALINDICATORS,Threat,malicious,"6/25/2026, 5:55:42.515 AM","6/25/2026, 5:55:42.515 AM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/14/2026, 12:47:00.945 PM",2523330372035629357,WARNING!! Invoke-SMBExec was executed.,Application registered itself to become persistent via service,Unknown,Active,unresolved,CUBxxxxB02,desktop,,fdfd6xxxxfdfd6,Other,windows,Windows 11 Enterprise,xxx@test.com,,17816,,,2523330372035629357,Alert,1,High,Critical,Application registered itself to become persistent via service,BEHAVIORALINDICATORS,Threat,malicious,"7/14/2026, 12:47:00.945 PM","7/14/2026, 12:47:00.945 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} +"7/2/2026, 5:57:04.728 PM",2514789123106281027,WARNING!! Invoke-SMBExec was executed.,Application registered itself to become persistent via service,Unknown,Active,unresolved,CLKxxxxK03,laptop,,78f68xxxx78f68,Other,windows,Windows 11 Enterprise,xxx@test.com,,33516,,,2514789123106281027,Alert,1,High,Critical,Application registered itself to become persistent via service,BEHAVIORALINDICATORS,Threat,malicious,"7/2/2026, 5:57:04.728 PM","7/2/2026, 5:57:04.728 PM",Singularity,SentinelOne,Success,AlertEvent,0.1,,,OUPxxx@test.com,UPN,Detect Unapproved Browser (Opera and Brave),,Detect Unapproved Browser (Opera and Brave),"Mitigate and Delete unapproved Internet browsers (Opera, Brave) to be executed",DVAxxxxA01,DVAxxxxA01,,,,SentinelOneAlerts_CL,{} \ No newline at end of file