Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This query finds matches in VMConnection Event data for known FileName Indicators of Compromise from Threat Intelligence sources. FileName matches may produce false positives, so use this for hunting rather than real-time detection.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Threat Intelligence (NEW) |
| ID | f231cbcd-66d9-45be-a6a3-4a915e53d46c |
| Tactics | Impact |
| Required Connectors | AzureMonitor(VMInsights), ThreatIntelligence, ThreatIntelligenceTaxii, MicrosoftDefenderThreatIntelligence |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
ThreatIntelIndicators |
✓ | ✓ | ✗ | |
VMConnection |
? | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Hunting Queries · Back to Threat Intelligence (NEW)