{ "Name": "Microsoft Defender XDR", "Author": "Microsoft - support@microsoft.com", "Logo": "", "Description": "The [Microsoft Defender XDR](https://www.microsoft.com/security/business/threat-protection/microsoft-365-defender) solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.\n\nAdditional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on [GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender). This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)", "Data Connectors": [ "Data Connectors/MicrosoftThreatProtection.json" ], "Analytic Rules": [ "Analytic Rules/PossiblePhishingwithCSL&NetworkSession.yaml", "Analytic Rules/SUNSPOTHashes.yaml", "Analytic Rules/PotentialBuildProcessCompromiseMDE.yaml", "Analytic Rules/SolarWinds_TEARDROP_Process-IOCs.yaml", "Analytic Rules/SolarWinds_SUNBURST_Network-IOCs.yaml", "Analytic Rules/SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs.yaml", "Analytic Rules/AVdetectionsrelatedtoUkrainebasedthreats.yaml", "Analytic Rules/AVTarrask.yaml", "Analytic Rules/AVSpringShell.yaml", "Analytic Rules/PossibleWebpBufferOverflow.yaml", "Analytic Rules/Campaign/Jupyter-Solarmaker/DeimosComponentExecution.yaml", "Analytic Rules/Campaign/Macaw Ransomware/ImminentRansomware.yaml", "Analytic Rules/Campaign/Sysrv-botnet/MaliciousCMDExecutionByJava.yaml", "Analytic Rules/Command and Control/C2-NamedPipe.yaml", "Analytic Rules/Credential Access/DoppelPaymerProcDump.yaml", "Analytic Rules/Credential Access/LSASSCredDumpProcdump.yaml", "Analytic Rules/Defense Evasion/DoppelpaymerStopService.yaml", "Analytic Rules/Defense Evasion/QakbotCampaignSelfDeletion.yaml", "Analytic Rules/Defense Evasion/Regsvr32Rundll32ImageLoadsAbnormalExtension.yaml", "Analytic Rules/Defense Evasion/Regsvr32Rundll32WithAnomalousParentProcess.yaml", "Analytic Rules/Discovery/SuspiciousCommandInitiatedByWebServerProcess.yaml", "Analytic Rules/Execution/BITSAdminActivity.yaml", "Analytic Rules/Execution/OfficeAppsLaunchingWscript.yaml", "Analytic Rules/Execution/PotentialKerberoastActivities.yaml", "Analytic Rules/Exfiltration/FilesCopiedToUSBDrives.yaml", "Analytic Rules/Exploits/MosaicLoader.yaml", "Analytic Rules/Impact/AnomalousVoulmeOfFileDeletion.yaml", "Analytic Rules/Lateral Movement/RemoteFileCreationWithPsExec.yaml", "Analytic Rules/Lateral Movement/ServiceAccountsPerformingRemotePS.yaml", "Analytic Rules/Persistence/AccountCreation.yaml", "Analytic Rules/Persistence/LocalAdminGroupChanges.yaml", "Analytic Rules/Persistence/RareProcessAsService.yaml", "Analytic Rules/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yaml", "Analytic Rules/Ransomware/DataDeletionOnMulipleDrivesUsingCipherExe.yaml", "Analytic Rules/Ransomware/LaZagneCredTheft.yaml", "Analytic Rules/Ransomware/LogDeletionUsingWevtutil.yaml", "Analytic Rules/Ransomware/MultiProcessKillWithTaskKill.yaml", "Analytic Rules/Ransomware/PotentialCobaltStrikeRansomwareActivity.yaml", "Analytic Rules/Ransomware/QakbotDiscoveryActivities.yaml", "Analytic Rules/Ransomware/ShadowCopyDeletion.yaml" ], "Hunting Queries": [ "Hunting Queries/Appspot Phishing Abuse.yaml", "Hunting Queries/Campaigns/Bazacall/PayloadDropUsingCertUtil.yaml", "Hunting Queries/Campaigns/JudgementPandaExfilActivity.yaml", "Hunting Queries/Campaigns/Jupyter-Solarmaker/DeimosComponentExecution.yaml", "Hunting Queries/Campaigns/LemonDuck/LemonDuckRegistrationFunction.yaml", "Hunting Queries/Campaigns/Log4j/DeviceWithLog4jAlerts.yaml", "Hunting Queries/Campaigns/Log4j/Log4jVulnRelatedAlerts.yaml", "Hunting Queries/Campaigns/Macaw Ransomware/ImminentRansomware.yaml", "Hunting Queries/Campaigns/Macaw Ransomware/MaliciousUseOfMSBuildAsLoLBin.yaml", "Hunting Queries/Campaigns/Qakbot/QakbotReconActivities.yaml", "Hunting Queries/Campaigns/RobbinhoodDriver.yaml", "Hunting Queries/Campaigns/Snip3MaliciousNetworkConnectivity.yaml", "Hunting Queries/Campaigns/Sysrv-botnet/MaliciousCMDExecutionByJava.yaml", "Hunting Queries/Check for spoofing attempts on the domain with Authentication failures.yaml", "Hunting Queries/Command and Control/C2-NamedPipe.yaml", "Hunting Queries/Command and Control/ReconWithRundll.yaml", "Hunting Queries/Credential Access/DoppelPaymerProcdump.yaml", "Hunting Queries/Credential Access/LaZagne.yaml", "Hunting Queries/Credential Access/LSASSCredDumpProcdump.yaml", "Hunting Queries/Defense Evasion/ClearSystemLogs.yaml", "Hunting Queries/Defense Evasion/DoppelpaymerStopServices.yaml", "Hunting Queries/Defense Evasion/QakbotCampaignSelfDeletion.yaml", "Hunting Queries/Defense Evasion/Regsvr32Rundll32ImageLoadsAbnormalExtension.yaml", "Hunting Queries/Defense Evasion/Regsvr32Rundll32WithAnomalousParentProcess.yaml", "Hunting Queries/Delivered Bad Emails from Top bad IPv4 addresses.yaml", "Hunting Queries/Discovery/SuspiciousCommandInitiatedByWebServerProcess.yaml", "Hunting Queries/Discovery/User&GroupEnumWithNetCommand.yaml", "Hunting Queries/Email and Collaboration Queries/Attachment/ATP policy status check.yaml", "Hunting Queries/Email and Collaboration Queries/Attachment/JNLP attachment.yaml", "Hunting Queries/Email and Collaboration Queries/Attachment/Safe attachment detection.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/Authentication failures.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/CompAuth Failure Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/DKIM Failure Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/DMARC Failure Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/SPF Failure Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/Spoof attempts with auth failure.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof detections by Sender Domain.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof DMARC detections by Sender Domain.