OfficeActivity

← All KQL categories

Data Source

OfficeActivity

6 queries tagged with this data source.

• Analytics Rules Detect Smartconnect Session Without Signin

  Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.

• Hunting Hunt First Time Admin Operation User Baseline

  Baselines identities that have ever executed admin operations, then alerts when an account outside that set succeeds — 'the admin who has never administered.'

• Hunting Hunt Outlook Calendar C2 Far Future Standing Meeting

  Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.

• Hunting Hunt Teams Phishing Then Suspicious Login Correlation

  Teams phishing messages correlated with subsequent suspicious sign-ins for the same recipient — deals with ExternalAccess not being populated by falling back to sender-domain-outside-org.

• Hunting / User Activity Whats This User Doing

  Unions `DeviceEvents`, `DeviceNetworkEvents`, and `DeviceFileEvents` to give a timestamped activity trace for a single user, including URLs touched. Swiss-army knife for user investigations — includes a Facebook-usage example.

• Identity Who Removed A User From Group Chat

  Teams-related removal actions performed by a specific user in the last 7 days, from `OfficeActivity` / Unified Audit Log.