Microsoft Defender 的進階獵捕功能允許你主動搜尋以下威脅：
- 由適用於端點的 Microsoft Defender 管理的裝置
- Microsoft 365 處理的電子郵件
- 雲端應用程式活動、認證事件及網域控制器活動，皆由 Microsoft Defender for Cloud Apps 與 適用於身分識別的 Microsoft Defender 追蹤
透過跨裝置、電子郵件、雲端應用程式、驗證事件及網域控制活動的可視性，你可以快速搜尋跨越網路各區段的威脅，包括透過電子郵件或網頁進入、提升本地權限、取得特權網域憑證，並在裝置間橫向移動的複雜入侵。
以下是基於各種狩獵情境的通用技巧與範例查詢，幫助你探索在尋找這些複雜威脅時如何構建查詢。
取得實體資訊
利用這些查詢來學習如何快速取得使用者帳號、裝置和檔案的資訊。
從電子郵件地址取得使用者帳戶
在涵蓋裝置和電子郵件的表格建立查詢時，您可能需要取得寄件者或收件者電子郵件地址的使用者帳戶名稱。 通常你可以用電子郵件地址的 本地主機 ，對收件人或寄件人地址進行此操作。
在下方的程式碼片段中，我們使用 tostring() Kusto 函式，從 @ 欄中的收件者電子郵件地址擷取緊接在 RecipientEmailAddress 前面的本機主機名稱。 以下片段會擷取帳號名稱 RecipientEmailAddress ，讓你能以身份或裝置資料重用於連結：
//Query snippet showing how to extract the account name from an email address
AccountName = tostring(split(RecipientEmailAddress, "@")[0])
以下範例查詢在查詢 EmailEvents 中使用了這個帳號名稱擷取片段：
EmailEvents
| where Timestamp > ago(7d)
| project RecipientEmailAddress, AccountName = tostring(split(RecipientEmailAddress, "@")[0]);
合併 IdentityInfo 表格
您可以透過合併或加入 IdentityInfo 表格來取得帳號名稱及其他帳號資訊。 以下查詢會從 EmailEvents 表格 取得釣魚與惡意軟體偵測清單，並將該資訊與 IdentityInfo 表格合併，以獲得每位收件人的詳細資訊。
EmailEvents
| where Timestamp > ago(7d)
//Get email processing events where the messages were identified as either phishing or malware
| where ThreatTypes has "Malware" or ThreatTypes has "Phish"
//Merge email events with identity info to get recipient details
| join (IdentityInfo | distinct AccountUpn, AccountDisplayName, JobTitle,
Department, City, Country) on $left.RecipientEmailAddress == $right.AccountUpn
//Show important message and recipient details
| project Timestamp, NetworkMessageId, Subject, ThreatTypes,
SenderFromAddress, RecipientEmailAddress, AccountDisplayName, JobTitle,
Department, City, Country
觀看這支關於用 Kusto Query Language 連接表格的影片，了解更多。
取得裝置資訊
進階狩獵結構在各種表格中提供大量裝置資訊。 例如， DeviceInfo 表格 提供基於定期彙整事件資料的完整裝置資訊。 此查詢會利用表格 DeviceInfo 檢查是否有潛在被入侵的使用者（）<account-name>登入任何裝置，然後列出該使用者登入裝置上觸發的警報。
提示
此查詢使用 kind=inner 來指定 內部聯結，這會避免針對 DeviceId 對左側值進行去重複。
DeviceInfo
//Query for devices that the potentially compromised account has logged onto
| where LoggedOnUsers contains '<account-name>'
| distinct DeviceId
//Crosscheck devices against alert records in AlertEvidence and AlertInfo tables
| join kind=inner AlertEvidence on DeviceId
| project AlertId
//List all alerts on devices that user has logged on to
| join AlertInfo on AlertId
| project AlertId, Timestamp, Title, Severity, Category
取得檔案事件資訊
請使用以下查詢查詢檔案相關事件的資訊。
DeviceInfo
| where Timestamp > ago(1d)
| where ClientVersion startswith "20.1"
| summarize by DeviceId
| join kind=inner (
DeviceFileEvents
| where Timestamp > ago(1d)
) on DeviceId
| take 10
獲取網路活動資訊
請使用以下查詢以獲取與網路相關的事件資訊。
DeviceInfo
| where Timestamp > ago(1d)
| where ClientVersion startswith "20.1"
| summarize by DeviceId
| join kind=inner (
DeviceNetworkEvents
| where Timestamp > ago(1d)
) on DeviceId
| take 10
取得裝置代理版本資訊
請使用以下查詢取得裝置上執行的代理版本。
DeviceInfo
| where Timestamp > ago(1d)
| where ClientVersion startswith "20.1"
| summarize by DeviceId
| join kind=inner (
DeviceNetworkEvents
| where Timestamp > ago(1d)
) on DeviceId
| take 10
macOS 裝置的範例查詢
請使用以下範例查詢，查看所有運行 macOS 且版本比 Catalina 早的裝置。
DeviceInfo
| where Timestamp > ago(1d)
| where OSPlatform == "macOS" and OSVersion !contains "10.15" and OSVersion !contains "11."
| summarize by DeviceId
| join kind=inner (
DeviceInfo
| where Timestamp > ago(1d)
) on DeviceId
| take 10
取得裝置狀態資訊
請使用以下查詢，透過查詢 DeviceInfo 資料表並對 OnboardingStatus進行過濾，檢查裝置是否已接入。
DeviceInfo
| where Timestamp > ago(1d)
| where OnboardingStatus != "Onboarded"
| summarize by DeviceId
| join kind=inner (
DeviceInfo
| where Timestamp > ago(1d)
) on DeviceId
| take 10
狩獵情境
以下範例查詢涵蓋涵蓋電子郵件、身份及裝置資料的常見威脅狩獵調查。
列出收到之電子郵件未經 ZAP 成功清除的使用者登入活動
零時自動清除 (ZAP) 會在收到的惡意郵件後處理。 若 ZAP 失敗，惡意程式碼最終可能在接收者的裝置上運行，導致帳號遭入侵。 此查詢會檢查未由 ZAP 成功處理之電子郵件的收件人所進行的登入活動。
EmailPostDeliveryEvents
| where Timestamp > ago(7d)
//List malicious emails that were not zapped successfully
| where ActionType has "ZAP" and ActionResult == "Error"
| project ZapTime = Timestamp, ActionType, NetworkMessageId , RecipientEmailAddress
//Get logon activity of recipients using RecipientEmailAddress and AccountUpn
| join kind=inner IdentityLogonEvents on $left.RecipientEmailAddress == $right.AccountUpn
| where Timestamp between ((ZapTime-24h) .. (ZapTime+24h))
//Show only pertinent info, such as account name, the app or service, protocol, the target device, and type of logon
| project ZapTime, ActionType, NetworkMessageId , RecipientEmailAddress, AccountUpn,
LogonTime = Timestamp, AccountDisplayName, Application, Protocol, DeviceName, LogonType
取得認證竊取鎖定之網域帳戶的登入嘗試
此查詢首先識別表格中 AlertInfo 所有憑證存取警示。 接著，它會合併或聯結 AlertEvidence 資料表，從中剖析目標帳號的名稱，並僅篩選已加入網域的帳號。 最後，它會檢查 IdentityLogonEvents 資料表，以取得已加入網域的目標帳號的所有登入活動。
AlertInfo
| where Timestamp > ago(30d)
//Get all credential access alerts
| where Category == "CredentialAccess"
//Get more info from AlertEvidence table to get the SID of the target accounts
| join AlertEvidence on AlertId
| extend IsJoined=(parse_json(AdditionalFields).Account.IsDomainJoined)
| extend TargetAccountSid=tostring(parse_json(AdditionalFields).Account.Sid)
//Filter for domain-joined accounts only
| where IsJoined has "true"
//Merge with IdentityLogonEvents to get all logon attempts by the potentially compromised target accounts
| join kind=inner IdentityLogonEvents on $left.TargetAccountSid == $right.AccountSid
//Show only pertinent info, such as account name, the app or service, protocol, the accessed device, and type of logon
| project AccountDisplayName, TargetAccountSid, Application, Protocol, DeviceName, LogonType
檢查裝置上是否有來自已知惡意寄件者的檔案
假設你知道有個電子郵件地址會寄出惡意檔案 (MaliciousSender@example.com) ，你可以執行這個查詢，判斷該寄件人是否存在你的裝置上的檔案。 例如，你可以用這個查詢來識別受惡意軟體散布活動影響的裝置。
EmailAttachmentInfo
| where SenderFromAddress =~ "MaliciousSender@example.com"
//Get emails with attachments identified by a SHA-256
| where isnotempty(SHA256)
| join (
//Check devices for any activity involving the attachments
DeviceFileEvents
| project FileName, SHA256, DeviceName, DeviceId
) on SHA256
| project Timestamp, FileName , SHA256, DeviceName, DeviceId, NetworkMessageId, SenderFromAddress, RecipientEmailAddress
檢閱收到惡意電子郵件後的登入嘗試
此查詢會在收到已知的惡意電子郵件後，尋找 30 分鐘內由電子郵件收件者執行的最近 10 次登入。 您可以使用此查詢來檢查電子郵件收件者的帳戶是否遭入侵。
//Define new table for malicious emails
let MaliciousEmails=EmailEvents
//List emails detected as malware, getting only pertinent columns
| where ThreatTypes has "Malware"
| project TimeEmail = Timestamp, Subject, SenderFromAddress, AccountName = tostring(split(RecipientEmailAddress, "@")[0]);
MaliciousEmails
| join (
//Merge malicious emails with logon events to find logons by recipients
IdentityLogonEvents
| project LogonTime = Timestamp, AccountName, DeviceName
) on AccountName
//Check only logons within 30 minutes of receipt of an email
| where (LogonTime - TimeEmail) between (0min.. 30min)
| take 10
在收到已知惡意寄件者的電子郵件後檢閱 PowerShell 活動
惡意電子郵件通常包含文件和其他精心設計的附件，以執行 PowerShell 命令來提供額外的承載。 如果你知道有來自已知惡意寄件人 (MaliciousSender@example.com) 的郵件，你可以利用此查詢列出並檢視在收到郵件後 30 分鐘內發生的 PowerShell 活動。
//Define new table for emails from specific sender
let EmailsFromBadSender=EmailEvents
| where SenderFromAddress =~ "MaliciousSender@example.com"
| project TimeEmail = Timestamp, Subject, SenderFromAddress, AccountName = tostring(split(RecipientEmailAddress, "@")[0]);
//Merge emails from sender with process-related events on devices
EmailsFromBadSender
| join (
DeviceProcessEvents
//Look for PowerShell activity
| where FileName =~ "powershell.exe"
//Add line below to check only events initiated by Outlook
//| where InitiatingProcessParentFileName =~ "outlook.exe"
| project TimeProc = Timestamp, AccountName, DeviceName, InitiatingProcessParentFileName, InitiatingProcessFileName, FileName, ProcessCommandLine
) on AccountName
//Check only PowerShell activities within 30 minutes of receipt of an email
| where (TimeProc - TimeEmail) between (0min.. 30min)
相關內容
提示
想要深入了解? 請到我們的技術社群中與 Microsoft 安全性社群互動: Microsoft Defender 全面偵測回應技術社群。