Skip to content

Commit 5f602ad

Browse files
vakohlvakohl
committed
Merge branch 'master' of https://github.com/Azure/Azure-Sentinel into BarracudaWAFWebSession
2 parents 38de696 + 347a62d commit 5f602ad

File tree

46 files changed

+1934
-106
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+1934
-106
lines changed

‎.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,34 @@
11
[
2+
{
3+
"id": "e8394afb-82a7-4718-8d31-cc57ad352fa8",
4+
"templateName": "SAPLogServ-AuditTrailPolicyChanges.yaml",
5+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
6+
},
7+
{
8+
"id": "a9e4b02a-5a8c-4c59-9836-a204d1028632",
9+
"templateName": "SAPLogServ-UserAdminActions.yaml",
10+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
11+
},
12+
{
13+
"id": "8fb9fb88-693f-4906-8be2-4bb9771418fc",
14+
"templateName": "SAPLogServ-DeactivationofAuditTrail.yaml",
15+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
16+
},
17+
{
18+
"id": "4981469b-8618-43a7-b44c-5744594fa494",
19+
"templateName": "SAPLogServ-AssignAdminAuthorizations.yaml",
20+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
21+
},
222
{
323
"id": "5dd72ebe-03ac-43ac-851b-68cfe5106e4f",
424
"templateName": "SAPETD-LoginFromUnexpectedNetwork.yaml",
525
"validationFailReason": "The name 'Network' does not refer to any known column, table, variable or function. The name 'geo_info_from_ip_address' does not refer to any known function."
626
},
27+
{
28+
"id": "c6111e06-11e2-45eb-86ef-28313a06db35",
29+
"templateName": "SAPETD-ExecutionofSensitiveFunctionModule.yaml",
30+
"validationFailReason": "The name 'FunctionModule' does not refer to any known column, table, variable or function."
31+
},
732
{
833
"id": "ef895ada-e8e8-4cf0-9313-b1ab67fab69f",
934
"templateName": "AuthenticationAttemptfromNewCountry.yaml",

‎Hunting Queries/Microsoft 365 Defender/Email Queries/General/Top 10 External Senders (Spam).yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
id: 86c7d21b-2081-419d-bc2e-7bc909d61eef
1+
id: debd82cc-2507-4c93-bd0a-a58926fc6d3a
22
name: Top 10 External Senders (Spam)
33
description: |
44
Identifies the top 10 external sender addresses delivering inbound emails classified as spam.

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Blocked Clicks Trend.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: ac738108-451b-4341-ba38-021a00665415
2+
name: Blocked Clicks Trend
3+
description: |
4+
Visualises the trend of malicious URL clicks that were blocked by Safe Links over the past 30 days, helping analysts monitor the effectiveness of click protection policies.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
let TimeStart = startofday(ago(30d));
16+
let TimeEnd = startofday(now());
17+
UrlClickEvents
18+
| where TimeGenerated >= TimeStart
19+
| where ActionType == "ClickBlocked"
20+
| make-series BlockedClicks = count() default = 0 on TimeGenerated from TimeStart to TimeEnd step 1d
21+
| render timechart
22+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Malicious Clicks allowed (click-through).yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: ba4f7e56-a2f8-4a30-b848-200fdc7fc3a2
2+
name: Malicious Clicks allowed (click-through)
3+
description: |
4+
Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
let TimeStart = startofday(ago(30d));
16+
let TimeEnd = startofday(now());
17+
UrlClickEvents
18+
| where TimeGenerated >= TimeStart
19+
| where IsClickedThrough == 1
20+
| where isnotempty(ThreatTypes)
21+
| make-series Count = count() default = 0 on TimeGenerated from TimeStart to TimeEnd step 1d
22+
| render timechart
23+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Malicious Emails with QR code Urls.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: 13260191-fb10-4a36-9ca1-2bbc0aaf77d0
2+
name: Malicious Emails with QR code Urls
3+
description: |
4+
Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- EmailUrlInfo
10+
- EmailEvents
11+
tactics:
12+
- InitialAccess
13+
relevantTechniques:
14+
- T1566
15+
query: |
16+
EmailUrlInfo
17+
| where UrlLocation == "QRCode"
18+
| join kind=inner (
19+
EmailEvents
20+
| where isnotempty(ThreatTypes)
21+
| project NetworkMessageId, ThreatTypes
22+
) on NetworkMessageId
23+
| summarize count() by ThreatTypes
24+
| render piechart
25+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Malicious URL Clicks by workload.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: c2b4ef3a-216d-4506-8b35-6a1b0f2a3bf7
2+
name: Malicious URL Clicks by workload
3+
description: |
4+
Visualises click attempts on malicious URLs, grouped by workload (such as Exchange, Teams, SharePoint, Copilot etc.), to help analysts understand which workloads are most targeted.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
UrlClickEvents
16+
| where isnotempty(ThreatTypes)
17+
| summarize count() by Workload
18+
| render piechart
19+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Top 10 Users clicking on Malicious URLs (Malware).yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: 5a84e13a-bb17-4124-9564-d74cdb84c124
2+
name: Top 10 Users clicking on Malicious URLs (Malware)
3+
description: |
4+
Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
UrlClickEvents
16+
| where ThreatTypes == "Malware"
17+
| summarize count() by AccountUpn
18+
| top 10 by count_
19+
| render piechart
20+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Top 10 Users clicking on Malicious URLs (Phish).yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: a937905e-ee5c-406c-ab86-8e2581240112
2+
name: Top 10 Users clicking on Malicious URLs (Phish)
3+
description: |
4+
Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
UrlClickEvents
16+
| where ThreatTypes == "Phish"
17+
| summarize count() by AccountUpn
18+
| top 10 by count_
19+
| render piechart
20+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Top 10 Users clicking on Malicious URLs (Spam).yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: 3a2fdf32-ebe7-4f65-a1c3-fc7faf23ae90
2+
name: Top 10 Users clicking on Malicious URLs (Spam)
3+
description: |
4+
Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
UrlClickEvents
16+
| where ThreatTypes == "Spam"
17+
| summarize count() by AccountUpn
18+
| top 10 by count_
19+
| render piechart
20+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/URL/URL Click attempts by threat type.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: 3eef362d-3aee-4950-9208-4afa6f7afbe9
2+
name: URL Click attempts by threat type
3+
description: |
4+
Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified.
5+
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
6+
requiredDataConnectors:
7+
- connectorId: MicrosoftThreatProtection
8+
dataTypes:
9+
- UrlClickEvents
10+
tactics:
11+
- InitialAccess
12+
relevantTechniques:
13+
- T1566
14+
query: |
15+
let TimeStart = startofday(ago(30d));
16+
let TimeEnd = startofday(now());
17+
UrlClickEvents
18+
| where TimeGenerated >= TimeStart
19+
| where isnotempty(ThreatTypes)
20+
| summarize Count = count() by ThreatTypes, bin(TimeGenerated, 1d)
21+
| render timechart
22+
version: 1.0.0

0 commit comments

Comments
 (0)