Defender investigation reference fragments
Find the Defender Advanced Hunting entry point, file-search fragment and SmartScreen guide. The antimalware item contains a policy link and missing image, not a complete email-investigation query.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
Contents – MS Defender
Provides some basics on how to do a few things in Defender.
- How to unblock a website that is getting blocked by SmartScreen
- How to use some KQL to do some hunting in Defenders Advanced Hunting
Where is Advanced Hunting
In MS Defender
https://security.microsoft.com/v2/advanced-hunting
OR https://security.microsoft.com/ Investigation and Response -> Hunting -> Advanced Hunting
Find Emails Blocked By AntiMalware Policy (HasAttachment)
The Antimalware policy
Email Attachment Blocking
https://security.microsoft.com/antimalwarev2
Image alternative text: web content
Missing source images
1 image record(s) in this source have no resolved payload. Available alternative text is retained; the missing pixels have not been recreated.
Find a File
DeviceFileEvents
| where FileName contains "infatica"
| project Timestamp,ActionType,ProductName = InitiatingProcessVersionInfoProductName, ProcessDescription = InitiatingProcessVersionInfoFileDescription ,ParentFileName = InitiatingProcessParentFileName,ParentProcessCreationTime = InitiatingProcessParentCreationTime,FileName,FolderPath,InitiatingProcessAccountUpn
Email & Collaboration - Explorer
Explorer was previously called ThreatExplorer
You can find it here
https://security.microsoft.com/threatexplorerv3
OR https://security.microsoft.com/ -> Email & Collaboration -> Explorer
In here you can see what URL's people clicked on across various phishing campaigns.