%3CLINGO-SUB%20id%3D%22lingo-sub-1286004%22%20slang%3D%22en-US%22%3EHunt%20more%20broadly%20and%20effectively%20with%20new%20Microsoft%20Threat%20Protection%20features%20on%20preview%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1286004%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20Microsoft%20Threat%20Protection%20team%20has%20been%20working%20hard%20to%20make%20your%20%3CA%20title%3D%22Advanced%20hunting%20overview%22%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fdocs.microsoft.com%252Fen-us%252Fmicrosoft-365%252Fsecurity%252Fmtp%252Fadvanced-hunting-overview%26amp%3Bdata%3D04%257C01%257CLouie.Mayor%2540microsoft.com%257C97f7d87c1f8241f77c4208d7bce9cf45%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637185584884472748%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C-1%26amp%3Bsdata%3DFm89KY0ZYYkw3AzprhyN5vMjlAr7vsNh5tTQTNhSITs%253D%26amp%3Breserved%3D0%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eadvanced%20hunting%20experience%3C%2FA%3E%20even%20more%20straightforward%2C%20interesting%2C%20and%20productive.%20With%20app%20%26amp%3B%20identity%20signals%2C%20custom%20detections%2C%20and%20charts%20now%20available%20on%20preview%2C%20your%20proactive%20threat%20hunting%20activities%20have%20never%20been%20as%20comprehensive%20and%20effective.%20%3CA%20title%3D%22Turn%20on%20Microsoft%20Threat%20Protection%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fmtp-enable%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ETurn%20on%20Microsoft%20Threat%20Protection%3C%2FA%3E%20and%20%3CA%20title%3D%22sign%20up%20for%20previews%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fpreview%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Esign%20up%20for%20previews%3C%2FA%3E%20to%20start%20enjoying%20these%20new%20experiences%20and%20let%20us%20know%20what%20you%20think.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1380268177%22%20id%3D%22toc-hId--1380268177%22%20id%3D%22toc-hId--1380268177%22%20id%3D%22toc-hId--1380268177%22%20id%3D%22toc-hId--1380268177%22%20id%3D%22toc-hId--1380268177%22%3EHunt%20across%20domains%20with%20identity%20and%20cloud%20app%20signals%3C%2FH2%3E%0A%3CP%3EWhile%20Microsoft%20Threat%20Protection%20automatically%20flags%20and%20remediates%20threats%2C%20advanced%20hunting%20lets%20you%20take%20your%20response%20a%20step%20further%20by%20enabling%20you%20to%20efficiently%20inspect%20benign%20events%20that%20in%20certain%20contexts%20can%20be%20indicative%20of%20breach%20activity.%20For%20several%20months%20now%2C%20in%20Microsoft%20365%20security%20center%2C%20SecOps%20staff%20for%20various%20organizations%20have%20started%20%3CA%20title%3D%22Hunt%20on%20email%20and%20devices%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fadvanced-hunting-query-emails-devices%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehunting%20for%20clues%20on%20endpoints%20after%20receiving%20suspicious%20emails%3C%2FA%3E.%20This%20has%20been%20made%20easy%20and%20convenient%20by%20endpoint%20data%20from%20%3CA%20title%3D%22Microsoft%20Defender%20ATP%20overview%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fmicrosoft-defender-atp%2Fmicrosoft-defender-advanced-threat-protection%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft%20Defender%20ATP%3C%2FA%3E%20and%20email%20data%20from%20%3CA%20title%3D%22Office%20365%20ATP%20overview%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Foffice-365-security%2Foffice-365-atp%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EOffice%20365%20ATP%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe've%20expanded%20that%20coverage%20to%20include%20data%20from%20%3CA%20title%3D%22Azure%20ATP%20overview%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure-advanced-threat-protection%2Fwhat-is-atp%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20ATP%3C%2FA%3E%20and%20%3CA%20title%3D%22Microsoft%20Cloud%20App%20Security%20overview%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fcloud-app-security%2Fwhat-is-cloud-app-security%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft%20Cloud%20App%20Security%3C%2FA%3E%20with%20the%20following%20new%20schema%20tables%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EIdentityQueryEvents%3C%2FSTRONG%3E%20%E2%80%94%20contains%20data%20about%20attempts%20to%20query%20identity%20information%20in%20Active%20Directory%20using%20LDAP%20and%20other%20protocols.