Skip to content

Commit b6327e8

Browse files
authored
Merge pull request Azure#13683 from Azure/v-sabiraj-Updatingtechniquesforhq
Updated technique in hunting query and Microsoft Business Application…
2 parents d08f2a3 + 3955065 commit b6327e8

File tree

4 files changed

+111
-110
lines changed

4 files changed

+111
-110
lines changed

Detections/http_proxy_oab_CL/ExchagngeSuspiciousFileDownloads.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: |
44
'This query looks for messages related to file downloads of suspicious file types on an Exchange Server. This could indicate attempted deployment of webshells.
55
This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
66
This log is commonly found at C:\Program Files\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog on the Exchange server. Details on collecting custom logs into Sentinel
7-
can be found here: https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs-ama
7+
can be found here: https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs-ama'
88
severity: Medium
99
requiredDataConnectors: []
1010
queryFrequency: 1d
@@ -35,7 +35,7 @@ entityMappings:
3535
columnName: HostName
3636
- identifier: DnsDomain
3737
columnName: HostNameDomain
38-
version: 1.0.4
38+
version: 1.0.5
3939
kind: Scheduled
4040
metadata:
4141
source:
128 KB
Binary file not shown.

0 commit comments

Comments
 (0)