🔥 3-day streak
Microsoft Security Operations Analyst92 / 190
Question 92 of 190

A SOC analyst in Microsoft Defender XDR Advanced Hunting is investigating a business email compromise (BEC) campaign. A compromised internal mailbox is suspected of sending malicious emails to other employees inside the same organization. The analyst writes a query against the EmailEvents table but wants to isolate only messages that originated from an internal sender and were delivered to another internal recipient (intra-organizational messages), excluding inbound mail from external domains. Which filter condition should the analyst add to the EmailEvents query?

Reviewed for accuracy · Report an issueNext question