EXPLORE DETECTIONS

Locate SolarWinds processes launching suspicious PowerShell commands

This query was originally published in the threat analytics report, *Solorigate supply chain attack*. Please note that these attacks are currently known as the *Nobelium campaign*.

Log Analytic Workspace Deletions

Deletion of a workspace could lead to a loss of logging - though the queryable workspace may be deleted meaning you'll have no way to run this query

LOL Driver Usage

This query uses different tables to list all actions related to LOL drivers. It combines DeviceFileEvents, DeviceProcessEvents and DeviceImageLoadEvents to list the results. The lol drivers project is a curated list of Windows drivers used by adversaries to bypass security controls and carry out attacks. The project helps security professionals stay informed and mitigate potential threats. Those drivers should preferable be removed from your environment.

Lookup vulnerability information based on a CveID

----

Machine Onboarded Azure Arc

Lists the onboarded machines to Azure Arc. The HostName is the hostname that is used within Azure and Defender For Endpoint, this may differ from the actual hostname of the local system.

Mail.Read or Mail.ReadWrite permissions added to OAuth application

This query will find applications that have been granted Mail.Read or Mail.ReadWrite permissions in which the corresponding user recently consented to. It can help identify applications that have been abused to gain access to user email.

MailItemsAccessed by Compromised account

This query lists the *MailItemsAccessed* actions performed by a suspicious/compromised account.

MailItemsAccessed throttling [Nobelium]

The MailItemsAccessed action is part of the new Advanced Audit functionality of Microsoft 365 Defender. It's part of Exchange mailbox auditing and is enabled by default for users that have an Office 365 or Microsoft 365 E5 license, or for organizations with a Microsoft 365 E5 Compliance add-on subscription.

Malicious Browser Extension Downloads using DeviceFileEvents

Credit https://github.com/toborrm9/malicious_extension_sentry

Malicious email delivered in Microsoft 365

This query lists all the emails that have been classified as malicious based on Threat Intelligence on the mailbox.

MalwareBazaar Certificate Blocklist Detection

This query searches for code signing certificates from MalwareBazaar's blocklist

MCP Server Registered to Entra

| where parse_json(TargetResources)["0.displayName"] == 'Microsoft MCP Server for Enterprise' //Example https://learn.microsoft.com/en-us/graph/mcp-server/get-started?tabs=http%2Cvscode

MDA - File Download by Country

download or download from browser

MDA - IP Address Type

MDA - OAuth App Disabled

My Guess is this is Microsoft Application Goverance

MDA Blocks by Application and URL

MDA Custom Warn Indicators Report

This query reports on MDE Indicators in Warn mode and CASB/MDA warnings

MDE DeviceRegistryEvents Tampering To DeviceTag

Modifications to this registry key could move a device into a different MDE Device Group

MDI Sensor Deleted

This query returns results when a Defender For Identity Sensor has been deleted. This sensor would have been installed on your Domain Controller, ADCS, ADFS or Entra Connect server.

MDI Service Accounts without Service Principals and MSAs

Exclude gMSA/dMSA

Microsoft Phishing Subdomain Detection

This query detects phishing domains using Microsoft in subdomain

Microsoft Teams Emoji Reactions

This query lists the statistics of the Emoji reactions that have been send via Microsoft Teams

Microsoft Teams Emoji Reactions for each Department

This query lists the statistics of the Emoji reactions that have been send via Microsoft Teams for each Department.

MicrosoftGraphActivityLogs App Enrichment AADNonInteractiveUserSignInLogs Based

This query enriches the *MicrosoftGraphActivityLogs* with Application information from the *AADNonInteractiveUserSignInLogs* table to get more context in the results.