%20These%20events%20are%20also%20tracked%20by%20Azure%20ATP%20to%20find%20reconnaissance%20activities%2C%20including%20activities%20meant%20to%20discover%20critical%20targets%20on%20your%20network.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EIdentityLogonEvents%3C%2FSTRONG%3E%20%E2%80%94%20contains%20authentication%20events%20from%20Active%20Directory%20as%20well%20as%20monitored%20cloud%20apps%20and%20services.%20Use%20this%20to%20surface%20suspicious%20logon%20activities%2C%20including%20repetitive%20attempts%20and%20the%20use%20of%20atypical%20logon%20methods.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EAppFileEvents%3C%2FSTRONG%3E%20%E2%80%94%20covers%20file-related%20activities%20involving%20apps%20monitored%20by%20Microsoft%20Cloud%20App%20Security.%20This%20gives%20you%20coverage%20over%20attempts%20to%20handle%20files%20that%20might%20contain%20sensitive%20information%20as%20well%20as%20malicious%20code.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22schema_tables.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F182517i4B11D311A85AD04E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22schema_tables.png%22%20alt%3D%22schema_tables.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CA%20title%3D%22See%20the%20full%20list%20of%20advanced%20hunting%20schema%20tables%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fadvanced-hunting-schema-tables%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ESee%20the%20full%20list%20of%20advanced%20hunting%20schema%20tables%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1107244656%22%20id%3D%22toc-hId-1107244656%22%20id%3D%22toc-hId-1107244656%22%20id%3D%22toc-hId-1107244656%22%20id%3D%22toc-hId-1107244656%22%20id%3D%22toc-hId-1107244656%22%3ESample%20scenarios%20you%20can%20try%3C%2FH2%3E%0A%3CP%3EWith%20these%20new%20data%20sets%2C%20you%20can%20hunt%20for%20activities%20that%20happen%20across%20the%20cybersecurity%20attack%20chain.%20Check%20out%20the%20sample%20scenarios%20below%20to%20explore%20what%20you%20can%20do%20with%20the%20expanded%20schema.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-1797806130%22%20id%3D%22toc-hId-1797806130%22%20id%3D%22toc-hId-1797806130%22%20id%3D%22toc-hId-1797806130%22%20id%3D%22toc-hId-1797806130%22%20id%3D%22toc-hId-1797806130%22%3ESAMR%20queries%20to%20Active%20Directory%3C%2FH3%3E%0A%3CP%3EWith%20%3CSTRONG%3EIdentityQueryEvents%3C%2FSTRONG%3E%2C%20you%20can%20now%20quickly%20find%20reconnaissance%20activities%2C%20such%20as%20processes%20performing%20suspicious%20SAMR%20queries%20against%20users%20and%20admins%20in%20your%20org.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EIdentityQueryEvents%3CBR%20%2F%3E%7C%20where%20Timestamp%20%26gt%3B%20ago(7d)%3CBR%20%2F%3E%7C%20where%20ActionType%20%3D%3D%20%22SamrQuerySuccess%22%20and%20isnotempty(AccountName)%3CBR%20%2F%3E%7C%20project%20QueryTime%20%3D%20Timestamp%2C%20DeviceName%2C%20AccountName%2C%20Query%2C%20QueryTarget%20%3CBR%20%2F%3E%7C%20join%20kind%3Dinner%20(%3CBR%20%2F%3E%20%20DeviceProcessEvents%20%3CBR%20%2F%3E%20%20%7C%20where%20Timestamp%20%26gt%3B%20ago(7d)%3CBR%20%2F%3E%20%20%7C%20extend%20DeviceName%20%3D%20toupper(trim(%40%22%5C..*%24%22%2CDeviceName))%3CBR%20%2F%3E%20%20%7C%20project%20ProcessCreationTime%20%3D%20Timestamp%2C%20DeviceName%2C%20AccountName%2C%20InitiatingProcessFileName%2C%20%3CBR%20%2F%3E%20%20InitiatingProcessCommandLine%3CBR%20%2F%3E)%20on%20DeviceName%2C%20AccountName%3CBR%20%2F%3E%7C%20where%20ProcessCreationTime%20-%20QueryTime%20between%20(-2m%20..%202m)%3CBR%20%2F%3E%7C%20project%20QueryTime%2C%20DeviceName%2C%20AccountName%2C%20InitiatingProcessFileName%2C%20%3CBR%20%2F%3EInitiatingProcessCommandLine%2C%20Query%2C%20QueryTarget%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--9648333%22%20id%3D%22toc-hId--9648333%22%20id%3D%22toc-hId--9648333%22%20id%3D%22toc-hId--9648333%22%20id%3D%22toc-hId--9648333%22%20id%3D%22toc-hId--9648333%22%3ELDAP%20authentication%20with%20cleartext%20passwords%3C%2FH3%3E%0A%3CP%3EWith%20%3CSTRONG%3EIdentityLogonEvents%3C%2FSTRONG%3E%2C%20you%20can%20identify%20possible%20lateral%20movement%20activities%20by%20searching%20for%20logon%20attempts%20using%20compromised%20accounts%20or%20logons%20over%20unprotected%20protocols%2C%20such%20cleartext%20authentications%20over%20LDAP.