Forum Discussion
BCSecA
Mar 03, 2021Copper Contributor
Azure Sentinel Hunting and Github - HAFNIUM
Hello everyone,
I am fairly new to Azure Sentinel and today I was hoping to take advantage of the Hunting queries in GitHub mentioned in this https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/.
The problem is I have no idea on how to take something from GitHub (https://github.com/Azure/Azure-Sentinel/blob/master/Detections/W3CIISLog/HAFNIUMSuspiciousExchangeRequestPattern.yaml) and create a new hunting query from it in Sentinel.
This may be something stupid simple but my google-fu has failed me.
Any pointers would be very much appreciated.
BCSecA Whipped this up real quick...let me know if this helps: