Microsoft Sentinel high experimental kql

Digital Guardian - Exfiltration using DNS protocol

'Detects exfiltration using DNS protocol.'

View Source

Detection Logic

DigitalGuardianDLPEvent
| where DstPortNumber == 53
| extend AccountCustomEntity = SrcUserName

Field Validations

Loading…

Comments (0)

Loading comments...