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20query%20identifies%20processes%20that%20have%20attempted%20to%20authenticate%20using%20a%20clear-text%20password%2C%20which%20are%20typically%20obtained%20using%20known%20credential%20theft%20methods.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EIdentityLogonEvents%3CBR%20%2F%3E%7C%20where%20Timestamp%20%26gt%3B%20ago(7d)%3CBR%20%2F%3E%7C%20where%20LogonType%20%3D%3D%20%22LDAP%20cleartext%22%20and%20isnotempty(AccountName)%3CBR%20%2F%3E%7C%20project%20LogonTime%20%3D%20Timestamp%2C%20DeviceName%2C%20AccountName%2C%20Application%2C%20LogonType%3CBR%20%2F%3E%7C%20join%20kind%3Dinner%20(%3CBR%20%2F%3E%20%20DeviceNetworkEvents%3CBR%20%2F%3E%20%20%7C%20where%20Timestamp%20%26gt%3B%20ago(7d)%3CBR%20%2F%3E%20%20%7C%20where%20ActionType%20%3D%3D%20%22ConnectionSuccess%22%3CBR%20%2F%3E%20%20%7C%20extend%20DeviceName%20%3D%20toupper(trim(%40%22%5C..*%24%22%2CDeviceName))%3CBR%20%2F%3E%20%20%7C%20where%20RemotePort%20%3D%3D%20%22389%22%3CBR%20%2F%3E%20%20%7C%20project%20NetworkConnectionTime%20%3D%20Timestamp%2C%20DeviceName%2C%20%3CBR%20%2F%3E%20%20AccountName%20%3D%20InitiatingProcessAccountName%2C%20InitiatingProcessFileName%2C%20%3CBR%20%2F%3E%20%20InitiatingProcessCommandLine%3CBR%20%2F%3E%20%20)%20on%20DeviceName%2C%20AccountName%3CBR%20%2F%3E%7C%20where%20LogonTime%20-%20NetworkConnectionTime%20between%20(-2m%20..%202m)%3CBR%20%2F%3E%7C%20project%20Application%2C%20LogonType%2C%20LogonTime%2C%20DeviceName%2C%20AccountName%2C%20%3CBR%20%2F%3EInitiatingProcessFileName%2C%20InitiatingProcessCommandLine%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1817102796%22%20id%3D%22toc-hId--1817102796%22%20id%3D%22toc-hId--1817102796%22%20id%3D%22toc-hId--1817102796%22%20id%3D%22toc-hId--1817102796%22%20id%3D%22toc-hId--1817102796%22%3ERenaming%20of%20.docx%20files%20to%20.doc%3C%2FH3%3E%0A%3CP%3EWith%20%3CSTRONG%3EAppFileEvents%3C%2FSTRONG%3E%2C%20you%20can%20hunt%20for%20attempts%20to%20move%20and%20stage%20malicious%20content%20using%20cloud%20apps.%20The%20following%20query%20locates%20attempts%20to%20rename%20%3CEM%3E.docx%3C%2FEM%3E%20files%20to%20%3CEM%3E.doc%3C%2FEM%3E%2C%20possibly%20to%20bypass%20protection%20mechanisms%20and%20allow%20malicious%20macros%20to%20run.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EAppFileEvents%20%3CBR%20%2F%3E%7C%20where%20Timestamp%20%26gt%3B%20ago(7d)%3CBR%20%2F%3E%7C%20where%20ActionType%20%3D%3D%20%22FileRenamed%22%3CBR%20%2F%3E%7C%20join%20kind%3Dinner%20(%3CBR%20%2F%3E%20%20DeviceFileEvents%20%3CBR%20%2F%3E%20%20%7C%20where%20Timestamp%20%26gt%3B%20ago(7d)%3CBR%20%2F%3E%20%20%7C%20project%20FileName%2C%20AccountName%20%3D%20InitiatingProcessAccountName%2C%20DeviceName%3CBR%20%2F%3E%20%20)%20on%20FileName%2C%20AccountName%3CBR%20%2F%3E%7C%20where%20FileName%20endswith%20%22doc%22%20and%20PreviousFileName%20endswith%20%22docx%22%20%3CBR%20%2F%3E%7C%20project%20Timestamp%2C%20FileName%2C%20PreviousFileName%2C%20Application%2C%20AccountName%2C%20DeviceName%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-670410037%22%20id%3D%22toc-hId-670410037%22%20id%3D%22toc-hId-670410037%22%20id%3D%22toc-hId-670410037%22%20id%3D%22toc-hId-670410037%22%20id%3D%22toc-hId-670410037%22%3ESensitive%20file%20uploads%3C%2FH3%3E%0A%3CP%3EYou%20can%20also%20use%20the%20%3CSTRONG%3EAppFileEvents%3C%2FSTRONG%3E%20table%20to%20hunt%20for%20exfiltration%20scenarios%20by%20querying%20for%20attempts%20to%20upload%20sensitive%20files%20to%20cloud%20apps%20like%20SharePoint%2C%20OneDrive%2C%20or%20Dropbox.%20You%20can%20use%20data%20under%20%3CSTRONG%3ESensitivityLabel%3C%2FSTRONG%3E%20in%20the%20%3CSTRONG%3EDeviceFileEvents%3C%2FSTRONG%3E%20table%20to%20locate%20sensitive%20files.