Skip to content

Commit 5b043a2

Browse files
v-sudkharatv-sudkharat
committed
Merge branch 'master' into v-sudkharat/DraftPR-ASIMCiscoMeraki
2 parents 2a223db + b851d98 commit 5b043a2

File tree

72 files changed

+3309
-235
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+3309
-235
lines changed

‎.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,34 @@
11
[
2+
{
3+
"id": "e8394afb-82a7-4718-8d31-cc57ad352fa8",
4+
"templateName": "SAPLogServ-AuditTrailPolicyChanges.yaml",
5+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
6+
},
7+
{
8+
"id": "a9e4b02a-5a8c-4c59-9836-a204d1028632",
9+
"templateName": "SAPLogServ-UserAdminActions.yaml",
10+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
11+
},
12+
{
13+
"id": "8fb9fb88-693f-4906-8be2-4bb9771418fc",
14+
"templateName": "SAPLogServ-DeactivationofAuditTrail.yaml",
15+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
16+
},
17+
{
18+
"id": "4981469b-8618-43a7-b44c-5744594fa494",
19+
"templateName": "SAPLogServ-AssignAdminAuthorizations.yaml",
20+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
21+
},
222
{
323
"id": "5dd72ebe-03ac-43ac-851b-68cfe5106e4f",
424
"templateName": "SAPETD-LoginFromUnexpectedNetwork.yaml",
525
"validationFailReason": "The name 'Network' does not refer to any known column, table, variable or function. The name 'geo_info_from_ip_address' does not refer to any known function."
626
},
27+
{
28+
"id": "c6111e06-11e2-45eb-86ef-28313a06db35",
29+
"templateName": "SAPETD-ExecutionofSensitiveFunctionModule.yaml",
30+
"validationFailReason": "The name 'FunctionModule' does not refer to any known column, table, variable or function."
31+
},
732
{
833
"id": "ef895ada-e8e8-4cf0-9313-b1ab67fab69f",
934
"templateName": "AuthenticationAttemptfromNewCountry.yaml",

‎DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ function Get-CloudTrailKmsPolicy {
1212
'Principal' = @{
1313
'Service' = 'cloudtrail.amazonaws.com';
1414
};
15-
'Action' = 'kms=GenerateDataKey*';
15+
'Action' = 'kms:GenerateDataKey*';
1616
'Resource' = '*';
1717
},
1818
@{
@@ -22,7 +22,7 @@ function Get-CloudTrailKmsPolicy {
2222
'AWS' = @("${roleArn}");
2323
};
2424
'Action' = @(
25-
'kms=Decrypt'
25+
'kms:Decrypt'
2626
);
2727
'Resource' = '*';
2828
}

‎Detections/ASimWebSession/UnusualUAPowershell.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,13 @@ entityMappings:
6060

6161
alertDetailsOverride:
6262
alertDisplayNameFormat: 'Host {{SrcIpAddr}} is potentially running PowerShell'
63-
alertDescriptionFormat: 'The host at address {{SrcIpAddr}} sent an HTTP request to the URL {{Url}} with the HTTP user agent header {{HttpUserAgent}}. This user agent is known to be used by PoerShell and indicates suspicious activity on the host.'
63+
alertDescriptionFormat: 'The host at address {{SrcIpAddr}} sent an HTTP request to the URL {{Url}} with the HTTP user agent header {{HttpUserAgent}}. This user agent is known to be used by PowerShell and indicates suspicious activity on the host.'
6464
customDetails:
6565
UserAgent: HttpUserAgent
6666

6767
eventGroupingSettings:
6868
aggregationKind: AlertPerResult
69-
version: 1.1.4
69+
version: 1.1.5
7070
kind: Scheduled
7171
metadata:
7272
source:

‎Hunting Queries/Microsoft 365 Defender/Email Queries/General/Top 10 External Senders (Spam).yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
id: 86c7d21b-2081-419d-bc2e-7bc909d61eef
1+
id: debd82cc-2507-4c93-bd0a-a58926fc6d3a
22
name: Top 10 External Senders (Spam)
33
description: |
44
Identifies the top 10 external sender addresses delivering inbound emails classified as spam.

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Blocked Clicks Trend.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: ac738108-451b-4341-ba38-021a00665415
2+
name: Blocked Clicks Trend
3+
description: |
4+
Visualises the trend of malicious URL clicks that were blocked by Safe Links over the past 30 days, helping analysts monitor the effectiveness of click protection policies.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
let TimeStart = startofday(ago(30d));
16+
let TimeEnd = startofday(now());
17+
UrlClickEvents
18+
| where TimeGenerated >= TimeStart
19+
| where ActionType == "ClickBlocked"
20+
| make-series BlockedClicks = count() default = 0 on TimeGenerated from TimeStart to TimeEnd step 1d
21+
| render timechart
22+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Malicious Clicks allowed (click-through).yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: ba4f7e56-a2f8-4a30-b848-200fdc7fc3a2
2+
name: Malicious Clicks allowed (click-through)
3+
description: |
4+
Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
let TimeStart = startofday(ago(30d));
16+
let TimeEnd = startofday(now());
17+
UrlClickEvents
18+
| where TimeGenerated >= TimeStart
19+
| where IsClickedThrough == 1
20+
| where isnotempty(ThreatTypes)
21+
| make-series Count = count() default = 0 on TimeGenerated from TimeStart to TimeEnd step 1d
22+
| render timechart
23+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Malicious Emails with QR code Urls.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: 13260191-fb10-4a36-9ca1-2bbc0aaf77d0
2+
name: Malicious Emails with QR code Urls
3+
description: |
4+
Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- EmailUrlInfo
10+
- EmailEvents
11+
tactics:
12+
- InitialAccess
13+
relevantTechniques:
14+
- T1566
15+
query: |
16+
EmailUrlInfo
17+
| where UrlLocation == "QRCode"
18+
| join kind=inner (
19+
EmailEvents
20+
| where isnotempty(ThreatTypes)
21+
| project NetworkMessageId, ThreatTypes
22+
) on NetworkMessageId
23+
| summarize count() by ThreatTypes
24+
| render piechart
25+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Malicious URL Clicks by workload.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: c2b4ef3a-216d-4506-8b35-6a1b0f2a3bf7
2+
name: Malicious URL Clicks by workload
3+
description: |
4+
Visualises click attempts on malicious URLs, grouped by workload (such as Exchange, Teams, SharePoint, Copilot etc.), to help analysts understand which workloads are most targeted.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
UrlClickEvents
16+
| where isnotempty(ThreatTypes)
17+
| summarize count() by Workload
18+
| render piechart
19+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Top 10 Users clicking on Malicious URLs (Malware).yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: 5a84e13a-bb17-4124-9564-d74cdb84c124
2+
name: Top 10 Users clicking on Malicious URLs (Malware)
3+
description: |
4+
Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
UrlClickEvents
16+
| where ThreatTypes == "Malware"
17+
| summarize count() by AccountUpn
18+
| top 10 by count_
19+
| render piechart
20+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Top 10 Users clicking on Malicious URLs (Phish).yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: a937905e-ee5c-406c-ab86-8e2581240112
2+
name: Top 10 Users clicking on Malicious URLs (Phish)
3+
description: |
4+
Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
UrlClickEvents
16+
| where ThreatTypes == "Phish"
17+
| summarize count() by AccountUpn
18+
| top 10 by count_
19+
| render piechart
20+
version: 1.0.0

0 commit comments

Comments
 (0)