Skip to content

Commit f3ccd84

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#12254 from jonade/post-delivery-mdo
Add new ZAP, Quarantine, and File Malware (SPO/Teams/ODfB) hunting queries for MDO
2 parents 634a4c0 + 6ed3b3e commit f3ccd84

32 files changed

+1035
-42
lines changed

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/File Malware Detection Trend.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: 71cdf9cb-39b7-40fe-a81f-2c125efc7d07
2+
name: File Malware Detection Trend
3+
description: |
4+
This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
5+
description-detailed: |
6+
This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- CloudAppEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
let TimeStart = startofday(ago(30d));
18+
let TimeEnd = startofday(now());
19+
CloudAppEvents
20+
| where TimeGenerated >= TimeStart
21+
| where ActionType == 'FileMalwareDetected'
22+
| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
23+
| render timechart
24+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/File Malware Top Families by AV.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: db287ba5-344a-4e43-a94f-26e686203598
2+
name: File Malware by Top Malware Families (Anti Virus)
3+
description: |
4+
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections
5+
description-detailed: |
6+
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- CloudAppEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
CloudAppEvents
18+
| where ActionType == 'FileMalwareDetected' and isempty(UserAgent)
19+
| project ObjectName, UserAgent, RawinfoVirusInfo = RawEventData.VirusInfo
20+
| summarize count() by tostring(RawinfoVirusInfo) | sort by count_
21+
| render piechart
22+
// | render columnchart // Uncomment to change the graph type
23+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/File Malware Top Families by Safe Attachments.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: afd90d9e-f8f5-41c7-823a-616907392503
2+
name: File Malware by Top Malware Families (Safe Attachments)
3+
description: |
4+
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)
5+
description-detailed: |
6+
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- CloudAppEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
CloudAppEvents
18+
| where ActionType == 'FileMalwareDetected' and UserAgent =~ 'MS Scanner ATP'
19+
| project ObjectName, UserAgent, RawinfoVirusInfo = RawEventData.VirusInfo
20+
| summarize count() by tostring(RawinfoVirusInfo) | sort by count_
21+
| render piechart
22+
// | render columnchart // Uncomment to change the graph type
23+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/Malware detections by Workload Locations.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: bb6afb85-8e80-4c98-b73b-c2c821528a1c
2+
name: Malware detections by Workload Locations
3+
description: |
4+
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
5+
description-detailed: |
6+
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- CloudAppEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
CloudAppEvents
18+
| where ActionType == 'FileMalwareDetected'
19+
| project location=(split(RawEventData.SiteUrl, '/')[4])
20+
| summarize count() by tostring(location)
21+
| sort by count_ desc
22+
| render columnchart
23+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/Malware detections by Workload Type.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: 094a9823-e053-4b36-8678-cd70f048db91
2+
name: Malware detections by Workload Type
3+
description: |
4+
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
5+
description-detailed: |
6+
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- CloudAppEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
CloudAppEvents
18+
| where ActionType == 'FileMalwareDetected'
19+
| extend Appwithteams = iff(Application =~ 'Microsoft SharePoint Online',strcat(Application,' / Teams Files'),Application)
20+
| extend Appwithteams = trim_start('Microsoft',Appwithteams) | summarize count() by Appwithteams
21+
| sort by count_ desc
22+
| render piechart
23+
// | render columnchart // Uncomment to change the graph type
24+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Quarantine/Quarantine Phish reason trend.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
id: 6f7df1b7-5613-45e5-9b82-3ec95d86e0e8
2+
name: Quarantine Phish Reason trend
3+
description: |
4+
This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method
5+
description-detailed: |
6+
This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- EmailEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
let TimeStart = startofday(ago(30d));
18+
let TimeEnd = startofday(now());
19+
let baseQuery = EmailEvents
20+
| where TimeGenerated >= TimeStart
21+
| where DetectionMethods has "Phish" and DeliveryLocation == "Quarantine";
22+
let ml=baseQuery
23+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
24+
| where Phish has 'Advanced filter'
25+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
26+
| extend Details = "Advanced filter";
27+
let camp=baseQuery
28+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
29+
| where Phish has 'Campaign'
30+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
31+
| extend Details = "Campaign";
32+
let fd=baseQuery
33+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
34+
| where Phish has 'File detonation' and Phish !has 'File detonation reputation'
35+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
36+
| extend Details = "File detonation";
37+
let fdr=baseQuery
38+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
39+
| where Phish has 'File detonation reputation'
40+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
41+
| extend Details = "File detonation reputation";
42+
let frp=baseQuery
43+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
44+
| where Phish has 'Fingerprint matching'
45+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
46+
| extend Details = "Fingerprint matching";
47+
let gf=baseQuery
48+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
49+
| where Phish has 'General filter'
50+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
51+
| extend Details = "General filter";
52+
let bimp=baseQuery
53+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
54+
| where Phish has 'Impersonation brand'
55+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
56+
| extend Details = "Impersonation brand";
57+
let dimp=baseQuery
58+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
59+
| where Phish has 'Impersonation domain'
60+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
61+
| extend Details = "Impersonation domain";
62+
let uimp=baseQuery
63+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
64+
| where Phish has 'Impersonation user'
65+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
66+
| extend Details = "Impersonation user";
