Adding new MDO related queries from recent Microsoft Threat Intellige…

[damozes1]

Adding new MDO related hunting queries from the recent Microsoft Threat Intelligence blog- File hosting services misused for identity phishing.

https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/

Required items, please complete

Change(s):

• Add 4 new hunting queries relevant to MDO to identify phishing attempts

Reason for Change(s):

• New hunting content from Microsoft Threat Intelligence

Testing Completed:

• Tested the queries in Defender XDR Advance hunting

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[v-shukore]

Hi @damozes1,

Please add the new hunting queries to the data file and repackage this solution using the V3 tool. You can refer to this https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md. Thanks...!!