Hunting Malicious Copilot Agent.kql

SlimKQL · Nov 23, 2024 · c8bf2e5 · c8bf2e5
1 parent 365f99b
commit c8bf2e5
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/Sentinel/Hunting Malicious Copilot Agent.kql b/Sentinel/Hunting Malicious Copilot Agent.kql
@@ -18,3 +18,7 @@ PowerPlatformAdminActivity
 | where EventOriginalType in ("BotCreate", "BotComponentCreate", "BotUpdateOperation-BotPublish")
 | where ActorName has_any(HighRiskUsers)
 
+
+
+
+// MITRE ATT&CK