Closed mezzofix closed 10 months ago
[New LOLBIN with external connection](https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/main/Defender%20For%20Endpoint/Living%20Off%20The%20Land/NewLOLBinExternalConnection.md#new-lolbin-with-external-connection) is referencing the KQL geo_info_from_ip_address function, but it looks like it isn't supported in Defender for Endpoints Advanced Hunting:
Hi, thank you for the concern. This is supported eventough it does not seem like it. The queries will run without any error.
[New LOLBIN with external connection](https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/main/Defender%20For%20Endpoint/Living%20Off%20The%20Land/NewLOLBinExternalConnection.md#new-lolbin-with-external-connection) is referencing the KQL geo_info_from_ip_address function, but it looks like it isn't supported in Defender for Endpoints Advanced Hunting: