Microsoft Sentinel medium experimental kql

Acronis - Multiple Inboxes with Malicious Content Detected

Many inboxes containing malicious content could indicate a potential ongoing phishing attack.

View Source

Detection Logic

CommonSecurityLog
| where DeviceVendor == "Acronis"
| where DeviceEventClassID in
("MaliciousURLDetectedInM365MailboxBackup",
"MalwareDetectedInM365MailboxBackup",
"MaliciousEmailDetectedPerceptionPointWarning")
| summarize MaliciousContent = count() by DeviceName

Field Validations

Loading…

Comments (0)

Loading comments...