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof Intra-Org detections by SenderDomain.yaml", "Hunting Queries/Email and Collaboration Queries/Custom Detections/Message from Accepted Domain with DMARC TempError.yaml", "Hunting Queries/Email and Collaboration Queries/Custom Detections/Message with URL listed on OpenPhish delivered into Inbox.yaml", "Hunting Queries/Email and Collaboration Queries/Custom Detections/Potential OAuth phishing email delivered into Inbox.yaml", "Hunting Queries/Email and Collaboration Queries/Custom Detections/Potentially malicious SVG file delivered into Inbox.yaml", "Hunting Queries/Email and Collaboration Queries/General/Audit Email Preview-Download action.yaml", "Hunting Queries/Email and Collaboration Queries/General/Bad email percentage - Inbound emails.yaml", "Hunting Queries/Email and Collaboration Queries/General/Calculate MDO Efficacy.yaml", "Hunting Queries/Email and Collaboration Queries/General/Email sender IP address Geo location information.yaml", "Hunting Queries/Email and Collaboration Queries/General/Hunt for Admin email access.yaml", "Hunting Queries/Email and Collaboration Queries/General/Hunt for TABL changes.yaml", "Hunting Queries/Email and Collaboration Queries/General/Local time to UTC time conversion.yaml", "Hunting Queries/Email and Collaboration Queries/General/Mail item accessed.yaml", "Hunting Queries/Email and Collaboration Queries/General/Malicious email senders.yaml", "Hunting Queries/Email and Collaboration Queries/General/MDO daily detection summary report.yaml", "Hunting Queries/Email and Collaboration Queries/General/New TABL Items.yaml", "Hunting Queries/Email and Collaboration Queries/General/Top 10 Domains sending Malicious Emails (Malware+Phish+Spam).yaml", "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Malware).yaml", "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Phish).yaml", "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Spam).yaml", "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders.yaml", "Hunting Queries/Email and Collaboration Queries/General/Top 10 Targeted Users (Malware+Phish+Spam).yaml", "Hunting Queries/Email and Collaboration Queries/General/Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam).yaml", "Hunting Queries/Email and Collaboration Queries/General/Total number of detections by MDO over time.yaml", "Hunting Queries/Email and Collaboration Queries/General/Total number of detections by MDO.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Automated email notifications and suspicious sign-in activity.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/BEC - File sharing tactics - OneDrive or SharePoint.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Email bombing.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Emails containing links to IP addresses.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Files share contents and suspicious sign-in activity.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Good emails from senders with bad patterns.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for email bombing attacks.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for email conversation take over attempts.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for malicious attachments using external IOC source.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for malicious URLs using external IOC source.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/Inbox rule change which forward-redirect email.yaml", "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_CountOfRecipientsEmailaddressbySubject.YAML", "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_Countofrecipientsemailaddressesbysubject.YAML", "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_CountOfSendersEmailaddressbySubject.YAML", "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_SummaryOfSenders.YAML", "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_URLClickedinEmail.YAML", "Hunting Queries/Email and Collaboration Queries/Hunting/Top outbound recipient domains sending inbound emails with threats.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Detections by detection methods.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Mail reply to new domain.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Mailflow by directionality.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Malicious emails detected per day.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Sender recipient contact establishment.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Spam Detections by Delivery Location - High.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Spam Detections by Delivery Location - Medium.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Top 100 malicious email senders.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Top 100 senders.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Zero day threats.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Email containing malware accessed on a unmanaged device.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Email containing malware sent by an internal sender.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Email malware detection report.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detection Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by AV.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by Safe Attachments.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detection Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Delivery Location.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Detection Technology Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Detection Technology.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware detections by Workload Locations.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware detections by Workload Type.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Top Domains sending Malware.