Microsoft Sentinel medium experimental kql

Trend Micro CAS - Possible phishing mail

'Detects possible phishing mail.'

View Source

Detection Logic

let threshold = 5;
TrendMicroCAS
| where EventCategoryType in~ ('exchange', 'gmail', 'exchangeserver')
| where isnotempty(SrcFileName)
| where isnotempty(SecurityRiskName)
| summarize r_users = makeset(DstUserName) by SrcFileName, bin(TimeGenerated, 30m)
| where array_length(r_users) > threshold
| extend AccountCustomEntity = r_users

Field Validations

Loading…

Comments (0)

Loading comments...