IOC Hunting: Domain & URL Activity Sweep
This hunt identifies activity related to known malicious domains or URLs across network, email, and messaging telemetry over the past 30 days. It searches for domain-based IOCs within device network events, emails, and Microsoft Teams messages to highlight potential indicators of compromise (IOCs). It tracks delivery actions and recipients for further investigation.
Microsoft Sentinel (KQL)