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Top Email Malware Families.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Top Users receiving Malware.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Zero-day Malware Detections Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Communication from suspicious external users.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Communication to suspicious external users.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Expanding recipients into separate rows.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/External malicious Teams messages sent from internal senders.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for malicious messages using External Threat Intelligence.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Inbound Teams messages by sender domains.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious Teams messages by URL detection methods.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious Teams messages received from external senders.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams chat initiated by a suspicious external user.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Number of unique accounts performing Teams message Admin submissions.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Number of unique accounts performing Teams message User submissions.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Possible partner impersonation in external Team messages.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Possible Teams phishing activity.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Potentially malicious URL click in Teams.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Rare Domains in External Teams Messages.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Suspicious Teams Display Name.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin submission of Malware and Phish daily trend.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin submission of No Threats daily trend.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin-User Submissions Grading Verdicts.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams blocked URL clicks daily trend.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Malware ZAP .yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Message with URL listed on OpenPhish.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams message ZAPed with the same URL in Email.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams messages from a specific sender by ThreadType.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams messages with suspicious URL domains.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Phish ZAP.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams post delivery events daily trend.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Spam ZAP.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams URL clicks actions summarized by URLs clicked on.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams URL clicks through actions on Phish or Malware URLs summarized by URLs.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams User submissions daily trend.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams users clicking on suspicious URL domains.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 Attacked user by Phish messages.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 external senders sending Teams messages.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 External senders sending Teams phishing messsages.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 sender domains - Admin Teams message submissions FN.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 sender domains - Teams user submissions FN or FP.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders - Teams users submissions FN or FP.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders of Admin Teams message submissions FN.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders of Admin Teams message submissions FP.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 Users clicking on malicious URLs in Teams.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top accounts performing Teams admin submissions FN or FP.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top accounts performing Teams user submissions FN or FP.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top domains outbound sending Malicious Teams messages inbound.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top external malicious senders.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Malware.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Phish.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Spam.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top malicious URLs clicked by users in Teams.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Total number of MDO Teams protection detections daily.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/URL click on URLs in ZAP-d Teams messages.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Spam and Phish delivered to Inbox due to Admin Overrides.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Spam and Phish delivered to Inbox due to User Overrides.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Top policies performing admin overrides.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Top policies performing user overrides.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with Admin Overrides - Allow.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with Admin Overrides - Block.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with User Overrides - Allow.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with User Overrides - Block.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detection Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location - High.