Skip to content

Collection of KQL queries for sentinel and defender for organization wide monitoring

Notifications You must be signed in to change notification settings

Peronchichino/KQL_Queries_AdvancedHunting

Repository files navigation

KQL_Queries_AdvancedHunting

Topics:

  • Country logins
  • Anomalous Token creation, etc
  • Various Logins (risky, failed, non-existant, etc)
  • Password resets
  • MFA
  • Device specific events
  • spoolsv.exe
  • New user in admin group -> PIM
  • Malicious HTTP Traffic -> HTTP Traffic
  • phishing file extension

To-Be-Added:

  • Azure job creation
  • Anomalous AAD Account Creation

Releases

No releases published

Packages

No packages published