Skip to content

t3l3m3try/Threat_Hunting

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

17 Commits
Account_Details.sql
Account_Details.sql
 
 
Account_Failed_Logon_Attempts.sql
Account_Failed_Logon_Attempts.sql
 
 
Account_Logon_Activities.sql
Account_Logon_Activities.sql
 
 
AntiMalware_Discovery.sql
AntiMalware_Discovery.sql
 
 
Attacker_Binaries_Activities.sql
Attacker_Binaries_Activities.sql
 
 
BITSAdmin_Transfers.sql
BITSAdmin_Transfers.sql
 
 
Browser_Bookmarks_Discovery.sql
Browser_Bookmarks_Discovery.sql
 
 
Bulk_Domain_Search.sql
Bulk_Domain_Search.sql
 
 
Bulk_Hash_Search.sql
Bulk_Hash_Search.sql
 
 
Bulk_Hash_Search_v2.sql
Bulk_Hash_Search_v2.sql
 
 
Bulk_Hash_Search_v3.sql
Bulk_Hash_Search_v3.sql
 
 
Bulk_Host_Audit.sql
Bulk_Host_Audit.sql
 
 
Bulk_IP_Search.sql
Bulk_IP_Search.sql
 
 
Bulk_IP_Search_v2.sql
Bulk_IP_Search_v2.sql
 
 
CMSTP_Abuse.sql
CMSTP_Abuse.sql
 
 
Certutil_Abuse.sql
Certutil_Abuse.sql
 
 
Clear_Windows_Logs_Event.sql
Clear_Windows_Logs_Event.sql
 
 
Clear_Windows_Logs_Event_v2.sql
Clear_Windows_Logs_Event_v2.sql
 
 
Control_Panel_Abuse.sql
Control_Panel_Abuse.sql
 
 
Disable_Event_Tracing_for_Windows.sql
Disable_Event_Tracing_for_Windows.sql
 
 
Disable_Windows_Firewall.sql
Disable_Windows_Firewall.sql
 
 
Enhanced_Attacker_Execution_Profiling_(EAEP)_events.sql
Enhanced_Attacker_Execution_Profiling_(EAEP)_events.sql
 
 
Exe_Run_Browser_Folders.sql
Exe_Run_Browser_Folders.sql
 
 
Exe_Run_Temp.sql
Exe_Run_Temp.sql
 
 
Exe_Run_User_Profile_Path.sql
Exe_Run_User_Profile_Path.sql
 
 
Exe_Written_INetCache.sql
Exe_Written_INetCache.sql
 
 
File_and_Directory_Discovery.sql
File_and_Directory_Discovery.sql
 
 
Files_Written_to_Removable_Media.sql
Files_Written_to_Removable_Media.sql
 
 
Files_Written_to_Removable_Media_v2.sql
Files_Written_to_Removable_Media_v2.sql
 
 
Firewall_Set_Rules.sql
Firewall_Set_Rules.sql
 
 
Indirect_Command_Execution.sql
Indirect_Command_Execution.sql
 
 
Inhibit_System_Recovery.sql
Inhibit_System_Recovery.sql
 
 
Investigate_Child_Process.sql
Investigate_Child_Process.sql
 
 
Investigate_Data_Transfer_Command_Lines.sql
Investigate_Data_Transfer_Command_Lines.sql
 
 
Investigate_Download_and_Execute_Command_Lines.sql
Investigate_Download_and_Execute_Command_Lines.sql
 
 
Investigate_Parent_Process.sql
Investigate_Parent_Process.sql
 
 
Investigate_Post_Exploitation_Binaries.sql
Investigate_Post_Exploitation_Binaries.sql
 
 
Investigate_Recon_Binaries.sql
Investigate_Recon_Binaries.sql
 
 
Investigate_Recon_Command_Lines.sql
Investigate_Recon_Command_Lines.sql
 
 
Local_Account_Creation.sql
Local_Account_Creation.sql
 
 
Local_Admin_Creation.sql
Local_Admin_Creation.sql
 
 
MSHTA_Abuse.sql
MSHTA_Abuse.sql
 
 
Outlook_Links.sql
Outlook_Links.sql
 
 
Outlook_Office_Attachments.sql
Outlook_Office_Attachments.sql
 
 
PowerShell_Command_Lines_Clustered.sql
PowerShell_Command_Lines_Clustered.sql
 
 
PowerShell_Download_Command_Lines.sql
PowerShell_Download_Command_Lines.sql
 
 
PowerShell_Download_Command_Lines_v2.sql
PowerShell_Download_Command_Lines_v2.sql
 
 
PowerShell_Encoded_Command_Lines.sql
PowerShell_Encoded_Command_Lines.sql
 
 
PowerShell_Hunt.sql
PowerShell_Hunt.sql
 
 
PowerShell_Malicious_Command_Lines.sql
PowerShell_Malicious_Command_Lines.sql
 
 
Process_DNS_Requests.sql
Process_DNS_Requests.sql
 
 
Processes_Spawning_Under_PSExec.sql
Processes_Spawning_Under_PSExec.sql
 
 
RDP_Hijacking.sql
RDP_Hijacking.sql
 
 
README.md
README.md
 
 
Rare_External_Connections.sql
Rare_External_Connections.sql
 
 
Regsvcs_Regasm_Abuse.sql
Regsvcs_Regasm_Abuse.sql
 
 
Regsvr32_Abuse.sql
Regsvr32_Abuse.sql
 
 
Responsible_Process_DNS_Request.sql
Responsible_Process_DNS_Request.sql
 
 
Responsible_Process_IP_Connection.sql
Responsible_Process_IP_Connection.sql
 
 
Rundll32_Abuse.sql
Rundll32_Abuse.sql
 
 
Scheduled_Tasks_Registered.sql
Scheduled_Tasks_Registered.sql
 
 
Suspicious_DNS_Request.sql
Suspicious_DNS_Request.sql
 
 
Suspicious_Written_Temp_Files.sql
Suspicious_Written_Temp_Files.sql
 
 
System_Binary_Proxy_Execution.sql
System_Binary_Proxy_Execution.sql
 
 
System_Script_Proxy_Execution.sql
System_Script_Proxy_Execution.sql
 
 
Team_Viewer_External_Connections.sql
Team_Viewer_External_Connections.sql
 
 
Timestomp_Attempts.sql
Timestomp_Attempts.sql
 
 
Tor_Browser_Usage.sql
Tor_Browser_Usage.sql
 
 
WMI_Abuse.sql
WMI_Abuse.sql
 
 
XSL_Script_Processing.sql
XSL_Script_Processing.sql
 
 

Repository files navigation

Threat_Hunting

Some Crowdstrike threat hunting queries useful for blue teamers and threat hunters

About

Some Threat Hunting queries useful for blue teamers

Resources

Readme
Activity

Stars

131 stars

Watchers

4 watching

Forks

24 forks
Report repository

Releases

No releases published

Packages

No packages published