TI map Email entity to SecurityAlert

Identifies a match in SecurityAlert table from any Email IOC from TI which will extend coverage to datatypes such as MCAS, StorageThreatProtection and many others

Detection logic

Detection requirements

Platform: Identity Provider Linux macOS Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: azuresecuritycenter microsoftdefenderthreatintelligence threatintelligence threatintelligencetaxii
Log source service: securityalert threatintelligenceindicator

Detection rules

TI map Email entity to SecurityAlert

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules