Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Listing Email Remediation Actions via Explorer

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•1•0•43

Listing Email Remediation Actions performed via Explorer in Defender for Office 365

Microsoft Sentinel (KQL)

Tags

T1566 - Phishing TA0001 - Initial Access T1114 - Email Collection TA0009 - Collection T1137.002 - Office Test T1137 - Office Application Startup T1137.001 - Office Template Macros T1586.002 - Email Accounts T1585.002 - Email Accounts S0195 - SDelete T1578.003 - Delete Cloud Instance T1098.002 - Additional Email Delegate Permissions TA0003 - Persistence TA0042 - Resource Development TA0005 - Defense Evasion TA0004 - Privilege Escalation Email Received Email Sent Admin Activity Office 365 M365 Unified Audit Logkqltactic:InitialAccesstechnique:T1566

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?