Sakshyam Sambyal
@Sakshyam0 followers0 downloads13 copies0 likes141 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
Platforms
1
1
Products / Services
1
1
This rule identifies user accounts that have one or more roles assigned to them. It queries the 'IdentityInfo' table, filters for entries where the 'AssignedRoles' field is not empty, and then projects relevant account details such as UPN, display name, assigned roles, and object ID. Finally, it summarizes the data to retrieve the most recent record for each unique account object ID.
This rule detects when a user from a specified watchlist sends an email with a large attachment (over 5MB).