Clicking on the name of the query will bring you to the file for it in this git repo.
Or try them out right away in your M365 Security tenant:
Click on the '🔎' hotlink to plug the query right into your Advanced Hunting Query page
- Searches for connections to specific webmail URLs
- Personal email usage may be problematic due to lack of phishing protection
- Looks for Gmail, Yahoo, and ProtonMail by default
- Identify people who are potentially looking to leave the company based on sites contacted
- Employees who are leaving may be trying to take data with them to their next job
- Arbitrarily scores each employee based on frequency and confidence
- Employees with a high total Count are spending a lot of time job or house hunting, or both
- The House/Job Ratio (HJR) indicates how you should interpret each employee's activity
- Employees with a LOW House/Job Ratio are likely early in their job search
- Employees with a HIGH House/Job Ratio are either just looking at houses or are leaving soon
- Use Confidence (seen applying for jobs) when considering employees with a HIGH HJR
- Track this list over time to identify employees that tranistion from a LOW HJR to a HIGH HJR
- Identify people who spend the most time browsing social media sites
- Looks for Facebook, Twitter, Reddit, and LinkedIn by default
- See all the WiFi network names that your devices are connected to