Microsoft Defender XDR Boosts Threat Detection with New Campaign and Malicious File Data Tables

Microsoft has recently announced the addition of two significant data tables—CampaignInfo and FileMaliciousContentInfo—to its Defender XDR advanced hunting capabilities. This enhancement aims to bolster threat detection and investigation within Microsoft 365 environments, providing security operations center (SOC) teams with deeper insights into email-based threats and malicious file activities.

CampaignInfo Table: Enhancing Email Campaign Detection​

The CampaignInfo table is a pivotal advancement in email security monitoring. It offers comprehensive data on email campaigns identified by Microsoft Defender for Office 365, integrating seamlessly into the existing Email & Collaboration schema within the advanced hunting framework. This integration empowers security teams to gain detailed insights into coordinated email attack campaigns.
Key Features:

• Unique Campaign Identifiers: Each campaign is assigned a distinct identifier, facilitating precise tracking and analysis.
• Campaign Metadata: Information such as campaign names, types, and associated network message IDs are provided, enabling a thorough understanding of the campaign's characteristics.
• Correlation Capabilities: Security teams can correlate email events with campaign data, allowing for a comprehensive assessment of the scope and impact of coordinated attacks targeting their organizations.

By leveraging the CampaignInfo table, SOC analysts can investigate threats more effectively, identifying patterns and tactics used in email-based attacks. This proactive approach enhances the organization's ability to mitigate risks associated with phishing and other email-borne threats.

FileMaliciousContentInfo Table: Addressing Cloud File Threats​

The FileMaliciousContentInfo table focuses on detecting malicious files across Microsoft's cloud collaboration platforms, including SharePoint Online, OneDrive, and Microsoft Teams. This addition addresses the growing need for comprehensive file-based threat monitoring in hybrid work environments where cloud file sharing is integral.
Key Features:

• Malicious File Detection: Provides detailed information about files identified as malicious by Defender for Office 365 across the Microsoft 365 ecosystem.
• Enhanced Visibility: Offers insights into malicious content within cloud storage and collaboration platforms, enabling faster response times and more comprehensive threat investigations.

With the FileMaliciousContentInfo table, security teams can swiftly identify and respond to threats embedded in cloud-shared files, thereby strengthening the organization's overall security posture.

Rollout Schedule and Availability​

Microsoft has outlined a phased rollout schedule for these new capabilities:

• Public Preview: Commencing in early June 2025, with completion expected by late June 2025.
• General Availability: Planned for early July 2025, with worldwide deployment expected to be completed by late July 2025.

The rollout encompasses all Microsoft cloud environments, including Worldwide, Government Community Cloud (GCC), GCC High, and Department of Defense (DoD) deployments. These new tables will be available by default, requiring no administrative action for implementation. SOC teams will immediately gain access to enhanced threat hunting capabilities through the familiar advanced hunting interface.

Implications for Security Operations​

The introduction of the CampaignInfo and FileMaliciousContentInfo tables signifies a substantial enhancement to Microsoft Defender XDR's threat hunting capabilities. Advanced hunting serves as a critical component of modern threat detection, allowing security teams to proactively inspect up to 30 days of raw data to locate threat indicators and entities. The new tables expand this capability specifically for email campaign analysis and cloud file threat investigation.
These enhancements reinforce Microsoft Defender XDR's position as a comprehensive threat hunting platform, joining existing tables that cover endpoint, identity, and cloud application security events. The integration ensures security teams can maintain a unified approach to threat investigation across all Microsoft 365 workloads.

Conclusion​

Microsoft's addition of the CampaignInfo and FileMaliciousContentInfo tables to Defender XDR's advanced hunting capabilities marks a significant step forward in enhancing threat detection and investigation within Microsoft 365 environments. By providing deeper visibility into email-based threats and malicious file activities, these new tables empower SOC teams to respond more effectively to evolving cyber threats. As organizations continue to navigate the complexities of hybrid work environments, such advancements are crucial in maintaining robust security postures.

---

Source: CybersecurityNews Microsoft Defender XDR New Advanced Hunting Tables for Email and Cloud Protections