Security Operations Center (SOC) Guide Security Operations Center (SOC) Guide

$UserUpn = "user@contoso.com"
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Identity.SignIns
Import-Module ExchangeOnlineManagement
Connect-MgGraph -Scopes "User.ReadWrite.All","AuditLog.Read.All","Directory.Read.All"
Connect-ExchangeOnline
Get-MgAuditLogSignIn -Filter "userPrincipalName eq '$UserUpn'" -All |
    Select CreatedDateTime,AppDisplayName,IPAddress,ClientAppUsed,ConditionalAccessStatus,Status
Get-MgRiskyUser -Filter "userPrincipalName eq '$UserUpn'"
Get-MgIdentityProtectionRiskDetection -Filter "userPrincipalName eq '$UserUpn'" -All |
    Select ActivityDateTime,RiskType,RiskLevel,RiskState,Location
Get-InboxRule -Mailbox $UserUpn |
    Select Name,Enabled,Priority,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage
Get-EXOMailbox -Identity $UserUpn |
    Select UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward
Get-MailboxPermission -Identity $UserUpn |
    Where-Object { -not $_.IsInherited } |
    Select User,AccessRights,Deny,IsInherited
Get-RecipientPermission -Identity $UserUpn |
    Select Trustee,AccessRights,IsInherited
Revoke-MgUserSignInSession -UserId $UserUpn
# Update-MgUser -UserId $UserUpn -AccountEnabled:$false
# Update-MgUser -UserId $UserUpn -PasswordProfile @{ ForceChangePasswordNextSignIn = $true; Password = 'Use-A-Secure-Temporary-Password!' }
# Remove-InboxRule -Mailbox $UserUpn -Identity "Suspicious Rule Name" -Confirm:$false
Get-MgUserAuthenticationMethod -UserId $UserUpn
[PSCustomObject]@{
    User = $UserUpn
    SessionRevoked = $true
    MailboxRulesReviewed = $true
    ForwardingReviewed = $true
}

$Mailbox = "user@contoso.com"
$StartDate = (Get-Date).AddDays(-14)
Import-Module ExchangeOnlineManagement
Import-Module Microsoft.Graph.Identity.SignIns
Connect-ExchangeOnline
Connect-MgGraph -Scopes "AuditLog.Read.All","User.Read.All"
Get-EXOMailbox -Identity $Mailbox |
    Select UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward,AuditEnabled
Get-InboxRule -Mailbox $Mailbox |
    Select Name,Enabled,Priority,ForwardTo,ForwardAsAttachmentTo,RedirectTo,MoveToFolder,DeleteMessage
Get-MailboxPermission -Identity $Mailbox |
    Where-Object { -not $_.IsInherited } |
    Select User,AccessRights,Deny,InheritanceType
Get-RecipientPermission -Identity $Mailbox |
    Select Trustee,AccessRights,IsInherited
Search-UnifiedAuditLog -StartDate $StartDate -EndDate (Get-Date) -UserIds $Mailbox -RecordType ExchangeItem |
    Select CreationDate,Operations,UserIds,AuditData -First 200
Get-MgAuditLogSignIn -Filter "userPrincipalName eq '$Mailbox'" -All |
    Select CreatedDateTime,AppDisplayName,IPAddress,ClientAppUsed,ConditionalAccessStatus,Status

AADSignInEventsBeta
| where Timestamp > ago(24h)
| where ResultType != 0
| summarize Failed=count(), Users=dcount(AccountUpn) by Country=tostring(LocationDetails.countryOrRegion), IPAddress
| order by Failed desc

AADSignInEventsBeta
| where Timestamp > ago(24h)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Countries=make_set(tostring(LocationDetails.countryOrRegion), 5) by AccountUpn
| where array_length(Countries) > 1 and datetime_diff('hour', LastSeen, FirstSeen) < 6

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType in~ ('New-InboxRule','Set-InboxRule')
| where RawEventData has_any ('ForwardTo','RedirectTo','ForwardAsAttachmentTo')
| project Timestamp, AccountDisplayName, ActivityType, RawEventData

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType has_any ('Consent to application','Add delegated permission grant')
| where RawEventData has_any ('Mail.Read','Files.ReadWrite.All','offline_access','User.Read.All')
| project Timestamp, AccountDisplayName, ObjectName, RawEventData

CloudAppEvents
| where Timestamp > ago(12h)
| where Application has_any ('SharePoint','OneDrive')
| where ActivityType has_any ('FileDownloaded','FileSyncDownloadedFull')
| summarize Downloads=count() by AccountDisplayName, bin(Timestamp, 30m)
| where Downloads > 100

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType has_any ('Set-Mailbox','New-InboxRule','Set-InboxRule')
| where RawEventData has '@' and RawEventData !has 'contoso.com'

IdentityDirectoryEvents
| where Timestamp > ago(7d)
| where ActionType has_any ('Add member to role','Add eligible member to role')
| project Timestamp, InitiatingAccountUpn, TargetAccountUpn, TargetRoleName, ActionType

