Skip to content

Fa1c0/KQL-Queries

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

154 Commits
AD ADCS_ESC1_Abuse
AD ADCS_ESC1_Abuse
 
 
AD DCSync Alert
AD DCSync Alert
 
 
AD DCSync Alert 2.0
AD DCSync Alert 2.0
 
 
AD Domain Admin Group Change
AD Domain Admin Group Change
 
 
AD MFA Bombing
AD MFA Bombing
 
 
AD Password Reset from Anomalous Location
AD Password Reset from Anomalous Location
 
 
AD User Added to DA or EA Group
AD User Added to DA or EA Group
 
 
AD User Added to Domain Admins
AD User Added to Domain Admins
 
 
ADO New PA, PCA, or PCAS
ADO New PA, PCA, or PCAS
 
 
AWS EC2 Compute Resource Deployments
AWS EC2 Compute Resource Deployments
 
 
AbuseCh_IPs
AbuseCh_IPs
 
 
Azure Blob Anonymous Access
Azure Blob Anonymous Access
 
 
Azure Collector Disk Space Low < 10%
Azure Collector Disk Space Low < 10%
 
 
Azure Collector Disk Space Low < 50%
Azure Collector Disk Space Low < 50%
 
 
Azure Key Vault Change Detected
Azure Key Vault Change Detected
 
 
Azure Managed Identity Created
Azure Managed Identity Created
 
 
Azure Network Infrastructure Created
Azure Network Infrastructure Created
 
 
Azure New Blob SAS URL
Azure New Blob SAS URL
 
 
Azure New Public IP
Azure New Public IP
 
 
Azure RBAC Privilege Access Granted
Azure RBAC Privilege Access Granted
 
 
Azure Rogue VM Created
Azure Rogue VM Created
 
 
Azure Serial Console Connection Detected
Azure Serial Console Connection Detected
 
 
Azure Storage Account Created
Azure Storage Account Created
 
 
Azure Suspicious Azure PowerShell Login
Azure Suspicious Azure PowerShell Login
 
 
Azure Suspicious NSG Created
Azure Suspicious NSG Created
 
 
Azure User Export
Azure User Export
 
 
Azure User added to Security Group for Role Assignment
Azure User added to Security Group for Role Assignment
 
 
Azure VM Run Cmd
Azure VM Run Cmd
 
 
CA Help Desk Impersonation
CA Help Desk Impersonation
 
 
DFO Possible BEC
DFO Possible BEC
 
 
DFO Possible Spoofed Email
DFO Possible Spoofed Email
 
 
DFO SharePoint Upload Threshold
DFO SharePoint Upload Threshold
 
 
DFO Spoofed NoReply
DFO Spoofed NoReply
 
 
DFO Subject contains phone number
DFO Subject contains phone number
 
 
Entra High Priv User MFA Change
Entra High Priv User MFA Change
 
 
Entra Risk Event for High Priv User
Entra Risk Event for High Priv User
 
 
IDE Domain Controller OS Credential Dumping
IDE Domain Controller OS Credential Dumping
 
 
MCAS CloudApp DLP Email Match
MCAS CloudApp DLP Email Match
 
 
MDE Anomalous File Copy
MDE Anomalous File Copy
 
 
MDE Attack Surface Reduction Queries
MDE Attack Surface Reduction Queries
 
 
MDE CVE-2023-38545 Curl Exploit Check
MDE CVE-2023-38545 Curl Exploit Check
 
 
MDE Certurtil Abuse Download
MDE Certurtil Abuse Download
 
 
MDE ClickFix
MDE ClickFix
 
 
MDE Defender Disable
MDE Defender Disable
 
 
MDE Device Without EDR
MDE Device Without EDR
 
 
MDE Device with external RDP connections
MDE Device with external RDP connections
 
 
MDE Disable Defender Svc Attempted
MDE Disable Defender Svc Attempted
 
 
MDE Discovery Commands
MDE Discovery Commands
 
 
MDE File Sharing Attemtped
MDE File Sharing Attemtped
 
 
MDE HTML Email Attachment Check
MDE HTML Email Attachment Check
 
 
MDE ISO File Created
MDE ISO File Created
 
 
MDE JS File executed in download folder
MDE JS File executed in download folder
 
 
MDE Javascript Executed in user's Download folder
MDE Javascript Executed in user's Download folder
 
 
MDE MSHTA Use
MDE MSHTA Use
 
 
MDE Mimikatz Commands
MDE Mimikatz Commands
 
 
MDE NTDS Theft
MDE NTDS Theft
 
 
MDE Nested RDP
MDE Nested RDP
 
 
MDE New Rule Added to Windows Firewall
MDE New Rule Added to Windows Firewall
 
 
MDE OfficeLOLBinSpawn
MDE OfficeLOLBinSpawn
 
 
MDE Possible Enumeration
MDE Possible Enumeration
 
 
MDE Possible Exploitation of CVE-2024-21413
MDE Possible Exploitation of CVE-2024-21413
 
 
MDE Possible Pingcastle Usage
MDE Possible Pingcastle Usage
 
 
MDE Privileged User Discovery
MDE Privileged User Discovery
 
 
MDE RClone Command Line Activity
MDE RClone Command Line Activity
 
 
MDE RClone Config File Creation
MDE RClone Config File Creation
 
 
MDE RMM Check
MDE RMM Check
 
 
MDE RMM Users
MDE RMM Users
 
 
MDE Rundll32 with suspicious lineage
MDE Rundll32 with suspicious lineage
 
 
MDE SMB connections from Word
MDE SMB connections from Word
 
 
MDE Storm-0940_Login
MDE Storm-0940_Login
 
 
MDE Suspicious PSExec Usage
MDE Suspicious PSExec Usage
 
 
MDE Sysinternals Usage Detected
MDE Sysinternals Usage Detected
 
 
MDE TeamsGuestUserAdd
MDE TeamsGuestUserAdd
 
 
MDE User Added to Local Admin Group
MDE User Added to Local Admin Group
 
 
MDE User Added to localadmin
MDE User Added to localadmin
 
 
MDE WinRar_CVE-2023-40477
MDE WinRar_CVE-2023-40477
 
 
OA New-InboxRule
OA New-InboxRule
 
 
PA Crypto Jack Alert
PA Crypto Jack Alert
 
 
PA MOVEIt May 23 IOCs
PA MOVEIt May 23 IOCs
 
 
PA Potential Botnet_BruteForce_C2
PA Potential Botnet_BruteForce_C2
 
 
PA RMM App
PA RMM App
 
 
README.md
README.md
 
 
Ransomware_live
Ransomware_live
 
 

Repository files navigation

A colletion of KQL use case queries to suppliment out of the box Sentinel.

  • AD Active Directory
  • ADO Active Directory
  • Azure Azure
  • CA CloudApp Events
  • Entra Azure EntraID
  • IDE Identity Directory Events
  • MCAS Microsoft Cloud App Security
  • MDE Microsoft Defender for Endpoint
  • OA Office Activity
  • PA Palo Alto

About

Sentinel KQL use cases and Wiki for incident response.

Resources

Readme
Activity

Stars

0 stars

Watchers

2 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors