Microsoft on sentinelchangelog.nethttp://sentinelchangelog.net/tags/microsoft/Recent content in Microsoft on sentinelchangelog.netHugo -- 0.157.0enFri, 03 Jul 2026 06:43:54 +0000Entra ID Brute-Force Detection: Sort Order Fix Corrects Anomaly Decomposition Inputhttp://sentinelchangelog.net/posts/2026-07-03-pr-14589/Fri, 03 Jul 2026 06:43:54 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14589/The BruteForceAgainstanEntraAuthenticatedWindowsDevice Analytic Rule was building unsorted time-series arrays for series_decompose_anomalies, meaning anomaly detection results could be incorrect or inconsistent across executions – this fix enforces chronological ordering and stable serialization before make_list.Hybrid Attack Solution: Packaging Fix for Missing Workbook Content ID and Versionhttp://sentinelchangelog.net/posts/2026-06-29-pr-14576/Mon, 29 Jun 2026 07:16:25 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14576/Corrects missing content ID and version fields in the Hybrid Attack — Cloud & Identity solution packaging template to resolve a validation failure preventing Content Hub deployment.New Workbook: Hybrid Attack Kill-Chain Hunting Across Cloud and On-Prem Identityhttp://sentinelchangelog.net/posts/2026-06-29-pr-14575/Mon, 29 Jun 2026 06:09:41 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14575/A new behavior-led hunting workbook registers in Microsoft Sentinel covering end-to-end hybrid identity attack scenarios across 7 MITRE ATT&CK phases, correlating signals from Entra ID, Azure, on-prem AD, and Defender XDR.Microsoft Defender XDR: Email Hunting Queries Fixed to Reference Correct Connector, Three New Teams/Phish Queries Addedhttp://sentinelchangelog.net/posts/2026-06-23-pr-14537/Tue, 23 Jun 2026 05:40:00 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14537/Three email-focused Hunting Queries had a broken connector reference (OfficeATP instead of MicrosoftThreatProtection), suppressing results for orgs using the Defender XDR connector; three new queries covering RMM-via-Teams, alert correlation with Teams messages, and phish-reporter identity are also added.Microsoft Defender XDR: OAuth and Device-Code Phishing Hunting Queries Unblocked After ARM-TTK Pipeline Failurehttp://sentinelchangelog.net/posts/2026-06-18-pr-14472/Thu, 18 Jun 2026 05:58:50 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14472/Two Defender XDR hunting queries targeting OAuth consent and device-code phishing were blocked from pipeline validation due to ARM-TTK hardcoded URI false positives; KQL refactored to construct URLs via strcat(), restoring deployment and preserving detection semantics.Premium MDTI Connector Removed from Threat Intelligence Solution During MDTI Convergencehttp://sentinelchangelog.net/posts/2026-06-15-pr-14343/Mon, 15 Jun 2026 09:58:43 +0000http://sentinelchangelog.net/posts/2026-06-15-pr-14343/Premium Microsoft Defender Threat Intelligence connector no longer available in Threat Intelligence (NEW) solution v3.0.19 as part of MDTI convergence effort.Azure SQL Database Detection Rules: Enhanced MITRE Coverage and Alert Contexthttp://sentinelchangelog.net/posts/2026-06-11-pr-13876/Thu, 11 Jun 2026 13:00:36 +0000http://sentinelchangelog.net/posts/2026-06-11-pr-13876/Quality improvements to 10 Azure SQL analytic rules add missing MITRE techniques, alert customization, and standardized query outputs.Agent 365 Solution: Content Hub Update Detection Restored After Package ID Mismatchhttp://sentinelchangelog.net/posts/2026-06-09-pr-14431/Tue, 09 Jun 2026 05:53:07 +0000http://sentinelchangelog.net/posts/2026-06-09-pr-14431/Restores Agent 365 v3.1.1 Content Hub update detection by fixing solution ID mismatch that prevented upgrade notifications.Microsoft Agent Identities Connector: New Entra Non-Human Identity Asset Visibility (Preview)http://sentinelchangelog.net/posts/2026-06-03-pr-14326/Wed, 03 Jun 2026 06:01:01 +0000http://sentinelchangelog.net/posts/2026-06-03-pr-14326/Agent 365 solution adds new Microsoft Agent Identities connector for tracking agent blueprints and non-human identity assets across four data tables.Azure Security Benchmark Solution: Enhanced Detection Logic and Incident Enrichment (v3.0.5)http://sentinelchangelog.net/posts/2026-05-29-pr-13905/Fri, 29 May 2026 08:53:48 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-13905/Azure Security Benchmark solution updated to v3.0.5 with improved compliance monitoring logic, proper data connector declarations, and enhanced incident alert details.LockBit Hunting Query: ActiveMQ Exploit IoC Detection Addedhttp://sentinelchangelog.net/posts/2026-05-29-pr-14350/Fri, 29 May 2026 05:32:22 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14350/New hunting query provides hash-based detection for LockBit ransomware artifacts deployed via Apache ActiveMQ CVE-2023-46604 exploitation.Entra ID Authentication Anomalies: Advanced Hunting for Privilege Abuse and Defense Evasionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14339/Wed, 27 May 2026 13:42:33 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14339/Adds three-query pack detecting legacy auth bypass, guest account abuse, and post-reset privileged operations.Entra ID Account Takeover: Three-Query Hunting Pack for Post-Compromise Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14335/Wed, 27 May 2026 13:41:06 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14335/Adds hunting pack targeting device code phishing, service principal persistence, and bulk password resets by privileged actors.BadUSB HID Injection Detection: New Hunt for PowerShell via Windows Run Dialoghttp://sentinelchangelog.net/posts/2026-05-27-pr-14336/Wed, 27 May 2026 13:38:59 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14336/Adds hunting query to detect hardware keystroke injectors spawning PowerShell through explorer.exe with evasion patterns.Microsoft Entra ID OAuth Consent Query: Fixing Zero-Result Bug in High-Risk Permission Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14334/Wed, 27 May 2026 13:38:30 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14334/Corrects broken hunting query that returned no results due to incorrect property name filter.Hunting Query: Ephemeral Code Signing Certificates for Malware-Signing-as-a-Service Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14308/Wed, 27 May 2026 08:59:01 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14308/New hunting query identifies short-lived code signing certificates (≤14 days) on non-developer endpoints to detect Fox Tempest MSaaS operations.Hunting Query: Rootkit Network Evasion Detection via Firewall-EDR Telemetry Deltahttp://sentinelchangelog.net/posts/2026-05-27-pr-14337/Wed, 27 May 2026 08:36:31 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14337/New hunting query detects kernel-level rootkits bypassing EDR network telemetry by comparing perimeter firewall logs against Microsoft Defender for Endpoint data streams.Defender for Endpoint: Cryptographic Identity Baselining Hunting Query for Process Network Anomalieshttp://sentinelchangelog.net/posts/2026-05-26-pr-14333/Tue, 26 May 2026 09:05:22 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14333/New hunting query detects first-time network connections by processes using cryptographic signer baselining to defeat DLL sideloading and BYOTA attacks.LSASS Credential Dumping: Resilient Behavioral Detection Pack Addedhttp://sentinelchangelog.net/posts/2026-05-26-pr-14341/Tue, 26 May 2026 05:29:06 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14341/Three new hunting queries detect LSASS memory dumping using behavioral physics rather than brittle