Addition of Sentinel analytics rule for Network firewall logs and proxy server logs

[Rajaravi99]

Detection Rule Proposal

Summary

I wanted to suggest few good threat detection rule logics for on-premises firewall and proxy server logs.

---

Threat Scenario

Here are specific attack scenarios detected using these logs:

• Malware and Command & Control (C2) Activity
• Data Exfiltration
• Privilege Escalation and Unauthorized Access
• Insider Threats and Compliance Issues

---

Data Sources Required

• commonsecuritylogs
• Signinlogs
• Azureactivitylogs

---

Status

• Detection logic drafted
• KQL tested in Sentinel
• Ready to submit PR if approved

---

Additional Context

I am happy to implement this rule as a PR including:

• KQL query
• Metadata (severity, tactics, techniques)
• ARM/YAML format as per repo standards

[0xAnalyst]

@Rajaravi99 Gor for it but follow the format I use for documentation and put yourself as the autheor and I will approve

[Rajaravi99]

@0xAnalyst Thanks for the update. I will document the detections and create a pull request for review ASAP.

[0xAnalyst]

@Rajaravi99 just take one of the documentation and use it as a template with AI to document the same way also use .md file as well so that it can be parsed by various tools

[Rajaravi99]

@0xAnalyst yes sure, I will do as directed. Thanks

[Rajaravi99]

Hi @0xAnalyst I have raised PR, please review and do let me know if any changes needs to be done. I have tried to follow the documentation as much as possible.