Microsoft 365

← All KQL categories

Platform

Microsoft 365

16 queries tagged with this platform.

• Analytics Rules Detect Oauth Token Used From Novel Country

  OAuth token used from a country the user has never signed in from — ToddyCat/Umbrij downstream shape where the token itself is the payload.

• Analytics Rules Detect Sharepoint Toolshell Rce Encoded Command

  SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.

• Analytics Rules Detect Smartconnect Session Without Signin

  Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.

• Email & Phishing External Email Accounts Synced To Outlook Sending Attachments

  Employees using Outlook on corporate machines to send email via third-party SMTP servers, with attachments — a common data-exfiltration pattern.

• Email & Phishing Top Blocked Malware Email Events

  Top blocked malware email events. Does what it says on the tin.

• Email & Phishing Top Phishing Domains

  Top phishing *sender domains* with severity categorized by volume.

• Email & Phishing Top Phishing Sender Recipient Pairs

  Top phishing volume grouped by *(recipient, sender-domain)* pair — useful for spotting targeted campaigns against specific users.

• Email & Phishing Top Phishing Targets

  Top *recipients* of phishing emails (targeted individuals) with severity by volume.

• Email & Phishing Whos Clicking On Junk Mail

  Users who clicked links in messages that landed in the Junk folder — a strong "who needs training" signal.

• Hunting Hunt Credential Compromise Signin Audit Alert Three Table

  Three-table credential-compromise chain: joins risky sign-ins, audit follow-up, and downstream SecurityAlert on the same user.

• Hunting Hunt First Time Admin Operation User Baseline

  Baselines identities that have ever executed admin operations, then alerts when an account outside that set succeeds — 'the admin who has never administered.'

• Hunting Hunt Outlook Calendar C2 Far Future Standing Meeting

  Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.

• Hunting Hunt Suspicious User Consented Oauth App Grants

  'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.

• Hunting Hunt Teams Phishing Then Suspicious Login Correlation

  Teams phishing messages correlated with subsequent suspicious sign-ins for the same recipient — deals with ExternalAccess not being populated by falling back to sender-domain-outside-org.

• Hunting / User Activity Whats This User Doing

  Unions `DeviceEvents`, `DeviceNetworkEvents`, and `DeviceFileEvents` to give a timestamped activity trace for a single user, including URLs touched. Swiss-army knife for user investigations — includes a Facebook-usage example.

• Identity Who Removed A User From Group Chat

  Teams-related removal actions performed by a specific user in the last 7 days, from `OfficeActivity` / Unified Audit Log.