Updated and added new Hunting Queries in Microsoft Defender XDR solution. Also corrected the incorrect mapping of dataTypes: EmailEvents with connectorId: OfficeATP across multiple Hunting Queries.

[v-utpalkumar]

Change(s):

• Updated the Hunting Query Punycode chars lookalike domains. Also added new Hunting Queries Hunt for RMM tool execution following Teams messages, Hunt for alerts correlated with Teams messages and Identify acting user for reported phish.
• Corrected the incorrect mapping of dataTypes: EmailEvents with connectorId: OfficeATP across multiple Hunting Queries.

Reason for Change(s):

• Updated and newley added Hunting Queries Punycode chars lookalike domains, Hunt for RMM tool execution following Teams messages, Hunt for alerts correlated with Teams messages and Identify acting user for reported phish.
• Incorrect mapping of dataTypes: EmailEvents with connectorId: OfficeATP across multiple Hunting Queries.

Version Updated:

• Yes

Testing Completed:

• Yes, please refer the document attached to the work item.

Checked that the validations are passing and have addressed any issues that are present:

• Yes