Bi Yue Xu
@biyuexuColorado, USCompletionist
1 follower4 downloads175 copies0 likes384 views
33 detections
Filters
Last updated
All Time
Detection languages
33
Categories
4
2
2
2
1
Platforms
1
This query identifies and summarizes domains surfaced through Microsoft Copilot, showing URL event volume, unique users, click-through activity, and observation timeframe. It helps security teams identify high-exposure domains in Copilot and prioritize domains with significant user reach or click-through activity for further security investigation.
Identifies URLs surfaced through Microsoft Copilot and provides visibility into their frequency, user reach, and observation timeframe.
This query detects potential email bombing by calculating a Bomb Signal score for each user based on four indicators: high email volume, multiple senders, multiple sender domains, and a high number of first-contact emails. First-contact emails can be useful as a signal because email bombing often involves a large number of senders the recipient has never interacted with before.
This query analyzes URLs surfaced through Microsoft Teams by aggregating UrlClickEvents associated with the Teams workload. It groups events by URL and shows how frequently each URL appears, how many unique users are associated with it, and the first and most recent time it was observed.
This query detects mailbox forwarding rules created for specified users, such as high-risk users.
Attackers don’t always target random mailboxes. They often prioritize accounts with access to valuable information, such as executives, finance teams, legal departments, HR personnel, and security leaders. By creating mailbox forwarding rules on these high-value accounts, attackers can quietly monitor sensitive communications and collect intelligence while remaining unnoticed.
Attackers don’t always target random mailboxes. They often prioritize accounts with access to valuable information, such as executives, finance teams, legal departments, HR personnel, and security leaders. By creating mailbox forwarding rules on these high-value accounts, attackers can quietly monitor sensitive communications and collect intelligence while remaining unnoticed.
This query identifies each instance of an AI note-taking bot waiting in the Teams meeting lobby and the user who admitted it from the lobby. Note: Update MeetingParticipantName has_any ("Fireflies", "Spice AI", "read.ai", "Cresco AI") to include additional AI bot names.
This KQL query reveals the PowerShell commands executed within PowerShell script by extracting individual commands through the PowerShellCommand events in Defender DeviceEvents.
This detection rule identifies what are the sensitivity-labeled files present on a specified device using the DeviceFileEvents table in Microsoft Defender for Endpoint.
You can run this query to quickly determine whether a compromised device contains any files with sensitivity labels during investigation.
You can run this query to quickly determine whether a compromised device contains any files with sensitivity labels during investigation.
This KQL query generates a high-level summary of AI note-taking bots that have joined Teams meetings across the organization, including their corresponding source IP address ranges.
This KQL query identifies a user who is flagged in a security alert then creates a mailbox forwarding rule within a defined time window.
Page 2 of 4