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location - Medium.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Detection Technology Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Detection Technology.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Possible device code phishing attempts.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Top Domains sending Phish.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Top Users receiving Phish.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Zero-day Phish Detections Trend.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Campaign with randomly named attachments.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Campaign with suspicious keywords.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Custom detection-Emails with QR from non-prevalent senders.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Emails delivered having URLs from QR codes.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Emails with QR codes and suspicious keywords in subject.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Emails with QR codes from non-prevalent sender.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Hunting for sender patterns.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Hunting for user signals-clusters.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Inbound emails with QR code URLs.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Personalized campaigns based on the first few keywords.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Personalized campaigns based on the last few keywords.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Risky sign-in attempt from a non-managed device.yaml", "Hunting Queries/Email and Collaboration Queries/QR code/Suspicious sign-in attempts from QR code phishing campaigns.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Group quarantine release.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/High Confidence Phish Released.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Phish reason trend.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Phish reason.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Release Email Details.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine release trend.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine releases by Detection types.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Spam reason trend.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Spam reason.yaml", "Hunting Queries/Email and Collaboration Queries/Remediation/AIR investigation actions insight.yaml", "Hunting Queries/Email and Collaboration Queries/Remediation/Email remediation action list.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Bulk Detection Top10 Domains.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Delivery Location.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection IP and Geo Position.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Mails with BCL.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Tech.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top10 Domains.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top10 Users.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top15 Domains Details.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top15 Users Details.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detections by Detection technology.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Display Name - Spoof and Impersonation.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections by Detection Technology Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections by Detection Technology.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections trend.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Referral phish emails.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof and impersonation detections by sender IP.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof and impersonation phish detections.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections by Detection Technology Trend.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections by Detection Technology.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections trend.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Top Domains with BEC Threats inbound.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/User not covered under display name impersonation.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submission Trend - FN.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submission Trend - FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Method - Phish FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Method - Spam FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Type.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Grading Verdict - FN-FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission State - FN.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission State - FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission Type - FN.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission Type - FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing admin submissions - FN.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing admin submissions - FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing user submissions.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Top Detection Overrides - Admin Submissions.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Top Sender Domains - Admin Submissions FN.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Top Sender Domains - Admin Submissions FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Total Submissions by Submission Status.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Total Submissions by Submission Type.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User reported submissions.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submission Accuracy versus Admin Verdicts.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top detection overrides by Admins.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top detection overrides by Users.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders domains.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org Subjects.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Admin review status.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Grading Verdict - FN-FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Submission Type.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions from Junk Folder.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions Trend - FN.yaml", "Hunting Queries/Email and Collaboration Queries/Top Attacks/Attacked more than x times average.yaml", "Hunting Queries/Email and Collaboration Queries/Top Attacks/Malicious mails by sender IPs.yaml", "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top 10 percent of most attacked users.yaml", "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top 10 URL domains attacking organization.yaml", "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top external malicious senders.yaml", "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top targeted users.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/End user malicious clicks.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/URL click count by click action.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/URL click on ZAP Email.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/URL clicks actions by URL.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/URLClick details based on malicious URL click alert.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/User clicked through events.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/User clicks on malicious inbound emails.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/User clicks on phishing URLs in emails.yaml", "Hunting Queries/Email and Collaboration Queries/URL/Malicious Clicks allowed (click-through).yaml", "Hunting Queries/Email and Collaboration Queries/URL/Malicious Emails with QR code Urls.yaml", "Hunting Queries/Email and Collaboration Queries/URL/Phishing Email Url Redirector.yaml", "Hunting Queries/Email and Collaboration Queries/URL/SafeLinks URL detections.yaml", "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Malware).yaml", "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Phish).yaml", "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Spam).yaml", "Hunting Queries/Email and Collaboration Queries/URL/URL Click attempts by threat type.yaml", "Hunting Queries/Email and Collaboration Queries/URL/URL Clicks by Action.yaml", "Hunting Queries/Email and Collaboration Queries/URL/URLs by location.yaml", "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by Admin.yaml", "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by Location.yaml", "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by ZAP type.yaml", "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events over time.yaml", "Hunting Queries/EmailDelivered-ToInbox.yaml", "Hunting Queries/Execution/AnomalousPayloadDeliveredWithISOFile.yaml", "Hunting Queries/Execution/BitsadminActivity.yaml", "Hunting Queries/Execution/MaliciousUseOfMSIExec.yaml", "Hunting Queries/Execution/MaliciousUseOfMsiExecMimikatz.yaml", "Hunting Queries/Execution/OfficeAppsLaunchingWscript.yaml", "Hunting Queries/Execution/PotentialKerberoastActivities.yaml", "Hunting Queries/Execution/PowerShellDownloads.yaml", "Hunting Queries/Execution/SuspiciousAppExeutedByWebserver.yaml", "Hunting Queries/Execution/SuspiciousMshtaUsage.yaml", "Hunting Queries/Exfiltration/FilesCopiedToUSBDrives.yaml", "Hunting Queries/Exploits/CVE-2022-26134-Confluence.yaml", "Hunting Queries/Exploits/MosaicLoader.yaml", "Hunting Queries/Exploits/Print Spooler RCE/SpoolsvSpawningRundll32.yaml", "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousDLLInSpoolFolder.yaml", "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousFilesInSpoolFolder.yaml", "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousSpoolsvChildProcess.yaml", "Hunting Queries/Exploits/PrintNightmareUsageDetection-CVE-2021-1675.yaml", "Hunting Queries/Exploits/SuspiciousFileCreationByPrintSpoolerService.yaml", "Hunting Queries/General Queries/MITRESuspiciousEvents.yaml", "Hunting Queries/Impact/AnomalousVoulmeOfFileDeletion.yaml", "Hunting Queries/Initial Access/DetectMailSniper.yaml", "Hunting Queries/Lateral Movement/AccountBruteForce.yaml", "Hunting Queries/Lateral Movement/RemoteFileCreationWithPsExec.yaml", "Hunting Queries/Lateral Movement/ServiceAccountsPerformingRemotePS.yaml", "Hunting Queries/Persistence/AccountCreation.yaml", "Hunting Queries/Persistence/LocalAdminGroupChanges.yaml", "Hunting Queries/Persistence/RareProcessAsService.yaml", "Hunting Queries/Persistence/ScheduledTaskCreation.yaml", "Hunting Queries/Privilege Escalation/SAMNameChange_CVE-2021-42278.yaml", "Hunting Queries/Ransomware/DataDeletionOnMulipleDrivesUsingCipherExe.yaml", "Hunting Queries/Ransomware/DetectMultipleSignsOfRamsomwareActivity.yaml", "Hunting Queries/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yaml", "Hunting Queries/Ransomware/DEV-0270/DomainDiscoveryWMICwithDLLHostExe.yaml", "Hunting Queries/Ransomware/DEV-0270/MDEExclusionUsingPowerShell.yaml", "Hunting Queries/Ransomware/IcedIdSuspiciousImageLoad.yaml", "Hunting Queries/Ransomware/LaZagneCredTheft.yaml", "Hunting Queries/Ransomware/LogDeletionUsingWevtutil.yaml", "Hunting Queries/Ransomware/MultiProcessKillWithTaskKill.yaml", "Hunting Queries/Ransomware/PotentialCobaltStrikeRansomwareActivity.yaml", "Hunting Queries/Ransomware/QakbotDiscoveryActivities.yaml", "Hunting Queries/Ransomware/ShadowCopyDeletion.yaml", "Hunting Queries/Ransomware/TurningOffServicesWithSCCommad.yaml", "Hunting Queries/TVM/Detect_CISA_Alert_AA22-117A2021_Top_Routinely_Exploited_Vulnerabilities.