Skip to content

Commit 37d4426

Browse files
detections-ai[bot]detections-ai[bot]
authored
Update file at /KQL/forg365-phaas-detection-using-silent-push.kql
1 parent b161663 commit 37d4426

1 file changed

Lines changed: 22 additions & 0 deletions

File tree

‎KQL/forg365-phaas-detection-using-silent-push.kql‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Forg365 PhaaS Detection Using Silent Push
2+
// Author: KQLWizard (Steven Lim)
3+
//
4+
let Forg365BackendNode = dynamic([
5+
"104.21.73.235",
6+
"104.21.73.235",
7+
"188.114.96.11",
8+
"104.21.17.182",
9+
"188.114.96.2",
10+
"143.198.0.184",
11+
"143.198.0.184",
12+
"104.21.17.182",
13+
"188.114.96.2",
14+
"104.21.17.182",
15+
"188.114.96.2",
16+
"188.114.96.11"
17+
]);
18+
EntraIdSignInEvents
19+
| where Timestamp > ago(1h)
20+
| where EndpointCall == "Cmsi:Cmsi"
21+
| where ErrorCode == "0"
22+
| where IPAddress has_any(Forg365BackendNode)

0 commit comments

Comments
 (0)