T1566 on sentinelchangelog.nethttp://sentinelchangelog.net/tags/t1566/Recent content in T1566 on sentinelchangelog.netHugo -- 0.157.0enFri, 10 Jul 2026 09:21:28 +0000Okta SSO Detection Suite: Richer Alert Context, Configurable Thresholds, and Corrected Entity Mappings Across 9 Rules and 10 Hunting Querieshttp://sentinelchangelog.net/posts/2026-07-10-pr-14498/Fri, 10 Jul 2026 09:21:28 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14498/Nine Analytic Rules and ten Hunting Queries for Okta SSO have been overhauled with configurable thresholds, allowlist variables, improved JSON parsing, and corrected entity mappings, closing fidelity gaps that degraded Sentinel entity behaviour and alert context.Abnormal Security Solution: Full Detection Coverage Added for CCF Push Connector (v3.1.0)http://sentinelchangelog.net/posts/2026-07-01-pr-14419/Wed, 01 Jul 2026 07:53:17 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14419/The Abnormal Security solution now ships four scheduled Analytic Rules, four Hunting Queries, four parsers, a workbook, and a Playbook — closing a complete detection gap that existed since the CCF Push connector was introduced in v3.0.0 with no bundled detections.New Solution: Vaikora for O365 Brings CTASD-Powered Phishing Quarantine Telemetry into Microsoft Sentinelhttp://sentinelchangelog.net/posts/2026-06-25-pr-14289/Thu, 25 Jun 2026 11:56:08 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14289/A brand-new Sentinel solution for Vaikora for O365 (by Data443) adds three Analytic Rules over the VaikoraO365_Quarantine_CL custom table – covering high-confidence phishing/suspected quarantine events, abnormal quarantine volume spikes, and engine-offline detection – plus an incident-response Playbook and a quarantine dashboard Workbook.Microsoft Defender XDR: Email Hunting Queries Fixed to Reference Correct Connector, Three New Teams/Phish Queries Addedhttp://sentinelchangelog.net/posts/2026-06-23-pr-14537/Tue, 23 Jun 2026 05:40:00 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14537/Three email-focused Hunting Queries had a broken connector reference (OfficeATP instead of MicrosoftThreatProtection), suppressing results for orgs using the Defender XDR connector; three new queries covering RMM-via-Teams, alert correlation with Teams messages, and phish-reporter identity are also added.Google Threat Intelligence: New GTI Relevance System Alerts Connector and Six Bundled Detectionshttp://sentinelchangelog.net/posts/2026-06-19-pr-14415/Fri, 19 Jun 2026 11:27:14 +0000http://sentinelchangelog.net/posts/2026-06-19-pr-14415/A new Function App-based data connector ingests Google Threat Intelligence Relevance System Alerts into Sentinel, unlocking six new Analytic Rules that fire on high-severity, data-leak, initial access broker, and insider threat alert categories surfaced by the GTI platform.Microsoft Defender XDR: OAuth and Device-Code Phishing Hunting Queries Unblocked After ARM-TTK Pipeline Failurehttp://sentinelchangelog.net/posts/2026-06-18-pr-14472/Thu, 18 Jun 2026 05:58:50 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14472/Two Defender XDR hunting queries targeting OAuth consent and device-code phishing were blocked from pipeline validation due to ARM-TTK hardcoded URI false positives; KQL refactored to construct URLs via strcat(), restoring deployment and preserving detection semantics.Google SecOps Integration: New Detection Pipeline Connects Chronicle to Sentinelhttp://sentinelchangelog.net/posts/2026-06-12-pr-14200/Fri, 12 Jun 2026 07:00:27 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14200/Microsoft Sentinel gains visibility into Google Chronicle security detections through new connector and parsers.Slack Audit Solution: Enhanced Detection Logic and Alert Enrichmenthttp://sentinelchangelog.net/posts/2026-06-01-pr-14245/Mon, 01 Jun 2026 04:39:34 +0000http://sentinelchangelog.net/posts/2026-06-01-pr-14245/Slack Audit analytic rules, hunting queries, and workbook upgraded with improved KQL logic, custom alert details, and enhanced entity mappings for stronger workspace monitoring.Phishing Detection: Raw IP URLs in Delivered Emailhttp://sentinelchangelog.net/posts/2026-05-26-pr-14340/Tue, 26 May 2026 06:30:21 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14340/New hunting query identifies delivered emails using raw IPv4 addresses as URL domains to detect phishing campaigns bypassing domain reputation systems.Microsoft Defender XDR: New Hunting Query for Delegate Mailbox Phish Reporting Analysishttp://sentinelchangelog.net/posts/2026-05-21-pr-14257/Thu, 21 May 2026 04:14:42 