Midnight Blizzard
Query
BehaviorEntities
| where ThreatFamily contains "Midnight Blizzard"
| project Timestamp, BehaviorId, ActionType, Categories, ServiceSource, DetectionSource, DataSources, EntityType, EntityRole, DetailedEntityRole
),
(
AlertEvidence
| where ThreatFamily contains "Midnight Blizzard"
| project Timestamp, AlertId, Title, Categories, AttackTechniques, ServiceSource, DetectionSource, EntityType, EvidenceRole, EvidenceDirection, Severity
)About this query
//Checking for Midnight Blizzard impact in environment
union (
Explanation
This query is looking for any impact from the "Midnight Blizzard" threat in the environment by checking behavior entities and alert evidence related to this threat. It retrieves specific information such as timestamps, IDs, actions, categories, sources, and severity levels.