CloudAppEvents
| where Timestamp > ago(7d)
| where Application == 'Microsoft Entra admin center'
| where ActivityType has_any ('Add conditional access policy','Update conditional access policy','Delete conditional access policy')

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType has_any ('User registered security info','Delete authentication method','Update default authentication method')
| project Timestamp, AccountDisplayName, ActivityType, ObjectName, IPAddress

CloudAppEvents
| where Timestamp > ago(12h)
| where ActivityType == 'MailItemsAccessed'
| summarize Events=count() by AccountDisplayName, bin(Timestamp, 30m)
| where Events > 500

AADSignInEventsBeta
| where Timestamp > ago(6h)
| where ResultType != 0
| summarize Failed=count() by AccountUpn, IPAddress
| where Failed > 20

AADSignInEventsBeta
| where Timestamp > ago(6h)
| where ResultType != 0
| summarize FailedAttempts=count(), TargetUsers=dcount(AccountUpn) by IPAddress
| where FailedAttempts > 25 and TargetUsers > 10

let clicks = UrlClickEvents | where Timestamp > ago(24h) | project AccountUpn, ClickTime=Timestamp, Url;
AADSignInEventsBeta
| where Timestamp > ago(24h)
| where ResultType == 0
| join kind=inner clicks on AccountUpn
| where Timestamp between (ClickTime .. ClickTime + 2h)

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('powershell.exe','pwsh.exe')
| where ProcessCommandLine has_any ('-enc','EncodedCommand','DownloadString','Invoke-Expression')

EmailAttachmentInfo
| where Timestamp > ago(24h)
| summarize Attachments=count(), Size=sum(FileSize) by SenderFromAddress, RecipientEmailAddress
| where Size > 100000000

AADSignInEventsBeta
| where Timestamp > ago(7d)
| where RiskLevelAggregated has_any ('high','medium')
| summarize Events=count() by AccountUpn, AuthenticationRequirement

AADSpnSignInEventsBeta
| where Timestamp > ago(14d)
| summarize Countries=make_set(tostring(LocationDetails.countryOrRegion), 10), Count=count() by ServicePrincipalName
| where array_length(Countries) > 1

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType has_any ('Consent to application','Add delegated permission grant')
| summarize Users=dcount(AccountDisplayName) by ObjectName, bin(Timestamp, 1d)
| where Users > 5

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType has_any ('Add-MailboxPermission','Add-RecipientPermission','Set-Mailbox')
| project Timestamp, AccountDisplayName, ActivityType, ObjectName, RawEventData

CloudAppEvents
| where Timestamp > ago(14d)
| where ActivityType has_any ('Set-AdminAuditLogConfig','Disable mailbox auditing','Update audit settings')

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType has_any ('New-TransportRule','Set-TransportRule')
| where RawEventData has_any ('BlindCopyTo','RedirectMessageTo')

UrlClickEvents
| where Timestamp > ago(7d)
| summarize Clicks=count(), Users=dcount(AccountUpn) by Url, ActionType
| order by Clicks desc

let risky = AADSignInEventsBeta | where Timestamp > ago(24h) | where RiskLevelAggregated has_any ('high','medium') | project AccountUpn, RiskTime=Timestamp;
AADSignInEventsBeta
| where Timestamp > ago(24h)
| where ResultType == 0
| join kind=inner risky on AccountUpn
| where Timestamp between (RiskTime .. RiskTime + 1h)

AADSignInEventsBeta
| where Timestamp > ago(30d)
| summarize LastSeen=max(Timestamp) by AccountUpn
| where LastSeen > ago(1d)

CloudAppEvents
| where Timestamp > ago(7d)
| where AccountType =~ 'Guest' and Application has_any ('SharePoint','OneDrive')
| summarize Sites=dcount(ObjectName), Events=count() by AccountDisplayName
| where Sites > 20

DeviceFileEvents
| where Timestamp > ago(12h)
| where ActionType in~ ('FileDeleted','FileRemoved')
| summarize Deletes=count() by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 30m)
| where Deletes > 200

IdentityDirectoryEvents
| where Timestamp > ago(7d)
| where ActionType has_any ('Activate eligible assignment','Add member to role')
| extend Hour=datetime_part('hour', Timestamp)
| where Hour < 6 or Hour > 20

CloudAppEvents
| where Timestamp > ago(7d)
| where ActivityType == 'Set-Mailbox'
| where RawEventData has 'ForwardingSmtpAddress'
| project Timestamp, AccountDisplayName, RawEventData

AADSignInEventsBeta
| where Timestamp > ago(14d)
| where ClientAppUsed has_any ('IMAP','POP','SMTP','ActiveSync')
| summarize Attempts=count() by AccountUpn, ClientAppUsed

AADSignInEventsBeta
| where Timestamp > ago(24h)
| summarize Agents=make_set(UserAgent, 10), Devices=make_set(DeviceName, 10) by AccountUpn
| where array_length(Agents) > 3 or array_length(Devices) > 3

AADSpnSignInEventsBeta
| where Timestamp > ago(24h)
| summarize Failures=countif(ResultType != 0), Total=count() by ServicePrincipalName, AppId
| where Failures > 20