Zero day threats

Description

This query helps reviewing zero day threats via URL and file detonations

Query · kql

EmailEvents 
| where Timestamp > ago(30d) 
| where DetectionMethods has "URL Detonation" or DetectionMethods has "File Detonation" 
| count
Raw source Zero day threats · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 95b0c7ed-2853-4343-80a9-ab076cf31e51
name: Zero day threats
description: |
  This query helps reviewing zero day threats via URL and file detonations
description-detailed: |
  This query helps reviewing zero day threats via URL and file detonations using Defender for Office 365 data
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where Timestamp > ago(30d) 
  | where DetectionMethods has "URL Detonation" or DetectionMethods has "File Detonation" 
  | count
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.