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14257/New hunting query helps identify the actual user who reported a phishing message when recipients and actors differ in delegate or shared mailbox scenarios.Microsoft Entra ID Table Rename: Hunting Queries Updated for Current Schemahttp://sentinelchangelog.net/posts/2026-05-18-pr-14186/Mon, 18 May 2026 05:36:36 +0000http://sentinelchangelog.net/posts/2026-05-18-pr-14186/12 hunting queries updated to use EntraIdSignInEvents and EntraIdSpnSignInEvents tables, replacing deprecated AADSignInEventsBeta and AADSpnSignInEventsBeta references.Red Sift Solution: New CCF Data Connector and Email Security Detectionshttp://sentinelchangelog.net/posts/2026-05-14-pr-14036/Thu, 14 May 2026 10:01:32 +0000http://sentinelchangelog.net/posts/2026-05-14-pr-14036/Red Sift adds CCF-based email and authentication monitoring with 5 detection rules for phishing and account compromise scenarios.Teams Social Engineering Detection: New Hunting Queries for RMM-Based Attackshttp://sentinelchangelog.net/posts/2026-05-04-pr-14117/Mon, 04 May 2026 12:53:39 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14117/Two new hunting queries detect Teams phishing campaigns that lure victims into launching remote access tools, addressing the Storm-1811 / Black Basta cross-tenant attack pattern.Valimail Enforce Solution: New Email Authentication Monitoring for DMARC/SPF/DKIM Configuration Changeshttp://sentinelchangelog.net/posts/2026-04-24-pr-14045/Fri, 24 Apr 2026 05:26:39 +0000http://sentinelchangelog.net/posts/2026-04-24-pr-14045/Complete Valimail Enforce monitoring solution delivers real-time detection of email authentication policy weakening and suspicious admin activity affecting domain security posture.Microsoft Sentinel Training Lab: Comprehensive Hands-On Security Operations Environment Now Availablehttp://sentinelchangelog.net/posts/2026-04-10-pr-13848/Fri, 10 Apr 2026 15:05:24 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-13848/New deployment-ready training lab delivers 14 guided exercises with pre-recorded telemetry, detection rules, and automation workflows for practical Microsoft Sentinel skill development.Visa Threat Intelligence Solution: Initial Package Release with IOC Detection Ruleshttp://sentinelchangelog.net/posts/2026-02-13-pr-13616/Fri, 13 Feb 2026 21:02:02 +0000http://sentinelchangelog.net/posts/2026-02-13-pr-13616/New Visa Threat Intelligence (VTI) solution providing IOC feeds via DCR connector with high-severity detection rules for domains and file hashes.Microsoft Defender XDR: New Hunting Query for Punycode Lookalike Domain Phishinghttp://sentinelchangelog.net/posts/2026-02-03-pr-13535/Tue, 03 Feb 2026 09:48:09 +0000http://sentinelchangelog.net/posts/2026-02-03-pr-13535/Advanced hunting query detects punycode domains using Cyrillic, Greek, and fullwidth ASCII characters to visually impersonate legitimate domains in email and Teams.Google Threat Intelligence: Enhanced Threat Hunting with MITRE ATT&CK Integrationhttp://sentinelchangelog.net/posts/2025-12-04-pr-13198/Thu, 04 Dec 2025 05:49:38 +0000http://sentinelchangelog.net/posts/2025-12-04-pr-13198/Updated threat hunting rules add MITRE ATT&CK mappings and fix parser function calls for improved threat detection coverage.Microsoft Teams Security: 9 Additional Hunting Queries for Advanced Threat Detectionhttp://sentinelchangelog.net/posts/2025-11-21-pr-13167/Fri, 21 Nov 2025 05:16:08 +0000http://sentinelchangelog.net/posts/2025-11-21-pr-13167/Extended Teams protection hunting coverage with queries for partner impersonation, admin submissions, and external sender analysis.Microsoft Teams Security: 7 New Hunting Queries for URL Threat Detectionhttp://sentinelchangelog.net/posts/2025-11-19-pr-13156/Wed, 19 Nov 2025 08:50:58 +0000http://sentinelchangelog.net/posts/2025-11-19-pr-13156/New hunting queries added to detect malicious URL clicks, ZAP events, and user submissions in Microsoft Teams.VMware ESXi SSH Brute Force Detection Plus Multi-Solution Updateshttp://sentinelchangelog.net/posts/2025-11-10-pr-13063/Mon, 10 Nov 2025 06:23:07 +0000http://sentinelchangelog.net/posts/2025-11-10-pr-13063/New VMware ESXi detection for multiple failed SSH login attempts, plus comprehensive solution updates across 15+ vendor solutions.Threat Intelligence Detection: Critical Timing Fix for Cloud App Email Indicatorshttp://sentinelchangelog.net/posts/2025-11-07-pr-13091/Fri, 07 Nov 2025 12:06:34 +0000http://sentinelchangelog.net/posts/2025-11-07-pr-13091/TI analytic rule query periods reduced from 10 days to 1 hour to prevent false negatives from timing mismatches.