EXPLORE DETECTIONS

Find vulnerable Dell driver, dbutil_2_3.sys

This query was originally published in the threat analytics report, *Multiple EOP flaws in Dell driver (CVE-2021-21551)*.

FireEye Red Team tool CVEs [Nobelium]

Search for the CVEs that should be prioritized and resolved to reduce the success of the FireEye Red Team tools compromised by the Nobelium activity group.

FireEye Red Team tool HASHs [Nobelium]

This query searches for the HASHs of the FireEye Red Team tools compromised by the Nobelium activity group.

FOCI Client ID Detection

This query checks sign-in logs for Family of Client IDs (FOCI) applications

Follina Detection

Follina Detection

Forensics on Registry Run keys in Windows.

Registry Run keys can be used to establish persistence on a device.

Function: AnonymizedMicrosoftGraphActivityLogs()

This function removes the Azure Ids from the MicrosoftGraphActivityLogs and replaces them with an Id of your liking. This allows you to easily share your screen without showing the particular groups/users that are being queries with the GraphApi.

Function: AVScanResults()

The KQL function *AVScanResults()* collects this information, the function uses two input variables *DeviceIdInput* and *AvScanType*. *DeviceIdInput* is the DeviceId from the device you want to list results, the *AvScanType* can be either Quick, Full or Custom.

Gaming Domains - DeviceNetworkEvents

raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/Gaming.csv"] with (format="csv", ignoreFirstRecord=True);

Get an inventory of SolarWinds Orion software possibly affected by Nobelium

This query was originally published in the threat analytics report, *Solorigate supply chain attack*. Please note that these attacks are currently known as the *Nobelium campaign*.

Get Tenant ID for Given Domain

This query will return the tenant ID for a domain. This has little use-case today but if externaldata allowed variables then this could be quite useful as a function

Global Admin Elevations To User Access Administrator at Root Level

Graph API runHuntingQuery

This query lists successful runHuntingQuery Graph API calls from applications.

GraphAPI Resource Request Statistics

he requests that are executed by the Graph API are standardized, thus we can use the RequestUri to get statistics on which Resource is requested. The *{resource}* parameter is used for the resource in Microsoft Graph that you're referencing.

GraphAPI Resource Request Statistics

he requests that are executed by the Graph API are standardized, thus we can use the RequestUri to get statistics on which Resource is requested. The *{resource}* parameter is used for the resource in Microsoft Graph that you're referencing.

GraphAPI URI Request Statistics

Retrieving request statistics gives us the opportunity for new use cases. One can now summarize all the GraphAPI request types easily with the following query. The unique deltatokens have been removed from the data, returning a better overview of the executed requests.

GraphAPI URI Request Statistics

Retrieving request statistics gives us the opportunity for new use cases. One can now summarize all the GraphAPI request types easily with the following query. The unique deltatokens have been removed from the data, returning a better overview of the executed requests.

GraphAPIAuditEvents App Enrichment AADNonInteractiveUserSignInLogs Based

This query enriches the *GraphAPIAuditEvents* with Application information from the *AADNonInteractiveUserSignInLogs* table to get more context in the results.

GraphAPIAuditEvents App Enrichment ExternalData Based

This query enriches the *GraphAPIAuditEvents* with Application information Using the Azure_Application_ID list developed by [@Beercow](https://github.com/Beercow) 1000+ AppIds can be enriched with the [externaldata operator](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/externaldata-operator?pivots=azuredataexplorer) resulting in the query below.

GraphAPIAuditEvents IP Enrichment

The IP information can be enriched using the [geo_info_from_ip_address()](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/geo-info-from-ip-address-function) function, which returns the country, state, city, latitude and longitude of each IPv4 and IPv6 address.

GraphAPIAuditEvents User Enrichment

This query enriches the *MicrosoftGraphActivityLogs* with userinformation from the *IdentityInfo* table to get more context in the results.

Group Membership Report

This query can be used to draw an report of the Entra ID group memberships of all users.

Guest user with AD roles

This query can be used to display all Guest users in the tenant who have Azure Active Directory roles. Guest users by default have different rights than normal users, at the time these Guest users get additional roles those permissions change. Therefore, the least privilege principle should be applied to Guest (and all other) users, so that these Guest users cannot access sensitive information.

Hanada Group Crowdstrike Impersonation Detection

This query detects activity from Hanada group malware impersonating Crowdstrike updates