EXPLORE DETECTIONS

MailItemsAccessed by Compromised account

This query lists the *MailItemsAccessed* actions performed by a suspicious/compromised account.

MailItemsAccessed throttling [Nobelium]

The MailItemsAccessed action is part of the new Advanced Audit functionality of Microsoft 365 Defender. It's part of Exchange mailbox auditing and is enabled by default for users that have an Office 365 or Microsoft 365 E5 license, or for organizations with a Microsoft 365 E5 Compliance add-on subscription.

Malicious Browser Extension Downloads using DeviceFileEvents

Credit https://github.com/toborrm9/malicious_extension_sentry

Malicious email delivered in Microsoft 365

This query lists all the emails that have been classified as malicious based on Threat Intelligence on the mailbox.

MalwareBazaar Certificate Blocklist Detection

This query searches for code signing certificates from MalwareBazaar's blocklist

MCP Server Registered to Entra

| where parse_json(TargetResources)["0.displayName"] == 'Microsoft MCP Server for Enterprise' //Example https://learn.microsoft.com/en-us/graph/mcp-server/get-started?tabs=http%2Cvscode

MDA - File Download by Country

download or download from browser

MDA - IP Address Type

MDA - OAuth App Disabled

My Guess is this is Microsoft Application Goverance

MDA Blocks by Application and URL

MDA Custom Warn Indicators Report

This query reports on MDE Indicators in Warn mode and CASB/MDA warnings

MDE DeviceRegistryEvents Tampering To DeviceTag

Modifications to this registry key could move a device into a different MDE Device Group

MDI Sensor Deleted

This query returns results when a Defender For Identity Sensor has been deleted. This sensor would have been installed on your Domain Controller, ADCS, ADFS or Entra Connect server.

MDI Service Accounts without Service Principals and MSAs

Exclude gMSA/dMSA

Microsoft Phishing Subdomain Detection

This query detects phishing domains using Microsoft in subdomain

Microsoft Teams Emoji Reactions

This query lists the statistics of the Emoji reactions that have been send via Microsoft Teams

Microsoft Teams Emoji Reactions for each Department

This query lists the statistics of the Emoji reactions that have been send via Microsoft Teams for each Department.

MicrosoftGraphActivityLogs App Enrichment AADNonInteractiveUserSignInLogs Based

This query enriches the *MicrosoftGraphActivityLogs* with Application information from the *AADNonInteractiveUserSignInLogs* table to get more context in the results.

MicrosoftGraphActivityLogs App Enrichment ExternalData Based

This query enriches the *MicrosoftGraphActivityLogs* with Application information Using the Azure_Application_ID list developed by [@Beercow](https://github.com/Beercow) 1000+ AppIds can be enriched with the [externaldata operator](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/externaldata-operator?pivots=azuredataexplorer) resulting in the query below.

MicrosoftGraphActivityLogs IP Enrichment

The IP information can be enriched using the [geo_info_from_ip_address()](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/geo-info-from-ip-address-function) function, which returns the country, state, city, latitude and longitude of each IPv4 and IPv6 address.

MicrosoftGraphActivityLogs User Enrichment

This query enriches the *MicrosoftGraphActivityLogs* with userinformation from the *IdentityInfo* table to get more context in the results.

Modifications To ApplicationManagementPolicy for Entra App Registrations

This query looks for modifications to ApplicationManagementPolicy which could be someone attempting to bypass an app management policy that blocks client secrets being used for an app registration

Modifications to SafeLinks AllowClickThrough Policy

Monitor DLLs by Signer

change to 30d if using advanced hunting with no sentinel