Note: Please refer to the following before installing the solution:

• Review the solution Release Notes

• There may be known issues pertaining to this Solution, please refer to them before installing.

The Attacker Tools Threat Protection Essentials solution contains security content that is relevant for detection of tools commonly used by attackers in various campaigns. These tools can be commercial, open-source, built-in or publicly available and have historically been seen used by adversaries in different phases of the ATTACK kill chain.

Pre-requisites:

This is a domain solution and does not include any data connectors. The content in this solution supports the connectors listed below. Install one or more of the listed solutions, to unlock the value provided by this solution.

Windows Security Events
Windows Server DNS
Windows Forwarded Events
Microsoft Entra ID

Keywords: attack tools, penetration testing, Impacket, Powercat, Nishang, Cobalt Strike, ADFind, Credential Dumping, PowerShell Empire

Analytic Rules: 4, Hunting Queries: 2

Learn more about Microsoft Sentinel | Learn more about Solutions

Attacker Tools Threat Protection EssentialsMicrosoft Sentinel, Microsoft Corporation

Attacker Tools Threat Protection Essentials

Microsoft Sentinel, Microsoft Corporation

Attacker Tools Threat Protection Essentials

Microsoft Sentinel, Microsoft Corporation

Attacker Tools Threat Protection Essentials
Microsoft Sentinel, Microsoft Corporation