IOCs based Malicious email detection
This KQL look for any IOCs from the given list and compare against EmailEvents on Defender for Email
Microsoft Sentinel (KQL)

This KQL look for any IOCs from the given list and compare against EmailEvents on Defender for Email

Already have an account?