67+
let mimp=baseQuery
68+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
69+
| where Phish has 'Mailbox intelligence impersonation'
70+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
71+
| extend Details = "Mailbox intelligence impersonation";
72+
let sdmarc=baseQuery
73+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
74+
| where Phish has 'Spoof DMARC'
75+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
76+
| extend Details = "Spoof DMARC";
77+
let spoofe=baseQuery
78+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
79+
| where Phish has 'Spoof external domain'
80+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
81+
| extend Details = "Spoof external domain";
82+
let spoofi=baseQuery
83+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
84+
| where Phish has 'Spoof intra-org'
85+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
86+
| extend Details = "Spoof intra-org";
87+
let ud=baseQuery
88+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
89+
| where Phish has 'URL detonation' and Phish !has 'URL detonation reputation'
90+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
91+
| extend Details = "URL detonation";
92+
let udr=baseQuery
93+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
94+
| where Phish has 'URL detonation reputation'
95+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
96+
| extend Details = "URL detonation reputation";
97+
let umr=baseQuery
98+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
99+
| where Phish has 'URL malicious reputation'
100+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
101+
| extend Details = "URL malicious reputation";
102+
union ml,camp,fd,fdr,frp,gf,bimp,dimp,uimp,mimp,sdmarc,spoofe,spoofi,ud,udr,umr
103+
| project Count, Details, Timestamp
104+
| render timechart
105+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Quarantine/Quarantine Phish reason.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: 5caf3813-c628-48e2-be65-71b95be7ff85
2+
name: Quarantine Phish Reason
3+
description: |
4+
This query visualises the total amount of phish emails that are quarantined, summarized by the detection method
5+
description-detailed: |
6+
This query visualises the total amount of phish emails that are quarantined, summarized by the detection method
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- EmailEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
EmailEvents
18+
| where EmailDirection == "Inbound" and DetectionMethods has 'Phish' and DeliveryLocation == "Quarantine"
19+
| project DT=parse_json(DetectionMethods)| evaluate bag_unpack(DT)| summarize count() by Phish=tostring(column_ifexists('Phish', ''))
20+
| render piechart
21+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Quarantine/Quarantine Spam reason trend.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
id: 014ffc5c-0ba5-49f9-989c-3833e0d1c2b8
2+
name: Quarantine Spam Reason trend
3+
description: |
4+
This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method
5+
description-detailed: |
6+
This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- EmailEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
let TimeStart = startofday(ago(30d));
18+
let TimeEnd = startofday(now());
19+
let baseQuery = EmailEvents
20+
| where TimeGenerated >= TimeStart
21+
| where DetectionMethods has "Spam" and DeliveryLocation == "Quarantine";
22+
let timerange =
23+
baseQuery
24+
| summarize minTime = min(Timestamp), maxTime = max(Timestamp);
25+
let ml=baseQuery
26+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
27+
| where Spam has 'Advanced filter'
28+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
29+
| extend Details = "Advanced filter";
30+
let gf=baseQuery
31+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
32+
| where Spam has 'General filter'
33+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
34+
| extend Details = "General filter";
35+
let bl=baseQuery
36+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
37+
| where Spam has 'BulkFilter'
38+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
39+
| extend Details = "BulkFilter";
40+
let mx=baseQuery
41+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
42+
| where Spam has 'Mixed analysis detection'
43+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
44+
| extend Details = "Mixed analysis detection";
45+
let frp=baseQuery
46+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
47+
| where Spam has 'Fingerprint matching'
48+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
49+
| extend Details = "Fingerprint matching";
50+
let umr=baseQuery
51+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
52+
| where Spam has 'URL malicious reputation'
53+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
54+
| extend Details = "URL malicious reputation";
55+
let dr=baseQuery
56+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
57+
| where Spam has 'Domain reputation'
58+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
59+
| extend Details = "Domain reputation";
60+
let ipr=baseQuery
61+
| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT)
62+
| where Spam has 'IP reputation'
63+
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
64+
| extend Details = "IP reputation";
65+
union ml,gf,bl,mx,frp,umr,dr,ipr
66+
| project Count, Details, Timestamp
67+
| render timechart
68+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Quarantine/Quarantine Spam reason.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: 35b21933-9d3e-4919-b545-2ada20d26e8e
2+
name: Quarantine Spam Reason
3+
description: |
4+
This query visualises the total amount of spam emails that are quarantined, summarized by the detection method
5+
description-detailed: |
6+
This query visualises the total amount of spam emails that are quarantined, summarized by the detection method
7+
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
8+
requiredDataConnectors:
9+
- connectorId: MicrosoftThreatProtection
10+
dataTypes:
11+
- EmailEvents
12+
tactics:
13+
- InitialAccess
14+
relevantTechniques:
15+
- T1566
16+
query: |
17+
EmailEvents
18+
| where EmailDirection == "Inbound" and DetectionMethods has 'Spam' and DeliveryLocation == "Quarantine"
19+
| project DT=parse_json(DetectionMethods)| evaluate bag_unpack(DT)| summarize count() by Spam=tostring(column_ifexists('Spam', ''))
20+
| render piechart
21+
version: 1.0.0

‎Hunting Queries/Microsoft 365 Defender/Email Queries/Quarantine/Quarantine release trend.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ query: |
1818
| where ActionType == "QuarantineReleaseMessage"
1919
| summarize count() by bin(Timestamp, 1d)
2020
| project-rename Releases = count_
21-
| render timechart with (title="Qurantine Releases by Day")
21+
| render timechart with (title="Quarantine Releases by Day")
2222
version: 1.0.0

0 commit comments

Comments
 (0)