EXPLORE DETECTIONS

Entra Smart Lockout Tampering

EntraIdSignInEvents - Hunting Potential Seamless SSO Usage

This query is a replacement to https://github.com/jkerai1/KQL-Queries/blob/main/Defender/AADSignInEventsBeta%20-%20Hunting%20Potential%20Seamless%20SSO%20Usage.kql

EntraIdSignInEvents - Suspicious User agent

This query is the update to https://github.com/jkerai1/KQL-Queries/blob/main/Defender/AADSignInEventsBeta%20-%20Suspicious%20User%20agent.kqlhttps://github.com/jkerai1/KQL-Queries/blob/main/Defender/AADSignInEventsBeta%20-%20Suspicious%20User%20agent.kql

EntraTrace - Azure AD Graph UserAgent Matches

Hunts for legacy Azure AD Graph API requests whose `UserAgent` matches an entry extracted from offensive tool profiles in [EntraTrace](https://github.com/Bert-JanP/EntraTrace). The query dynamically retrieves the [UserAgents.csv indicator list](https://github.com/Bert-JanP/EntraTrace/blob/main/Indicator%20Lists/UserAgents.csv) at execution time, so coverage changes as the project updates its profiles.

EntraTrace - Microsoft Graph UserAgent Matches

Hunts for Microsoft Graph API requests whose `UserAgent` matches an entry extracted from offensive tool profiles in [EntraTrace](https://github.com/Bert-JanP/EntraTrace). The query dynamically retrieves the [UserAgents.csv indicator list](https://github.com/Bert-JanP/EntraTrace/blob/main/Indicator%20Lists/UserAgents.csv) at execution time, so coverage changes as the project updates its profiles.

EntraTrace - Sign-in UserAgent Matches

Hunts for Microsoft Entra ID sign-ins whose `UserAgent` matches an entry extracted from offensive tool profiles in [EntraTrace](https://github.com/Bert-JanP/EntraTrace). The query dynamically retrieves the [UserAgents.csv indicator list](https://github.com/Bert-JanP/EntraTrace/blob/main/Indicator%20Lists/UserAgents.csv) at execution time, so coverage changes as the project updates its profiles.

Exchange PowerShell snap-in being loaded

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".

Exchange Server IIS dropping web shells and other artifacts

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".

Exchange vulnerability creating web shells via UMWorkerProcess

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".

Exchange vulnerability launching subprocesses through UMWorkerProcess

This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".

Executable File Extentions downloaded via HTTP GET

List Executable File Extentions downloaded via HTTP GET

Executables in AppData Local Roaming

Remains a common TTP despite other user writtable and executable paths in windows

Exploit Guard Network Protection Triggered

Microsoft offers network protection for devices, this can be done based on custom indicators that have been uploaded to the portal or based on a websites reputation. Depening on the reputation of a website a alert may be generated. The most common Response Categories are: CustomPolicy, CustomBlockList, CasbPolicy (Defender For Cloud Apps), Malicious and Phishing. The query contains a filter to exclude all custom indicators from the query results, which may overwhelm the results.

Exploitable_CVE_AllDevices

FIDO AAGUID Passkey Explorer

This query looks up AAGUIDs with their device manufacturer using Passkey Explorer

File creation with WinRAR absolute path transversal exploit, CVE-2018-20250

This query was originally published in the threat analytics report, *WinRAR CVE-2018-20250 exploit*

File that contains malware detected by Defender For Cloud Apps

This query lists the *FileMalwareDetected* based on the uploaded content to your cloud applications (such as OneDrive, SharePoint). This activity does not always raise an alert.

Files Loaded by Suspicious Executable

This query is designed to list the files that have been loaded by a suspicious executable. Often malware loads dlls to properly function, these dlls can be identified by giving the SHA1 hash of the malicious executable as *InputSHA1*.

Files Loaded by Suspicious Executable

This query is designed to list the files that have been loaded by a suspicious executable. Often malware loads dlls to properly function, these dlls can be identified by giving the SHA1 hash of the malicious executable as *InputSHA1*.

Find all the processes a file has created and the associated FileNames, FileLocations and SHA1 hashes that the file has had.

----

Find all the processes a file has created and the associated FileNames, FileLocations and SHA1 hashes that the file has had.

----

Find data destruction related to Wadhrama ransomware

This query was originally published in the threat analytics report, *RDP ransomware persists as Wadhrama*.

Find RDP persistance attempts related to Wadhrama ransomware

This query was originally published in the threat analytics report, *RDP ransomware persists as Wadhrama*.

Find user accounts potentially affected by Cobalt Strike

This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).