KQL Search

Query Details

HomeAI ToolsDevice Query

MDO Authentication Details

Query

# Defender for Office 365 - Authentication Details

## Query Information

### Description

Use the below queries to get Authentication details from e-mail send thorugh Microsoft Defender for Office 365

#### References

- [Advanced Hunting: Surfacing more email data from Microsoft Defender for Office 365](https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/advanced-hunting-surfacing-more-email-data-from-microsoft/ba-p/2678118)

### Microsoft 365 Defender

Check for spoofing attempts on the domain with SPF fails

```kql
EmailEvents |where Timestamp > ago (1d) and DetectionMethods contains "spoof" and SenderFromDomain has "contoso.com" 
| project Timestamp, AR=parse_json(AuthenticationDetails) , NetworkMessageId, EmailDirection, Subject, SenderFromAddress, SenderIPv4,ThreatTypes, DetectionMethods, ThreatNames 
| evaluate bag_unpack(AR) 
| where SPF == "fail" 
```

Explanation

This query is used to check for spoofing attempts on a specific domain (contoso.com) within the last 24 hours. It retrieves email events that contain the keyword "spoof" in the detection methods and have a sender domain of "contoso.com". The query then projects specific fields such as timestamp, authentication details, network message ID, email direction, subject, sender address, sender IP address, threat types, detection methods, and threat names. It also unpacks the authentication details and filters the results to only include events where SPF (Sender Policy Framework) fails.

Details

Alex Verboon profile picture

Alex Verboon

Released: November 2, 2023

Tables

EmailEvents

Keywords

EmailEvents,Timestamp,DetectionMethods,SenderFromDomain,AR,NetworkMessageId,EmailDirection,Subject,SenderFromAddress,SenderIPv4,ThreatTypes,ThreatNames,SPF

Operators

whereTimestampagocontainshasprojectparse_jsonevaluatebag_unpack

Actions