KQL Search

// DefenderXDR Advanced Hunting All-In-One UPN Search
// https://www.linkedin.com/pulse/defenderxdr-advanced-hunting-all-in-one-upn-search-steven-lim-zdlic/

// This KQL query searches across these DefenderXDR log tables for the UPN variable that is defined at the start:
// AlertEvidence, BehaviorEntities, BehaviorInfo, AADSignInEventsBeta, IdentityInfo, IdentityLogonEvents, UrlClickEvents, DeviceEvents, DeviceFileEvents, DeviceImageLoadEvents, DeviceLogonEvents, DeviceNetworkEvents, DeviceProcessEvents, DeviceRegistryEvents, CloudAppEvents, EmailAttachmentInfo, EmailEvents, EmailPostDeliveryEvents, CloudAuditEvents, ExposureGraphNodes

let upn = "[email protected]"; // Enter Your Search UPN
search in (AlertEvidence, BehaviorEntities, BehaviorInfo, AADSignInEventsBeta,
IdentityInfo, IdentityLogonEvents, UrlClickEvents, DeviceEvents, DeviceFileEvents,
DeviceImageLoadEvents, DeviceLogonEvents, DeviceNetworkEvents, DeviceProcessEvents,
DeviceRegistryEvents, CloudAppEvents, EmailAttachmentInfo, EmailEvents, 
EmailPostDeliveryEvents, CloudAuditEvents, ExposureGraphNodes)
Timestamp between (ago(1d) .. now())
and (
// AlertEvidence BehaviorEntities BehaviorInfo DeviceProcessEvents
// AADSignInEventsBeta IdentityInfo IdentityLogonEvents UrlClickEvents 
AccountUpn == upn
// DeviceEvents DeviceFileEvents DeviceImageLoadEvents DeviceLogonEvents
// DeviceNetworkEvents DeviceProcessEvents DeviceRegistryEvents 
or InitiatingProcessAccountUpn == upn
// CloudAppEvents
or tostring(RawEventData.UserId) == upn
// EmailAttachmentInfo EmailEvents EmailPostDeliveryEvents  
or SenderFromAddress == upn
or RecipientEmailAddress == upn
// CloudAuditEvents 
or RawEventData contains upn
//ExposureGraphNodes
or NodeProperties.rawData contains upn
)

// MITRE ATT&CK Mapping

// The query can be associated with several MITRE ATT&CK techniques based on the data sources and fields being queried:

// Credential Access:
// T1078: Valid Accounts - Searching for AccountUpn and InitiatingProcessAccountUpn can help detect unauthorized use of valid accounts.

// Initial Access:
// T1071: Application Layer Protocol - UrlClickEvents and EmailEvents can be used to detect phishing attempts or malicious links.

// Execution:
// T1059: Command and Scripting Interpreter - DeviceProcessEvents can help detect suspicious script execution.

// Persistence:
// T1078: Valid Accounts - Repeated logon events (DeviceLogonEvents) can indicate persistence mechanisms.

// Privilege Escalation:
// T1055: Process Injection - DeviceProcessEvents can be used to detect process injection techniques.

// Defense Evasion:
// T1070: Indicator Removal on Host - DeviceRegistryEvents can help detect attempts to modify registry keys to evade detection.

// Discovery:
// T1083: File and Directory Discovery - DeviceFileEvents can be used to detect file and directory discovery activities.

// Lateral Movement:
// T1021: Remote Services - DeviceNetworkEvents can help detect lateral movement through remote services.

// Collection:
// T1114: Email Collection - EmailEvents and EmailAttachmentInfo can be used to detect email collection activities.

// Exfiltration:
// T1041: Exfiltration Over C2 Channel - CloudAppEvents can help detect data exfiltration over cloud applications.

// Impact:
// T1486: Data Encrypted for Impact - DeviceFileEvents can help detect ransomware activities.