Newly Observed .CFD Domain Access
The .cfd Top-Level Domain (TLD) is often linked to malicious activities such as phishing, malware distribution, and command-and-control (C2) operations. This query detects new allowed network connections to .cfd domains that have appeared for the first time in your environment within the past 24 hours. Monitoring these connections can serve as an early warning sign of potential security breaches or users being targeted by phishing attacks. The query also provides valuable context for each newly observed domain, including its first-ever occurrence within a 30-day window, the total recent access count, and the users involved—enabling analysts to quickly evaluate the associated risk.
Microsoft Sentinel (KQL)
