Platform
SharePoint
2 queries tagged with this platform.
-
Analytics Rules
Detect Smartconnect Session Without Signin
Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.
-
Hunting
Hunt First Time Admin Operation User Baseline
Baselines identities that have ever executed admin operations, then alerts when an account outside that set succeeds — 'the admin who has never administered.'