Bi Yue Xu
@biyuexuColorado, USCompletionist
1 follower4 downloads175 copies0 likes384 views
33 detections
Filters
Last updated
All Time
Detection languages
33
Categories
4
2
2
2
1
Platforms
1
This query identifies mailbox forwarding rules configured to a predefined list of external domains, including Gmail, Yahoo, Outlook.com, and Proton Mail.
This query identifies suspicious sign-in followed by the creation of a mail forwarding rule.
This query returns the latest verdict (e.g., No Threats Found, Malicious) from the Automated Investigation and Response (AIR) feature in Microsoft Defender for Office 365 (MDO), along with the alert timestamp, alert ID, and alert title.
This KQL query identifies which participants joined the Microsoft Teams meeting from the lobby and who admitted them.
MeetingParticipantName: the meeting participant who waited in the lobby
InviteTime: the time the participant entered the meeting but was waiting in the lobby
Inviter: the person who admitted the participant from the lobby
MeetingParticipantJoinTime: the time the participant was admitted from the lobby
Important caveat: There can be a significant delay (e.g., more than 8 hours) between when a Teams meeting occurs and when the corresponding events become available in Advanced Hunting.
MeetingParticipantName: the meeting participant who waited in the lobby
InviteTime: the time the participant entered the meeting but was waiting in the lobby
Inviter: the person who admitted the participant from the lobby
MeetingParticipantJoinTime: the time the participant was admitted from the lobby
Important caveat: There can be a significant delay (e.g., more than 8 hours) between when a Teams meeting occurs and when the corresponding events become available in Advanced Hunting.
This query uses Purview IRM telemetry to identify emails with attachments sent to free public domains.
This KQL query hunts for PowerShell commands hidden within PowerShell scripts, flagging keywords seen in there that are commonly associated with malicious activity.
This query identifies sensitivity-labeled files sent as email attachments to external recipients. The results provide details including the sender, recipient, file name, file path, and device where the file was observed.
This query detects when three or more user mailboxes are configured to forward email to the same external email address.
This query returns a summary of inbox rule creation events from Microsoft Purview Audit logs over the past 15 days.
This query identifies different types of mailbox forwarding rule creation events within the organization.
Page 3 of 4