%20However%2C%20a%20simpler%20way%20would%20be%20look%20for%20a%20specific%20string%20in%20file%20names%2C%20like%20%3CEM%3Esensitive%3C%2FEM%3E%20in%20the%20query%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EAppFileEvents%3CBR%20%2F%3E%7C%20where%20ActionType%20%3D%3D%20%22FileUploaded%22%3CBR%20%2F%3E%7C%20where%20Application%20in%20(%22Microsoft%20OneDrive%20for%20Business%22%2C%20%3CBR%20%2F%3E%22Microsoft%20SharePoint%20Online%22%2C%20%22Dropbox%22)%3CBR%20%2F%3E%7C%20where%20FileName%20contains%20%22sensitive%22%20%3CBR%20%2F%3E%7C%20project%20Timestamp%2C%20ActionType%2C%20Application%2C%20FileName%2C%20FolderPath%2C%20AccountUpn%2C%20%3CBR%20%2F%3EAccountName%2C%20AccountDomain%2C%20IPAddress%2C%20Location%3CBR%20%2F%3E%7C%20take%2010%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20more%20queries%2C%20check%20out%20the%20%3CA%20title%3D%22Microsoft%20Threat%20Protection%20query%20repository%20on%20GitHub%22%20href%3D%22https%3A%2F%2Fgithub.com%2Fmicrosoft%2FMTP-AHQ%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft%20Threat%20Protection%20query%20repository%20on%20GitHub%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-659906933%22%20id%3D%22toc-hId-659906933%22%20id%3D%22toc-hId-659906933%22%20id%3D%22toc-hId-659906933%22%20id%3D%22toc-hId-659906933%22%20id%3D%22toc-hId-659906933%22%3ECustomize%20alerts%20and%20take%20automatic%20actions%3C%2FH2%3E%0A%3CP%3EMany%20of%20you%20might%20have%20already%20benefited%20from%20custom%20detection%20alerts%20driven%20by%20advanced%20hunting%20queries%20in%20Microsoft%20Defender%20ATP.%20To%20simplify%20your%20hunt%20and%20optimize%20your%20use%20of%20the%20expanded%20schema%2C%20we%E2%80%99ve%20delivered%20the%20same%20custom%20detection%20functionality%20to%20Microsoft%20Threat%20Protection.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUsing%20advanced%20hunting%20queries%2C%20you%20can%20now%20automate%20your%20hunts%20so%20that%20you%20can%20effortlessly%20check%20fresh%20signals%20and%20raise%20alerts%20for%20new%20finds.%20Make%20sure%20you%20set%20your%20custom%20detection%20rules%20to%20take%20immediate%20response%20actions%20for%20you.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20create%20one%2C%20simply%20run%20a%20query%E2%80%94we%20used%20the%20last%20example%20above%20for%20sensitive%20file%20uploads.%20If%20you%20don%E2%80%99t%20have%20results%2C%20simulate%20the%20activity%20by%20uploading%20a%20file%20called%20%3CEM%3Esensitive.txt%3C%2FEM%3E%20to%20OneDrive%2C%20SharePoint%2C%20or%20Dropbox.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22query_results.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F182528i24B8516EB998FA1C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22query_results.png%22%20alt%3D%22query_results.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAfter%20confirming%20that%20the%20query%20runs%20well%20and%20returns%20meaningful%20results%2C%20click%20%3CSTRONG%3ECreate%20detection%20rules%3C%2FSTRONG%3E%20and%20start%20customizing%20your%20detection%20rule.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%3CSTRONG%3ENote%3A%3C%2FSTRONG%3E%20To%20create%20custom%20detection%20rules%2C%20you%20need%20to%20be%20a%20%3CSTRONG%3Esecurity%20administrator%3C%2FSTRONG%3E%20or%20a%20%3CSTRONG%3Esecurity%20operator%3C%2FSTRONG%3E.%20If%20you%20have%20Microsoft%20Defender%20ATP%20RBAC%20turned%20on%2C%20make%20sure%20you%20have%20the%20%3CSTRONG%3Emanaged%20security%20settings%20permission%3C%2FSTRONG%3E.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22alert_details.png%22%20style%3D%22width%3A%20979px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F182529iC4F3FEFD4867A239%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22alert_details.png%22%20alt%3D%22alert_details.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20identifying%20impacted%20entities%2C%20a%20user%E2%80%94identified%20by%20the%20%3CSTRONG%3EAccountUpn%3C%2FSTRONG%3E%20column%20in%20this%20example%E2%80%94will%20work%20since%20the%20exfiltration%20event%20does%20%3CEM%3Enot%3C%2FEM%3E%20affect%20specific%20endpoints%20or%20mailboxes.%20Identifying%20the%20right%20impacted%20entities%20helps%20Microsoft%20Threat%20Protection%20aggregate%20relevant%20alerts%2C%20correlate%20incidents%2C%20and%20target%20response%20actions.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20you%20save%20your%20custom%20detection%2C%20it%20will%20run%20immediately%20and%20then%20run%20again%20based%20on%20your%20preferred%20interval.%20To%20check%20for%20alerts%2C%20head%20over%20to%20the%20%3CSTRONG%3EHunting%20%26gt%3B%20Custom%20detections%20%26gt%3B%20%5BRule%20name%5D%3C%2FSTRONG%3E%20and%20open%20the%20%3CSTRONG%3ETriggered%20alerts%3C%2FSTRONG%3E%20tab.%3CEM%3E%3CBR%20%2F%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22custom_detection_alerts.