All Detections

Large Email Attachment (>5MB) Sent by Monitored User

avatar
Sakshyam Sambyal@Sakshyam
updated Jan 24, 20267069

This rule detects when a user from a specified watchlist sends an email with a large attachment (over 5MB).

Microsoft Sentinel (KQL)