KQL Search

This query is designed to identify and list active malicious campaigns targeting a specific tenant by using data from the CampaignInfo table in Microsoft Defender for Office 365. Here's a simplified breakdown:

1. Purpose: The query reads from the CampaignInfo table to identify ongoing malicious campaigns that are targeting the tenant.

2. Pre-requisite: Before running the query, you should check the schema of the CampaignInfo table using CampaignInfo | getschema because the columns in this table can vary depending on the tenant or version. This step ensures that you adjust the query to match your specific schema.

3. Query Details:

   • It filters the data to include only records from the last 30 days.
   • It sorts the results by the timestamp in descending order to show the most recent campaigns first.
   • The query is conservative in its approach to avoid errors due to column mismatches, and it suggests extending the summarization once the schema is confirmed.

4. Triage: After identifying the campaigns, you should cross-reference them with EmailEvents and UrlClickEvents to assess the volume of emails delivered and the extent of user engagement with potentially malicious links.

5. Data Source: The query requires data from the MicrosoftThreatProtection connector, specifically the CampaignInfo data type.

6. Security Context: It focuses on tactics like Initial Access and Reconnaissance, and it relates to the technique T1566, which involves phishing.

Overall, this query helps security teams monitor and respond to phishing campaigns by providing insights into active threats targeting their organization.