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F182530iD462E57EADB3CAA0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22custom_detection_alerts.png%22%20alt%3D%22custom_detection_alerts.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fcustom-detection-rules%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ELearn%20more%20about%20creating%20custom%20detection%20rules%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1147547530%22%20id%3D%22toc-hId--1147547530%22%20id%3D%22toc-hId--1147547530%22%20id%3D%22toc-hId--1147547530%22%20id%3D%22toc-hId--1147547530%22%20id%3D%22toc-hId--1147547530%22%3EVisualize%20query%20results%3C%2FH2%3E%0A%3CP%3ETo%20help%20you%20extract%20insights%20from%20your%20queries%20and%20add%20some%20color%20to%20your%20work%2C%20we%E2%80%99ve%20added%20an%20option%20to%20view%20query%20results%20as%20a%20chart.%20Now%20available%20to%20%3CEM%3Eall%20customers%3C%2FEM%3E%2C%20the%20chart%20options%20currently%20include%20line%2C%20column%2C%20pie%2C%20scatter%2C%20and%20many%20other%20chart%20types.%20After%20running%20your%20query%2C%20select%20the%20right%20chart%20type%20that%20matches%20your%20data.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20line%20chart%20shown%20below%20highlights%20spikes%20in%20activity%20involving%20a%20specific%20file.%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fadvanced-hunting-query-results%3Fview%3Do365-worldwide%23view-query-results-as-a-table-or-chart%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ELearn%20how%20to%20optimize%20queries%20to%20render%20effective%20charts%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22line_chart.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F182531i579ECE6C03F0B92A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22line_chart.jpg%22%20alt%3D%22line_chart.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20hope%20you%20enjoyed%20learning%20about%20these%20new%20hunting%20experiences.%20Don%E2%80%99t%20forget%20to%20%3CA%20title%3D%22Send%20feedback%20about%20these%20features%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Ffeedback%3Fview%3Do365-worldwide%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Elet%20us%20know%20what%20you%20think%3C%2FA%3E!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3EStay%20safe%20and%20happy%20hunting!%3C%2FEM%3E%3CBR%20%2F%3E-%20Microsoft%20Threat%20Protection%20Team%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1286004%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22teaser.png%22%20style%3D%22width%3A%20525px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F182533iC5B056ED6EBD89D2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22teaser.png%22%20alt%3D%22teaser.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EWith%20app%20%26amp%3B%20identity%20signals%2C%20custom%20detections%2C%20and%20charts%20now%20available%20on%20preview%2C%20your%20advanced%20hunting%20activities%20have%20never%20been%20as%20comprehensive%20and%20effective.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1286004%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdvanced%20hunting%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Threat%20Protection%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1489849%22%20slang%3D%22en-US%22%3ERe%3A%20Hunt%20more%20broadly%20and%20effectively%20with%20new%20Microsoft%20Threat%20Protection%20features%20on%20preview%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1489849%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F75275%22%20target%3D%22_blank%22%3E%40Louie%20Mayor%3C%2FA%3E%26nbsp%3Bwhat%20is%20recommended%20query%20to%20check%20that%20threat%20hunting%20is%20receiving%20logs%20from%20various%20EMS%20E5%20features%3F%20Something%20like%20a%20quick%20glance%20to%20see%20that%20security%20events%20are%20definitely%20coming%20in...%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1489902%22%20slang%3D%22en-US%22%3ERe%3A%20Hunt%20more%20broadly%20and%20effectively%20with%20new%20Microsoft%20Threat%20Protection%20features%20on%20preview%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1489902%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F283216%22%20target%3D%22_blank%22%3E%40Sergg%3C%2FA%3E%2C%26nbsp%3BI%20have%20some%20ideas%2C%20but%20I%20want%20to%20confer%20with%20our%20experts%20first.%20Will%20get%20back%20to%20you%20as%20soon%20as%20I%20hear%20from%20them.%20Do%20you%20have%20Cloud%20App%20Security%20or%20Azure%20ATP%20deployed%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1489946%22%20slang%3D%22en-US%22%3ERe%3A%20Hunt%20more%20broadly%20and%20effectively%20with%20new%20Microsoft%20Threat%20Protection%20features%20on%20preview%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1489946%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F75275%22%20target%3D%22_blank%22%3E%40Louie%20Mayor%3C%2FA%3E%26nbsp%3BWe%20are%20onboarding%20various%20small%20and%20big%20customers%20and%20helping%20to%20put%20%22shelved%22%20E5%20features%20into%20action.%26nbsp%3BThere%20were%20two%20parts%20in%20my%20question%20-%20shallow%20and%20deep.%3C%2FP%3E%3CP%3EShallow%20-%20just%20want%20to%20check%20how%20much%20data...%20is%20there%20something%20like%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.splunk.com%2FDocumentation%2FSplunk%2F8.0.4%2FSearchReference%2FDbinspect%235._Find_the_index_size_of_buckets_in_GB%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ESplunk%20Dbinspect%20-%20use%20cases%3C%2FA%3E%26nbsp%3BThis%20is%20to%20validate%20that%20various%20tables%20are%20not%20empty.%20And%20data%20will%20be%20ready%20when%20the%20disaster%20strikes.%3C%2FP%3E%3CP%3EDeeper%20-%20Using%20threat%20hunting%20as%20a%20single%20pain%20of%20glass%20tracking%20end-point%20and%20cloud%20security%20and%20features%20reporting%20back%20data%20(after%20features%20being%20enabled%20via%20Security%20Center%2C%20Device%20Management%20and%20Protection.office.com%20portals).%20And%20maybe%20even%20finding%20endpoints%20persistently%20reporting%20no%20data.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1502305%22%20slang%3D%22en-US%22%3ERe%3A%20Hunt%20more%20broadly%20and%20effectively%20with%20new%20Microsoft%20Threat%20Protection%20features%20on%20preview%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1502305%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F283216%22%20target%3D%22_blank%22%3E%40Sergg%3C%2FA%3E%2C%26nbsp%3Bapologies%20for%20the%20slow%20response.%20I%20had%20to%20check%20this%20with%20more%20technical%20folks%20in%20the%20team.%26nbsp%3BBefore%20anything%20else%2C%20please%20note%20that%20advanced%20hunting%20wasn%E2%80%99t%20really%20designed%20for%20configuration%20management.%20However%2C%20these%20queries%20might%20helpful%20for%20your%20needs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20would%20run%20these%20queries%20to%20check%20whether%20devices%2C%20Office%20365%20email%2C%20Cloud%20App%20Security%2C%20Azure%20ATP%2C%20and%20MCAS%20are%20returning%20data%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%2F%2F%20Get%20count%20of%20events%20from%20all%20devices%3C%2FP%3E%0A%3CP%3EDeviceEvents%3C%2FP%3E%0A%3CP%3E%7C%20count%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%2F%2F%20Get%20count%20of%20Office%20365%20email%20events%3C%2FP%3E%0A%3CP%3EEmailEvents%3C%2FP%3E%0A%3CP%3E%7C%20count%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%2F%2F%20Get%20count%20of%20events%20from%20Azure%20ATP%20(where%20Application%20%3D%3D%20%22Active%20Directory%22)%20as%20well%20as%20Microsoft%20online%20services%20monitored%20by%20MCAS%3C%2FP%3E%0A%3CP%3EIdentityLogonEvents%3C%2FP%3E%0A%3CP%3E%7C%20summarize%20count()%20by%20Application%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20want%20to%20get%20the%20list%20of%20devices%20that%20have%20sent%20events%20to%20Microsoft%20Defender%20ATP%2C%20you%20can%20use%20this%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%2F%2F%20Get%20list%20of%20devices%20returning%20events%3C%2FP%3E%0A%3CP%3EDeviceEvents%3C%2FP%3E%0A%3CP%3E%7C%20summarize%20count()%20by%20DeviceName%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20want%20to%20ensure%20that%20you%20are%20getting%20security%20alerts%20from%20Microsoft%20Defender%20ATP%2C%20Office%20365%20ATP%2C%20Azure%20ATP%2C%20and%20Cloud%20App%20Security%2C%20use%20this%20query.%20Note%20that%20some%20of%20these%20services%20might%20not%20be%20firing%20alerts.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%2F%2F%20Get%20count%20of%20security%20alerts%20by%20service%3C%2FP%3E%0A%3CP%3EAlertInfo%3C%2FP%3E%0A%3CP%3E%7C%20summarize%20count()%20by%20ServiceSource%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

