TI Map URL Entity to OfficeActivity Data [Deprecated]
This query is Deprecated as its filter conditions will never yield results. This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in OfficeActivity data.
Detection logic
Detection requirements
- Platform
- ESXiLinuxmacOSNetwork DevicesWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- microsoftdefenderthreatintelligenceoffice365threatintelligencethreatintelligencetaxii
- Log source service
- officeactivitythreatintelligenceindicator
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 36a9c9e5-3dc1-4ed9-afaa-1d13617bfc2b
- Tagged by the source as
- CommandAndControl
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1