Skip to content

Instantly share code, notes, and snippets.

@vikas891
Created March 26, 2024 14:15
Show Gist options
  • Save vikas891/624859aafed0d85ad88196a39410d101 to your computer and use it in GitHub Desktop.
Save vikas891/624859aafed0d85ad88196a39410d101 to your computer and use it in GitHub Desktop.
//Test Rule Logic 1
ObjectType = "process"
AND SrcProcParentName = "w3wp.exe"
AND SrcProcName In Contains Anycase ( "cmd.exe" , "powershell.exe" )
AND TgtProcName in Contains Anycase ( "ipconfig.exe" , "quser.exe" )
//Test Rule Logic 2
OfficeActivity
| where OfficeWorkload == “Exchange” and Operation == “Set-Mailbox”and Parameters has “DeliverToMailboxAndForward”
| extend Email = tostring(parse_json(Parameters)[1].Value)
| project TimeGenerated, OfficeWorkload, UserId, OfficeObjectId, Email
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment