lukejjh/MicrosoftSentinel

An assortment of resources pertaining to Defender XDR and Microsoft Sentinel, such as KQL hunting queries and workbooks.

Microsoft Sentinel

This repository contains an assortment of resources pertaining to Defender XDR and Microsoft Sentinel, such as KQL hunting queries and workbooks.

Sentinel

📋 Queries

• Accounts with AAD admin roles signing in overseas
• Azure AD device registrations
• Azure DNS zone record changes
• Passive DNS search IP
• PIM activations

🛠️ Functions

• EmailInvestigateLinks
• CountryCodeLookup

📊 Workbooks

• Application Control

Defender XDR

📋 Queries

• Detect remote access software
• Discover browser extensions from device events
• Email events top sender domain TLDs
• Emails failing to deliver to SecOps mailbox
• Hunt links opened from PDFs
• Outlook to browser file opens
• Suspicious Windows script host execution
• Users added to local administrators group