timing or tool names.Entra ID Workload Identity and Privileged Role Hunting Pack: Three New Detection Querieshttp://sentinelchangelog.net/posts/2026-05-21-pr-14281/Thu, 21 May 2026 12:50:47 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14281/New hunting pack targeting workload identity abuse and privileged role assignment anomalies with coverage gaps for service principal credential theft and PIM bypass techniques.ETW-Resistant .NET Fileless Injection Detection via Kernel-Level CLR Loadinghttp://sentinelchangelog.net/posts/2026-05-21-pr-14314/Thu, 21 May 2026 12:14:25 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14314/New hunting query detects fileless .NET execution even when attackers patch ETW by monitoring kernel-level .NET runtime DLL loading in native processes and untrusted paths.Microsoft Defender XDR: New Hunting Query for Delegate Mailbox Phish Reporting Analysishttp://sentinelchangelog.net/posts/2026-05-21-pr-14257/Thu, 21 May 2026 04:14:42 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14257/New hunting query helps identify the actual user who reported a phishing message when recipients and actors differ in delegate or shared mailbox scenarios.Agent 365 Solution Rebranded from A365 Observability (v3.0.1)http://sentinelchangelog.net/posts/2026-05-15-pr-14263/Fri, 15 May 2026 06:03:55 +0000http://sentinelchangelog.net/posts/2026-05-15-pr-14263/Microsoft renamed the A365 Observability solution to Agent 365 for marketing alignment with no functional changes.Microsoft Entra ID Protection: Enhanced Detection Logic Filters Out Admin Risk Eventshttp://sentinelchangelog.net/posts/2026-05-12-pr-14108/Tue, 12 May 2026 08:58:14 +0000http://sentinelchangelog.net/posts/2026-05-12-pr-14108/Updated CorrelateIPC_Unfamiliar-Atypical rule adds filtering to exclude admin-triggered atypical travel alerts, improving detection precision.Microsoft Entra ID: Service Principal Credential Manipulation by Rare Actorshttp://sentinelchangelog.net/posts/2026-05-07-pr-14213/Thu, 07 May 2026 10:51:04 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14213/Identifies service principal credential additions by actors not observed performing these operations in the previous 90 days, targeting persistence techniques.Microsoft Entra ID: Hunting Query for Password Spraying Detection via IP Failure Burstshttp://sentinelchangelog.net/posts/2026-05-07-pr-14208/Thu, 07 May 2026 10:50:43 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14208/Correlates failed sign-ins across multiple identities followed by successful authentication from the same IP within 15 minutes, targeting password spraying patterns.Microsoft Entra ID: New Hunting Query Detects Post-Compromise Token Abuse via ASN Mismatcheshttp://sentinelchangelog.net/posts/2026-05-07-pr-14207/Thu, 07 May 2026 10:50:16 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14207/Surfaces rapid ASN changes between interactive and non-interactive sign-ins within 10 minutes, indicating potential post-compromise token misuse.Azure Firewall Detection Quality Overhaul: Enhanced Alert Context and Reduced Query Costshttp://sentinelchangelog.net/posts/2026-05-06-pr-13820/Wed, 06 May 2026 09:37:20 +0000http://sentinelchangelog.net/posts/2026-05-06-pr-13820/Comprehensive quality improvements to 11 Azure Firewall detections and 5 hunting queries add entity mappings, custom details, and query optimizations to reduce false positives and improve incident context.Teams Social Engineering Detection: New Hunting Queries for RMM-Based Attackshttp://sentinelchangelog.net/posts/2026-05-04-pr-14117/Mon, 04 May 2026 12:53:39 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14117/Two new hunting queries detect Teams phishing campaigns that lure victims into launching remote access tools, addressing the Storm-1811 / Black Basta cross-tenant