The Microsoft Threat Protection team has been working hard to make your advanced hunting experience even more straightforward, interesting, and productive. With app & identity signals, custom detections, and charts now available on preview, your proactive threat hunting activities have never been as comprehensive and effective. Turn on Microsoft Threat Protection and sign up for previews to start enjoying these new experiences and let us know what you think.

 

Hunt across domains with identity and cloud app signals

While Microsoft Threat Protection automatically flags and remediates threats, advanced hunting lets you take your response a step further by enabling you to efficiently inspect benign events that in certain contexts can be indicative of breach activity. For several months now, in Microsoft 365 security center, SecOps staff for various organizations have started hunting for clues on endpoints after receiving suspicious emails. This has been made easy and convenient by endpoint data from Microsoft Defender ATP and email data from Office 365 ATP.

 

We've expanded that coverage to include data from Azure ATP and Microsoft Cloud App Security with the following new schema tables:

  • IdentityQueryEvents — contains data about attempts to query identity information in Active Directory using LDAP and other protocols. These events are also tracked by Azure ATP to find reconnaissance activities, including activities meant to discover critical targets on your network.
  • IdentityLogonEvents — contains authentication events from Active Directory as well as monitored cloud apps and services. Use this to surface suspicious logon activities, including repetitive attempts and the use of atypical logon methods.
  • AppFileEvents — covers file-related activities involving apps monitored by Microsoft Cloud App Security. This gives you coverage over attempts to handle files that might contain sensitive information as well as malicious code.

schema_tables.png

See the full list of advanced hunting schema tables

 

Sample scenarios you can try

With these new data sets, you can hunt for activities that happen across the cybersecurity attack chain. Check out the sample scenarios below to explore what you can do with the expanded schema.

 

SAMR queries to Active Directory

With IdentityQueryEvents, you can now quickly find reconnaissance activities, such as processes performing suspicious SAMR queries against users and admins in your org.

 

IdentityQueryEvents
| where Timestamp > ago(7d)
| where ActionType == "SamrQuerySuccess" and isnotempty(AccountName)
| project QueryTime = Timestamp, DeviceName, AccountName, Query, QueryTarget
| join kind=inner (
DeviceProcessEvents
| where Timestamp > ago(7d)
| extend DeviceName = toupper(trim(@"\..*$",DeviceName))
| project ProcessCreationTime = Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
InitiatingProcessCommandLine
) on DeviceName, AccountName
| where ProcessCreationTime - QueryTime between (-2m .. 2m)
| project QueryTime, DeviceName, AccountName, InitiatingProcessFileName,
InitiatingProcessCommandLine, Query, QueryTarget

 

LDAP authentication with cleartext passwords

With IdentityLogonEvents, you can identify possible lateral movement activities by searching for logon attempts using compromised accounts or logons over unprotected protocols, such cleartext authentications over LDAP.

 

This query identifies processes that have attempted to authenticate using a clear-text password, which are typically obtained using known credential theft methods.

 

IdentityLogonEvents
| where Timestamp > ago(7d)
| where LogonType == "LDAP cleartext" and isnotempty(AccountName)
| project LogonTime = Timestamp, DeviceName, AccountName, Application, LogonType
| join kind=inner (
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionSuccess"
| extend DeviceName = toupper(trim(@"\..*$",DeviceName))
| where RemotePort == "389"
| project NetworkConnectionTime = Timestamp, DeviceName,
AccountName = InitiatingProcessAccountName, InitiatingProcessFileName,
InitiatingProcessCommandLine
) on DeviceName, AccountName
| where LogonTime - NetworkConnectionTime between (-2m .. 2m)
| project Application, LogonType, LogonTime, DeviceName, AccountName,
InitiatingProcessFileName, InitiatingProcessCommandLine

 

Renaming of .docx files to .doc

With AppFileEvents, you can hunt for attempts to move and stage malicious content using cloud apps. The following query locates attempts to rename .docx files to .doc, possibly to bypass protection mechanisms and allow malicious macros to run.

 

AppFileEvents 
| where Timestamp > ago(7d)
| where ActionType == "FileRenamed"
| join kind=inner (
DeviceFileEvents
| where Timestamp > ago(7d)
| project FileName, AccountName = InitiatingProcessAccountName, DeviceName
) on FileName, AccountName
| where FileName endswith "doc" and PreviousFileName endswith "docx"
| project Timestamp, FileName, PreviousFileName, Application, AccountName, DeviceName

 

Sensitive file uploads

You can also use the AppFileEvents table to hunt for exfiltration scenarios by querying for attempts to upload sensitive files to cloud apps like SharePoint, OneDrive, or Dropbox. You can use data under SensitivityLabel in the DeviceFileEvents table to locate sensitive files. However, a simpler way would be look for a specific string in file names, like sensitive in the query below:

 

AppFileEvents
| where ActionType == "FileUploaded"
| where Application in ("Microsoft OneDrive for Business",
"Microsoft SharePoint Online", "Dropbox")
| where FileName contains "sensitive"
| project Timestamp, ActionType, Application, FileName, FolderPath, AccountUpn,
AccountName, AccountDomain, IPAddress, Location
| take 10

 

For more queries, check out the Microsoft Threat Protection query repository on GitHub.

 

Customize alerts and take automatic actions

Many of you might have already benefited from custom detection alerts driven by advanced hunting queries in Microsoft Defender ATP. To simplify your hunt and optimize your use of the expanded schema, we’ve delivered the same custom detection functionality to Microsoft Threat Protection.

