Unusual Volume of file deletion by users

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here.

Attribute	Value
Type	Hunting Query
Solution	Microsoft Defender XDR
ID	2bdd260c-c687-4cb2-9992-87e5ce677678
Tactics	Impact
Required Connectors	MicrosoftThreatProtection
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
CloudAppEvents	✓	✗	?
SigninLogs	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Microsoft Defender XDR