Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This query finds matches in Security Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rather than real-time detection.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Threat Intelligence (NEW) |
| ID | 10f83299-c4e6-4af8-9627-5f9448dee24a |
| Tactics | Impact |
| Required Connectors | SecurityEvents, ThreatIntelligence, ThreatIntelligenceTaxii, MicrosoftDefenderThreatIntelligence |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
EventID in "4648,4673,4688,8002" |
✓ | ✓ | ✓ |
ThreatIntelIndicators |
✓ | ✓ | ✗ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Hunting Queries · Back to Threat Intelligence (NEW)