 

Using advanced hunting queries, you can now automate your hunts so that you can effortlessly check fresh signals and raise alerts for new finds. Make sure you set your custom detection rules to take immediate response actions for you.

 

To create one, simply run a query—we used the last example above for sensitive file uploads. If you don’t have results, simulate the activity by uploading a file called sensitive.txt to OneDrive, SharePoint, or Dropbox.

 

query_results.png

 

After confirming that the query runs well and returns meaningful results, click Create detection rules and start customizing your detection rule.

 

Note: To create custom detection rules, you need to be a security administrator or a security operator. If you have Microsoft Defender ATP RBAC turned on, make sure you have the managed security settings permission.

 

alert_details.png

 

When identifying impacted entities, a user—identified by the AccountUpn column in this example—will work since the exfiltration event does not affect specific endpoints or mailboxes. Identifying the right impacted entities helps Microsoft Threat Protection aggregate relevant alerts, correlate incidents, and target response actions.

 

When you save your custom detection, it will run immediately and then run again based on your preferred interval. To check for alerts, head over to the Hunting > Custom detections > [Rule name] and open the Triggered alerts tab.

 

custom_detection_alerts.png

Learn more about creating custom detection rules

 

Visualize query results

To help you extract insights from your queries and add some color to your work, we’ve added an option to view query results as a chart. Now available to all customers, the chart options currently include line, column, pie, scatter, and many other chart types. After running your query, select the right chart type that matches your data.

 

The line chart shown below highlights spikes in activity involving a specific file. Learn how to optimize queries to render effective charts

 

line_chart.jpg

 

We hope you enjoyed learning about these new hunting experiences. Don’t forget to let us know what you think!

 

Stay safe and happy hunting!
- Microsoft Threat Protection Team

6 Comments
Occasional Contributor

@Louie Mayor what is recommended query to check that threat hunting is receiving logs from various EMS E5 features? Something like a quick glance to see that security events are definitely coming in... Thanks!

Microsoft

@Sergg, I have some ideas, but I want to confer with our experts first. Will get back to you as soon as I hear from them. Do you have Cloud App Security or Azure ATP deployed?

Occasional Contributor

@Louie Mayor We are onboarding various small and big customers and helping to put "shelved" E5 features into action. There were two parts in my question - shallow and deep.

Shallow - just want to check how much data... is there something like Splunk Dbinspect - use cases This is to validate that various tables are not empty. And data will be ready when the disaster strikes.

Deeper - Using threat hunting as a single pain of glass tracking end-point and cloud security and features reporting back data (after features being enabled via Security Center, Device Management and Protection.office.com portals). And maybe even finding endpoints persistently reporting no data.

Microsoft

@Sergg, apologies for the slow response. I had to check this with more technical folks in the team. Before anything else, please note that advanced hunting wasn’t really designed for configuration management. However, these queries might help so I'm sharing them.

 

I would run these queries to check whether devices, Office 365 email, Cloud App Security, Azure ATP, and MCAS are returning data:

 

// Get count of events from all devices

DeviceEvents

| count

 

// Get count of Office 365 email events

EmailEvents

| count

 

// Get count of events from Azure ATP (where Application == "Active Directory") as well as Microsoft online services monitored by MCAS

IdentityLogonEvents

| summarize count() by Application

 

If you want to get the list of devices that have sent events to Microsoft Defender ATP, you can use this:

 

// Get list of devices returning events

DeviceEvents

| summarize count() by DeviceName

 

If you want to ensure that you are getting security alerts from Microsoft Defender ATP, Office 365 ATP, Azure ATP, and Cloud App Security, use this query. Note that some of these services might not be firing alerts.

 

// Get count of security alerts by service

AlertInfo

| summarize count() by ServiceSource

Occasional Contributor

@Louie Mayor I realize this is not SLA help forums, but perhaps you can suggest where I can read more about enabling each specific type of schemas? In this test tenant MTP is enabled (under https://security.microsoft.com/settings/mtp_settings/mtp_consent + sign-in for previews is on) and all other E5 features are switched on and configured including MCAS but we are missing some tables. Note:  Azure ATP with on-prem agents not used - because this is Azure only tenant with no on-prem AD.  Does IdentityLogonEvents source events from Azure ATP or Azure AD?

Present: DeviceEvents 

Missing: EmailEvents and IdentityLogonEvents.

Should I ask this question to MDATP support? I failed to find any details on troubleshooting issues with not getting EmailEvents and IdentityLogonEvents with my google-foo...

Assuming integration is triggered, should the new schema/table exist even where there is not a single event yet arrived, or is it only created on first event arrival? Perhaps I can put my questions as documentation feedback under https://docs.microsoft.com/en-us/microsoft-365/security/mtp/mtp-enable-faq

Occasional Contributor

Problem with the missing event schemas is resolved. I realized there are TWO separate GUI for hunting:

1. https://securitycenter.windows.com/hunting

2. https://security.microsoft.com/advanced-hunting

Both look very similar, but the second one has more event types.