All Detections

PDF Attachment Interaction

avatar
Igor Oliveira@Pr0fiLeRR
updated Feb 22, 2026382456

This KQL script detects if end user interacted with a PDF attachment in a potential phishing/BEC incident

Microsoft Sentinel (KQL)