Microsoft Sentinel high experimental kql

Google DNS - Possible data exfiltration

'Detects possible data exfiltration.'

View Source

Detection Logic

GCPCloudDNS
| where Query has 'webhook.site'
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...