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Punycode chars lookalike domains.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for RMM tool execution following Teams messages.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for alerts correlated with Teams messages.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Identify acting user for reported phish.yaml", "Hunting Queries/Email and Collaboration Queries/Authentication/Inbound Sender Domains Failing Email Authentication.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Automatic External Email Forwarding by Type.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/First-Contact External Email Senders.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/New External Sender Domains Carrying Threats.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Domains Receiving Auto-forwarded Email.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Recipients Receiving Auto-forwarded Email.yaml", "Hunting Queries/Email and Collaboration Queries/Mailflow/Top Users Auto-forwarding Email Externally.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections Over Time.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections by Location.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections by Workload.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by MDO Detonation.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by SharePoint Antivirus.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/File Scanning Coverage.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detection IP and Geo Position.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Sender Country.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Threat Classification.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Top Attacked Users by Malware Threat Classification.yaml", "Hunting Queries/Email and Collaboration Queries/Malware/Top File Owners Holding Malware.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/First-Contact External Teams Senders.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious files shared in Microsoft Teams.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams External versus Internal Thread Exposure.yaml", "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams File Protection Summary.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/SecOps Mailbox Override Count.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/SecOps Mailbox Overrides by Threat Type.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Top Recipients Receiving Threats Delivered by Override.yaml", "Hunting Queries/Email and Collaboration Queries/Overrides/Top Sender Domains Delivering Threats via Override.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detection IP and Geo Position.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Sender Country.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Threat Classification.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Phishing Detected by LLM Content Analysis.yaml", "Hunting Queries/Email and Collaboration Queries/Phish/Top Attacked Users by Phish Threat Classification.yaml", "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Release Percentage.yaml", "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Investigation Outcomes by Day.yaml", "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Delivery to Action Latency.yaml", "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Efficiency Over Time.yaml", "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Manual versus Automatic Approval.yaml", "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detections by Sender Country.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation and Spoof Detections by Sender Country.yaml", "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Top Recipients Targeted by Impersonation or BEC.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing user submissions - FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Inbound Subjects FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) sender domains FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions Trend - FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Detection Method - Phish FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Detection Method - Spam FP.yaml", "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Submission State - FP.yaml", "Hunting Queries/Email and Collaboration Queries/Top Attacks/Largest Malicious Email Campaigns by Cluster.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/Blocked URL Clicks by Workload.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/Top 20 Malicious URLs by Clicks.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/Top Clicks on Malicious URLs.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/URL Click-Through by Workload.yaml", "Hunting Queries/Email and Collaboration Queries/URL Click/URL Threat Protection Summary.yaml", "Hunting Queries/Email and Collaboration Queries/URL/Malware URL Detections Trend.yaml", "Hunting Queries/Email and Collaboration Queries/URL/Phishing URL Detections Trend.yaml", "Hunting Queries/Email and Collaboration Queries/URL/QR Code URL Detections Trend.yaml" ], "Workbooks": [ "Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json", "Workbooks/MicrosoftDefenderForEndPoint.json", "Workbooks/MicrosoftDefenderForIdentity.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Defender XDR", "Version": "3.0.18", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ "MicrosoftThreatProtection" ] }