Udi B
@UdiAotearoa | New Zealand
0 followers3 downloads152 copies2 likes447 views
21 detections
Filters
Last updated
All Time
Detection languages
21
Categories
10
5
5
3
3
Platforms
10
10
8
4
1
Products / Services
15
6
3
3
3
MITRE Techniques
9
6
5
4
4
Aggregates identity, endpoint, cloud application, and messaging telemetry to build a consolidated profile of the devices, clients, applications, and user agents associated with a specific user account.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
Correlates Microsoft Entra Privileged Identity Management (PIM) role eligibility with actual activation activity to identify how privileged roles are being used across the environment.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
Identifies Microsoft Sentinel scheduled analytics rules that have executed successfully over a specified period but have never produced any query results.
The query reviews Microsoft Sentinel health telemetry and highlights rules that consistently execute without generating matching events. These rules may represent outdated detections, unused content, environmental mismatches, incorrect data source assumptions, or opportunities for detection engineering review.
This query helps SOC and detection engineering teams reduce maintenance overhead, improve content quality, and identify candidates for retirement or redesign.
The query reviews Microsoft Sentinel health telemetry and highlights rules that consistently execute without generating matching events. These rules may represent outdated detections, unused content, environmental mismatches, incorrect data source assumptions, or opportunities for detection engineering review.
This query helps SOC and detection engineering teams reduce maintenance overhead, improve content quality, and identify candidates for retirement or redesign.
Identifies suspicious inbound bulk email campaigns by correlating sender behaviour, recipient spread, URL evidence, Safe Links click telemetry, external SharePoint links, post-delivery remediation actions, and campaign delivery outcomes.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions.
It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction.
Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
Provides a role-centric view of Microsoft Entra Privileged Identity Management (PIM) usage by correlating role eligibility, activation history, and recently activated assignments.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
This rule monitors and aggregates Microsoft Entra ID Privileged Identity Management (PIM) group activation logs to provide a dashboard view of group usage, member count, and recent role activations. It facilitates governance by identifying high-usage, low-usage, or unused PIM-eligible groups by correlating historical and recent activation activity with current membership data.
Reviews Microsoft Entra Privileged Identity Management (PIM) role activations and correlates them with activation justifications supplied by users.
The query allows security teams to identify:
Who is activating privileged roles
Which roles are being activated
How often activations occur
When activations occurred
Business justifications provided during activation requests
This is useful for privileged access reviews, audit preparation, compliance reporting, least-privilege initiatives, and identifying users who repeatedly activate privileged roles with weak or repetitive justifications.
The query allows security teams to identify:
Who is activating privileged roles
Which roles are being activated
How often activations occur
When activations occurred
Business justifications provided during activation requests
This is useful for privileged access reviews, audit preparation, compliance reporting, least-privilege initiatives, and identifying users who repeatedly activate privileged roles with weak or repetitive justifications.
This rule detects email communications where the subject line contains numerical patterns matching standard credit card number formats (13-16 digits, or spaced/hyphenated variations). The purpose is to identify potential unauthorized transmission of sensitive financial data (PII/payment information) via email.
Identifies inbound email campaigns that deliver URLs to large numbers of recipients and groups activity by parent domain.
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain.
This is useful for:
Phishing campaign analysis
Infrastructure clustering
Bulk sender investigations
Threat hunting
Domain reputation reviews
Email security tuning
Page 2 of 3