---
name: Defender Advanced Hunting Pack
description: Run curated read-only Microsoft Defender XDR advanced hunting KQL queries to surface anomalous sign-ins, suspicious inbox rules and risky OAuth grants.
---

# Defender Advanced Hunting Pack

> **TL;DR:** This skill runs a curated set of read-only KQL queries in Microsoft Defender XDR advanced hunting to surface anomalous sign-ins, suspicious inbox rules and risky OAuth grants, then summarises the findings with a simple risk score.

## What does the Microsoft Defender XDR advanced hunting pack do?

Microsoft Defender XDR advanced hunting is a query-based threat hunting tool that lets you explore up to 30 days of raw telemetry across Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, Microsoft Defender for Identity and Microsoft Sentinel. This skill packages vetted, read-only Kusto Query Language (KQL) queries that pivot across the `AADSignInEventsBeta`, `CloudAppEvents` and `IdentityLogonEvents` tables. It surfaces common identity-led threats, such as impossible-travel sign-ins, newly created inbox forwarding rules in Exchange Online and consent grants to risky OAuth applications. Nothing is changed in the tenant; the skill only reads and summarises.

## When should you run this skill?

- "Show me any anomalous or impossible-travel sign-ins from the last week."
- "Have any suspicious inbox forwarding or deletion rules been created recently?"
- "Did anyone consent to a risky or over-privileged OAuth application?"
- "Run a quick identity threat sweep across Defender XDR before the security review."
- "Summarise the riskiest sign-in and mailbox activity for the executive team."
- "Triage a suspected account compromise using advanced hunting telemetry."
- "Check for unusual mail-flow rules after a reported phishing incident."

## How this skill works, step by step

1. Confirm the operator holds a read-only hunting role and that Microsoft Defender XDR advanced hunting is enabled for the tenant.
2. Open advanced mode in the Microsoft Defender portal under Hunting, then Advanced hunting.
3. Run the anomalous sign-in query against `AADSignInEventsBeta`, filtering for risky sign-in levels, failed multi-factor challenges and atypical locations over the chosen time window.
4. Run the suspicious inbox rule query against `CloudAppEvents`, looking for `New-InboxRule` and `Set-InboxRule` actions that forward, redirect or delete mail.
5. Run the risky OAuth grant query against `CloudAppEvents` for consent and add-service-principal events, flagging applications requesting high-privilege scopes or from unverified publishers.
6. Apply time filters and `kind=inner` joins per Microsoft best practices to keep each query efficient and within CPU quotas.
7. Tag each returned row with a severity weight (high, medium, low) based on the signal that matched.
8. Derive a per-finding risk score from the severity weight multiplied by a recency factor, then aggregate counts per category.
9. Compile the results into a single read-only summary table and bullet list, with no response actions taken.

## Output format

The skill returns a findings table followed by a short summary. Each row is one hunting hit mapped to a category and a derived risk score (1 to 100, higher is riskier).

| Timestamp (UTC) | Category | Account | Signal | Severity | Risk score |
| --- | --- | --- | --- | --- | --- |
| 2026-05-28 02:14 | Anomalous sign-in | `j.smith@contoso.com` | Risky sign-in from new country, MFA failed | High | 92 |
| 2026-05-29 09:41 | Suspicious inbox rule | `a.patel@contoso.com` | New-InboxRule forwarding all mail externally | High | 88 |
| 2026-05-30 16:05 | Risky OAuth grant | `m.lee@contoso.com` | Consent to unverified app requesting `Mail.ReadWrite` | Medium | 64 |

Summary of the run:

- Total findings by category, with counts for anomalous sign-ins, suspicious inbox rules and risky OAuth grants.
- The highest-scoring finding and the account involved.
- The time window queried and the tables used.
- A recommendation to investigate any finding scoring 70 or above first.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Advanced hunting in Microsoft Defender XDR | Microsoft 365 E5, Microsoft 365 E5 Security, or Microsoft Defender for Endpoint Plan 2 |
| Sign-in and identity telemetry (`AADSignInEventsBeta`) | Microsoft Entra ID P1 (P2 for full risky sign-in detail) |
| Cloud app and OAuth telemetry (`CloudAppEvents`) | Microsoft Defender for Cloud Apps |

### Least-privilege roles

- Security Reader (Microsoft Entra directory role) for read-only access to the Defender portal and advanced hunting.
- Security Operator may be used where the operator also needs to view incidents, but no write or response action is required by this skill.

### Microsoft Graph permissions (read-only)

This skill is operated through the Microsoft Defender portal advanced hunting interface (or the `runHuntingQuery` Microsoft Graph security action), not through directory write operations. The following read-only scopes apply when querying via Microsoft Graph:

- `ThreatHunting.Read.All` — runs advanced hunting KQL queries against Microsoft Defender XDR tables.
- `SecurityEvents.Read.All` — reads related security alerts and events for context.

## Scope and safety

This skill is read-only by default. It queries advanced hunting telemetry and summarises findings; it never modifies sign-in policy, mailbox rules, app consent or any other tenant configuration.

This skill does NOT:

- Disable accounts, revoke sessions or reset credentials.
- Delete, modify or quarantine inbox rules or mail-flow rules.
- Revoke OAuth grants, remove service principals or change app consent.
- Create custom detection rules or take any automated response action.

## Sources and compliance

- [Advanced hunting overview (Microsoft Defender XDR)](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview)
- [Advanced hunting query best practices](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-best-practices)
- Maps to Essential Eight: Restrict Microsoft Office macros and Multi-factor authentication monitoring objectives, primarily supporting detection that reinforces the multi-factor authentication and restrict administrative privileges controls. See the [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model).
- Aligns with ISM event logging and monitoring guidance for detecting anomalous authentication and email activity.
- Output in Australian English.