TLDR Tech / InfoSec
The Blind Spot in the Watchtower: Detections for When Someone Attacks Your Sentinel
Attackers can sabotage Microsoft Sentinel by altering detection rules, disabling data connectors, or modifying log retention to obstruct visibility, effectively using the SIEM's own infrastructure to hide malicious activity. Defenders can detect such tampering by monitoring AzureActivity, SentinelAudit, and SentinelHealth logs with targeted KQL queries that flag unauthorized changes to Sentinel configurations. Implement continuous monitoring of these logs and establish alerting on anomalous administrative actions to harden the SIEM against insider or elevated-threat abuse.
Read the full story