Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRHard
A security analyst is investigating a sophisticated attack campaign targeting senior executives. The attackers are using highly customized spear-phishing emails containing unique, low-volume malicious attachments that bypass traditional antivirus signatures. The analyst needs to use Microsoft Defender for Office 365 to proactively search for emails containing these specific attachment characteristics across all mailboxes, including those already delivered. Which feature should the analyst use?
- AThreat Explorer (Explorer)
- BAutomated investigation and remediation (AIR)
- CMail flow rules (transport rules)
- DSubmission to Microsoft for analysis
Show answer & explanationAnswer & explanation
Correct answer: A. Threat Explorer (Explorer)
Threat Explorer (also known as Explorer) in Microsoft Defender for Office 365 provides a robust search and investigation tool that allows security analysts to proactively search for and filter email messages based on various attributes, including attachment characteristics, across all mailboxes, retroactively if needed. This is ideal for hunting for specific, low-volume threats that may have already been delivered.
Why the other options are wrong
- B. AIR automates response to alerts but is not a proactive hunting tool for specific email characteristics.
- C. Mail flow rules apply to email in transit and are used for policy enforcement, not for retrospective hunting or deep investigation of delivered emails.
- D. Submission to Microsoft for analysis is for reporting suspicious items and improving detection, not for proactive hunting across an organization's mailboxes.
Threat Explorer (Defender for Office 365)
A powerful security operations tool in Microsoft Defender for Office 365 that allows security teams to proactively investigate, hunt for, and remediate email-related threats across all mailboxes.
- Provides detailed views of email, attachments, and URLs.
- Enables filtering and searching across various email attributes.
- Supports remediation actions like soft deleting messages.
Memory trick: Threat Explorer is your email detective, searching everywhere for clues.