T1078 on sentinelchangelog.nethttp://sentinelchangelog.net/tags/t1078/Recent content in T1078 on sentinelchangelog.netHugo -- 0.157.0enFri, 10 Jul 2026 09:21:28 +0000Okta SSO Detection Suite: Richer Alert Context, Configurable Thresholds, and Corrected Entity Mappings Across 9 Rules and 10 Hunting Querieshttp://sentinelchangelog.net/posts/2026-07-10-pr-14498/Fri, 10 Jul 2026 09:21:28 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14498/Nine Analytic Rules and ten Hunting Queries for Okta SSO have been overhauled with configurable thresholds, allowlist variables, improved JSON parsing, and corrected entity mappings, closing fidelity gaps that degraded Sentinel entity behaviour and alert context.New Netskope Alerts and Events Solution: DLP, Shadow IT, and Malware Threat Visibility via CCF Blob Storage Connectorhttp://sentinelchangelog.net/posts/2026-07-10-pr-14560/Fri, 10 Jul 2026 06:05:09 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14560/A new Microsoft Sentinel solution delivers full-stack Netskope Security Cloud visibility including DLP incidents, malware detections, policy enforcement, and Shadow IT via a CCF Blob Storage connector ingesting gzip-compressed positional CSV into a 254-column custom table.AI Agents Hunting Queries Migrated to Unified AgentsInfo Table -- Connector-Split Queries Retiredhttp://sentinelchangelog.net/posts/2026-07-02-pr-14594/Thu, 02 Jul 2026 10:38:59 +0000http://sentinelchangelog.net/posts/2026-07-02-pr-14594/Seven consolidated AI agent hunting queries now target the unified Defender XDR AgentsInfo table, replacing 26 connector-specific queries split across the A365 and Copilot Studio connectors; existing deployments still running the old AIAgentsInfo-based queries have had no effective hunting coverage since the table split was introduced.Abnormal Security Solution: Full Detection Coverage Added for CCF Push Connector (v3.1.0)http://sentinelchangelog.net/posts/2026-07-01-pr-14419/Wed, 01 Jul 2026 07:53:17 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14419/The Abnormal Security solution now ships four scheduled Analytic Rules, four Hunting Queries, four parsers, a workbook, and a Playbook — closing a complete detection gap that existed since the CCF Push connector was introduced in v3.0.0 with no bundled detections.New Solution: Hybrid Attack Chain Hunting Across On-Premises, Cloud, and Kuberneteshttp://sentinelchangelog.net/posts/2026-06-29-pr-14427/Mon, 29 Jun 2026 04:21:48 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14427/A new Microsoft Sentinel Solution ships 55+ multi-stage hunting queries designed to detect attacker pivots across on-premises identity, Azure control plane, Kubernetes, and Microsoft Entra ID – covering full kill chains that individual, single-source detections routinely miss.Microsoft Defender XDR: Email Hunting Queries Fixed to Reference Correct Connector, Three New Teams/Phish Queries Addedhttp://sentinelchangelog.net/posts/2026-06-23-pr-14537/Tue, 23 Jun 2026 05:40:00 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14537/Three email-focused Hunting Queries had a broken connector reference (OfficeATP instead of MicrosoftThreatProtection), suppressing results for orgs using the Defender XDR connector; three new queries covering RMM-via-Teams, alert correlation with Teams messages, and phish-reporter identity are also added.Google Threat Intelligence: New GTI Relevance System Alerts Connector and Six Bundled Detectionshttp://sentinelchangelog.net/posts/2026-06-19-pr-14415/Fri, 19 Jun 2026 11:27:14 +0000http://sentinelchangelog.net/posts/2026-06-19-pr-14415/A new Function App-based data connector ingests Google Threat Intelligence Relevance System Alerts into Sentinel, unlocking six new Analytic Rules that fire on high-severity, data-leak, initial access broker, and insider threat alert categories surfaced by the GTI platform.New eDCRule Solution: 10 Entra ID and Azure Subscription Analytic Rules for Privilege Escalation and Identity Abuse Detectionhttp://sentinelchangelog.net/posts/2026-06-17-pr-14392/Wed, 17 Jun 2026 05:44:03 +0000http://sentinelchangelog.net/posts/2026-06-17-pr-14392/A new community solution adds 10 scheduled Analytic Rules (plus Chinese-localized counterparts) targeting Microsoft Entra ID privilege escalation, OAuth token abuse, federation trust tampering, and Azure VM Run Command abuse correlated with UEBA signals.Utimaco ESKM Integration: Enterprise Key Management Monitoring Arrives in Sentinelhttp://sentinelchangelog.net/posts/2026-06-12-pr-14306/Fri, 12 Jun 2026 07:51:50 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14306/New solution enables Microsoft Sentinel monitoring of Utimaco Enterprise Secure Key Manager KMIP operations and authentication events.Google SecOps Integration: New Detection Pipeline Connects Chronicle to Sentinelhttp://sentinelchangelog.net/posts/2026-06-12-pr-14200/Fri, 12 Jun 2026 07:00:27 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14200/Microsoft Sentinel gains visibility into Google Chronicle security detections through new connector and parsers.StealthTalk: New Enterprise Authentication Monitoring Solution with MITRE-Mapped Detection Portfoliohttp://sentinelchangelog.net/posts/2026-06-10-pr-14259/Wed, 10 Jun 2026 10:24:48 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14259/Complete StealthTalk Enterprise solution delivers four analytic rules targeting credential attacks (T1078, T1110, T1098) plus ASIM Authentication parsers and Teams integration.Slack Audit Solution: Enhanced Detection Logic and Alert Enrichmenthttp://sentinelchangelog.net/posts/2026-06-01-pr-14245/Mon, 01 Jun 2026 04:39:34 +0000http://sentinelchangelog.net/posts/2026-06-01-pr-14245/Slack Audit analytic rules, hunting queries, and workbook upgraded with improved KQL logic, custom alert details, and enhanced entity mappings for stronger workspace monitoring.Microsoft Entra ID OAuth Consent Query: Fixing Zero-Result Bug in High-Risk Permission Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14334/Wed, 27 May 2026 13:38:30 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14334/Corrects broken hunting query that returned no results due to incorrect property name filter.AWS Content Quality Overhaul: Standardized Detection Rules and Improved Entity Mappingshttp://sentinelchangelog.net/posts/2026-05-18-pr-14101/Mon, 18 May 2026 07:30:57 +0000http://sentinelchangelog.net/posts/2026-05-18-pr-14101/Comprehensive quality improvements to 61 AWS Analytic Rules and 35 Hunting Queries with standardized naming conventions, normalized MITRE technique mappings, and updated entity field references from legacy AccountCustomEntity to UserIdentityUserName.Red Sift Solution: New CCF Data Connector and Email Security Detectionshttp://sentinelchangelog.net/posts/2026-05-14-pr-14036/Thu, 14 May 2026 10:01:32 +0000http://sentinelchangelog.net/posts/2026-05-14-pr-14036/Red Sift adds CCF-based email and authentication monitoring with 5 detection rules for phishing and account compromise scenarios.Microsoft Entra ID: Hunting Query for Password Spraying Detection via IP Failure Burstshttp://sentinelchangelog.net/posts/2026-05-07-pr-14208/Thu, 07 May 2026 10:50:43 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14208/Correlates failed sign-ins across multiple identities followed by successful authentication from the same IP within 15 minutes, targeting password spraying patterns.Teams Social Engineering Detection: New Hunting Queries for RMM-Based Attackshttp://sentinelchangelog.net/posts/2026-05-04-pr-14117/Mon, 04 May 2026 12:53:39 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14117/Two new hunting queries detect Teams phishing campaigns that lure victims into launching remote access tools, addressing the Storm-1811 / Black Basta cross-tenant attack pattern.Valimail Enforce Solution: New Email Authentication Monitoring for DMARC/SPF/DKIM Configuration Changeshttp://sentinelchangelog.net/posts/2026-04-24-pr-14045/Fri, 24 Apr 2026 05:26:39 +0000http://sentinelchangelog.net/posts/2026-04-24-pr-14045/Complete Valimail Enforce monitoring solution delivers real-time detection of email authentication policy weakening and suspicious admin activity affecting domain security posture.SOCRadar XTI Platform: New Extended Threat Intelligence Solution Launches