attack pattern.Azure DevOps Auditing: Fixing Broken Connector After Parameter Mismatchhttp://sentinelchangelog.net/posts/2026-05-04-pr-14090/Mon, 04 May 2026 06:56:16 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14090/Critical configuration fix resolves parameter name mismatch that prevented Azure DevOps audit log ingestion entirely.Entra ID Brute Force Detection: Renamed for Broader Windows Device Coveragehttp://sentinelchangelog.net/posts/2026-04-30-pr-14162/Thu, 30 Apr 2026 11:04:41 +0000http://sentinelchangelog.net/posts/2026-04-30-pr-14162/Analytic rule renamed from Cloud PC-specific to cover all Entra-authenticated Windows devices, clarifying detection scope without logic changes.ASIM Process Event Parsers: Parameter Standardization Fixes Filtering Logic Inconsistencieshttp://sentinelchangelog.net/posts/2026-04-17-pr-13932/Fri, 17 Apr 2026 23:03:12 +0000http://sentinelchangelog.net/posts/2026-04-17-pr-13932/ASIM Process Event parser parameter names corrected to match documentation, fixing filtering logic discrepancies that could affect query performance and parser interoperability.Global Secure Access: Threat Intelligence Detection Restored After URL Regex Failurehttp://sentinelchangelog.net/posts/2026-04-16-pr-14052/Thu, 16 Apr 2026 12:15:17 +0000http://sentinelchangelog.net/posts/2026-04-16-pr-14052/Fixed broken URL threat intelligence detection and expanded workbook coverage for new Entra traffic type.Microsoft Entra ID Conditional Access Bypass Detection: False Positive Reduction via Benign Status Code Watchlisthttp://sentinelchangelog.net/posts/2026-04-14-pr-14016/Tue, 14 Apr 2026 10:34:59 +0000http://sentinelchangelog.net/posts/2026-04-14-pr-14016/New watchlist filters out 7 known-benign status codes from Conditional Access bypass detection to reduce false positives from legitimate MFA prompts and session expiration events.Azure Security Benchmark Workbook: Parameter Filtering Logic Fixedhttp://sentinelchangelog.net/posts/2026-04-13-pr-14039/Mon, 13 Apr 2026 13:36:42 +0000http://sentinelchangelog.net/posts/2026-04-13-pr-14039/KQL queries in the Azure Security Benchmark workbook now properly filter by selected compliance domains.Microsoft Entra ID: Account Creation/Deletion Detection Enhanced Against Timing Evasionhttp://sentinelchangelog.net/posts/2026-04-13-pr-14049/Mon, 13 Apr 2026 10:07:13 +0000http://sentinelchangelog.net/posts/2026-04-13-pr-14049/Critical improvements to AccountCreatedandDeletedinShortTimeframe rule extend detection window to 7 days and use immutable UserID correlation to prevent timing-based evasion techniques.Azure Security Benchmark: Updated Labels to Microsoft Cloud Security Benchmarkhttp://sentinelchangelog.net/posts/2026-04-10-pr-14007/Fri, 10 Apr 2026 07:24:24 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-14007/Replaced “Azure Security Benchmark” references with “Microsoft cloud security benchmark” across workbook labels and KQL queries.ASIM AlertEvent Parser: Microsoft Defender XDR Missing AlertOriginalStatus Field Restoredhttp://sentinelchangelog.net/posts/2026-04-02-pr-13970/Thu, 02 Apr 2026 16:47:47 +0000http://sentinelchangelog.net/posts/2026-04-02-pr-13970/Critical data fidelity fix restores missing AlertOriginalStatus field in Microsoft Defender XDR ASIM AlertEvent parser, resolving alert status visibility gap.Microsoft Security Copilot Solution Released to General Availabilityhttp://sentinelchangelog.net/posts/2026-04-02-pr-13976/Thu, 02 Apr 2026 10:15:51 +0000http://sentinelchangelog.net/posts/2026-04-02-pr-13976/Microsoft Security Copilot solution v3.0.2 transitions from preview to GA with connector availability status updated.Microsoft A365 Observability Connector: Explicit SecurityAdmin Requirement Removedhttp://sentinelchangelog.net/posts/2026-04-01-pr-13956/Wed, 01 Apr 2026 05:30:21 +0000http://sentinelchangelog.net/posts/2026-04-01-pr-13956/Microsoft removed the explicit SecurityAdmin requirement from the A365 Observability connector, but GlobalAdmin — the highest privilege level in Azure AD — is still required. This is not a reduction in required privilege.Microsoft Security Copilot: Six New Detections for AI Assistant Abusehttp://sentinelchangelog.net/posts/2026-03-27-pr-13735/Fri, 27 Mar 2026 05:01:42 +0000http://sentinelchangelog.net/posts/2026-03-27-pr-13735/New analytic rules target jailbreak attempts, external access, plugin tampering, and file upload disabling - covering major AI security attack vectors.Microsoft Copilot Connector: Updated Product Scope Descriptionhttp://sentinelchangelog.net/posts/2026-03-20-pr-13842/Fri, 20 Mar 2026 07:56:13 +0000http://sentinelchangelog.net/posts/2026-03-20-pr-13842/Clarifies connector description to specify M365 Copilot and Security Copilot coverage alongside general improvements.A365 Observability Connector: New AI Agent Telemetry Visibility in Microsoft Sentinelhttp://sentinelchangelog.net/posts/2026-03-17-pr-13715/Tue, 17 Mar 2026 07:07:30 +0000http://sentinelchangelog.net/posts/2026-03-17-pr-13715/New data connector for AI agent behavior monitoring brings telemetry from A365, AI Foundry, and Copilot into Microsoft Sentinel for security investigations.Microsoft Entra ID Assets: Device and Organizational Contact Visibility Expansionhttp://sentinelchangelog.net/posts/2026-03-11-pr-13766/Wed, 11 Mar 2026 05:07:17 +0000http://sentinelchangelog.net/posts/2026-03-11-pr-13766/Two new asset tables (EntraDevices, EntraOrgContacts) added to Microsoft Entra ID connector for BloodHound graph building and complete asset enumeration.Azure DevOps Auditing Solution: Description Text Cleanup and Repackaginghttp://sentinelchangelog.net/posts/2026-01-22-pr-13488/Thu, 22 Jan 2026 11:11:47 +0000http://sentinelchangelog.net/posts/2026-01-22-pr-13488/Azure DevOps Auditing solution repackaged with updated description removing outdated streaming configuration text references.Microsoft Defender XDR: SUNSPOT Detection Rule Documentation Updatehttp://sentinelchangelog.net/posts/2026-01-22-pr-13485/Thu, 22 Jan 2026 11:09:59 +0000http://sentinelchangelog.net/posts/2026-01-22-pr-13485/Updated SUNSPOT malware detection rule with corrected reference link formatting and MITRE technique mapping fixes across multiple solutions.Microsoft Defender XDR: Teams Hunting Queries Version Number Fixhttp://sentinelchangelog.net/posts/2026-01-22-pr-13205/Thu, 22 Jan 2026 06:09:17 +0000http://sentinelchangelog.net/posts/2026-01-22-pr-13205/Corrected malformed version numbers in Microsoft Teams threat hunting queries from invalid “l.0.0” to proper “1.0.0” format.Multi-Solution Link Updates: MITRE Technique Corrections and Reference Refresheshttp://sentinelchangelog.net/posts/2026-01-21-pr-13480/Wed, 21 Jan 2026 13:39:25 +0000http://sentinelchangelog.net/posts/2026-01-21-pr-13480/Updated outdated links and corrected MITRE ATT&CK technique mapping in detection rules across Microsoft Business Applications, Microsoft Defender XDR, and Windows Security Events solutions.Microsoft Copilot Connector — Critical Table Name Update from LLMActivity to CopilotActivityhttp://sentinelchangelog.net/posts/2025-12-16-pr-13272/Tue, 16 Dec 2025 04:58:57 +0000http://sentinelchangelog.net/posts/2025-12-16-pr-13272/Microsoft Copilot connector fixes critical table reference issue, standardizing on official CopilotActivity table name across all components.ASIM Authentication Parsers: Hostname Resolution and Alias Fixeshttp://sentinelchangelog.net/posts/2025-12-03-pr-13232/Wed, 03 Dec 2025 21:11:29 +0000http://sentinelchangelog.net/posts/2025-12-03-pr-13232/Fixes SrcHostname resolution logic and IpAddr aliases in Microsoft Windows Event and SSH authentication parsers.