Forum Discussion

BCSecA's avatar
BCSecA
Copper Contributor
Mar 03, 2021
Solved

Azure Sentinel Hunting and Github - HAFNIUM

Hello everyone,

 

I am fairly new to Azure Sentinel and today I was hoping to take advantage of the Hunting queries in GitHub mentioned in this https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/. 

 

The problem is I have no idea on how to take something from GitHub (https://github.com/Azure/Azure-Sentinel/blob/master/Detections/W3CIISLog/HAFNIUMSuspiciousExchangeRequestPattern.yaml) and create a new hunting query from it in Sentinel.

 

This may be something stupid simple but my google-fu has failed me.

 

Any pointers would be very much appreciated.

3 Replies

Resources