with Bidirectional Synchttp://sentinelchangelog.net/posts/2026-04-23-pr-13858/Thu, 23 Apr 2026 05:24:37 +0000http://sentinelchangelog.net/posts/2026-04-23-pr-13858/SOCRadar XTI Platform solution now available in Content Hub with automated alarm import, incident sync, and comprehensive threat intelligence monitoring capabilities.Microsoft Entra ID: Account Creation/Deletion Detection Enhanced Against Timing Evasionhttp://sentinelchangelog.net/posts/2026-04-13-pr-14049/Mon, 13 Apr 2026 10:07:13 +0000http://sentinelchangelog.net/posts/2026-04-13-pr-14049/Critical improvements to AccountCreatedandDeletedinShortTimeframe rule extend detection window to 7 days and use immutable UserID correlation to prevent timing-based evasion techniques.Microsoft Sentinel Training Lab: Comprehensive Hands-On Security Operations Environment Now Availablehttp://sentinelchangelog.net/posts/2026-04-10-pr-13848/Fri, 10 Apr 2026 15:05:24 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-13848/New deployment-ready training lab delivers 14 guided exercises with pre-recorded telemetry, detection rules, and automation workflows for practical Microsoft Sentinel skill development.SOC Prime CCF: Three New Detection Rules for Platform Security Eventshttp://sentinelchangelog.net/posts/2026-04-08-pr-13636/Wed, 08 Apr 2026 09:50:43 +0000http://sentinelchangelog.net/posts/2026-04-08-pr-13636/SOC Prime solution adds Analytic Rules detecting platform administration events including tenant deletion and successful logins from malicious IPs.Netskope Secure Web Gateway Solution: New Detection Coverage for Cloud Application Visibilityhttp://sentinelchangelog.net/posts/2026-04-03-pr-13618/Fri, 03 Apr 2026 11:24:10 +0000http://sentinelchangelog.net/posts/2026-04-03-pr-13618/New Netskope solution adds 10 detections for web transaction monitoring including impossible travel, excessive downloads, shadow IT detection, and data exfiltration patterns.Microsoft Security Copilot: Six New Detections for AI Assistant Abusehttp://sentinelchangelog.net/posts/2026-03-27-pr-13735/Fri, 27 Mar 2026 05:01:42 +0000http://sentinelchangelog.net/posts/2026-03-27-pr-13735/New analytic rules target jailbreak attempts, external access, plugin tampering, and file upload disabling - covering major AI security attack vectors.Azure Firewall: Five New IDPS Analytic Rules for Advanced Threat Detectionhttp://sentinelchangelog.net/posts/2026-02-13-pr-13591/Fri, 13 Feb 2026 08:19:01 +0000http://sentinelchangelog.net/posts/2026-02-13-pr-13591/Azure Firewall solution expanded with 5 new analytic rules targeting high/medium severity threats, DDoS attacks, web application attacks, and privilege escalation attempts.Multi-Solution Link Updates: MITRE Technique Corrections and Reference Refresheshttp://sentinelchangelog.net/posts/2026-01-21-pr-13480/Wed, 21 Jan 2026 13:39:25 +0000http://sentinelchangelog.net/posts/2026-01-21-pr-13480/Updated outdated links and corrected MITRE ATT&CK technique mapping in detection rules across Microsoft Business Applications, Microsoft Defender XDR, and Windows Security Events solutions.SAP BTP: 10 New Enterprise Security Detections for Cloud Integration and Identity Servicehttp://sentinelchangelog.net/posts/2026-01-05-pr-13366/Mon, 05 Jan 2026 08:20:43 +0000http://sentinelchangelog.net/posts/2026-01-05-pr-13366/New threat detection coverage for SAP BTP Cloud Integration tampering, identity service compromise, and audit service availability.UEBA Essentials: Enhanced Multi-Cloud Detection with 6 New AWS, GCP & Okta Hunting Querieshttp://sentinelchangelog.net/posts/2025-11-12-pr-13065/Wed, 12 Nov 2025 11:17:58 +0000http://sentinelchangelog.net/posts/2025-11-12-pr-13065/Major update adds comprehensive multi-cloud anomaly detection capabilities across AWS, GCP, and Okta platforms with 6 new hunting queries.VMware ESXi SSH Brute Force Detection Plus Multi-Solution Updateshttp://sentinelchangelog.net/posts/2025-11-10-pr-13063/Mon, 10 Nov 2025 06:23:07 +0000http://sentinelchangelog.net/posts/2025-11-10-pr-13063/New VMware ESXi detection for multiple failed SSH login attempts, plus comprehensive solution updates across 15+ vendor solutions.