EXPLORE DETECTIONS
Hiding a Java class file
This query was originally published in the threat analytics report, *Adwind utilizes Java for cross-platform impact*.
HTTP Request Methods Statistics
HTTP Request Methods Statistics
Hunt for activities where Hard Delete user was performed
This query lists activities where a hard user delete has been performed.
Hunt for anomalies in Sentinel
The anomalies table contains anomalies generated by the active Anomaly analytics rules in Azure Sentinel. Those anomalies do not trigger a incident by default (at the moment of writing). This query lists the anomalies and the reaons why they are anomalies.
Hunt for devices with the most SMB connections
This hunting query lists all the devices and the unique connections they have made with a remote SMB port. Devices with a large number of connected SMB sessions can be interesting to investigate.
Hunt for files that have been used by APTs since 2015
This query uses a external csv that contains APT Ransomware note hashes. This list is used to search your environment for hash based matches on those ransomware notes.
Hunt for Local Admins with the most RemoteInteractive logins
Hunt for Local Admins with the most RemoteInteractive logins
Hunt for malicious files that have been identified by CERT-FR
```KQL
Hunt for newly identified lateral movement paths to sensitive accounts
Defender For Identity identifies lateral movement paths to all sensitive accounts (if possible). This is similar to a Bloodhound output. A newly identified path can mean that a sensitive account can be taken over if the path is followed.
Hunt for the 20 most unusual connections made by Office.
Hunt for the 20 most unusual connections made by Office.
Identify accounts that have logged on to endpoints affected by Cobalt Strike
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*.
identify mail items accessed by a specific IP address (CISA)
Query is from CISA Playbook https://www.cisa.gov/sites/default/files/2025-01/microsoft-expanded-cloud-logs-implementation-playbook-508c.pdf
Identify unused high privileged application permissions
The query below identifies unused high privileged application permissions. These permissions can be revoked from the application to adhere to the least privileged principle.
Image File Execution Options and .bat file usage in association with Wadhrama ransomware
This query was originally published in the threat analytics report, *RDP ransomware persists as Wadhrama*.
Inbound Authentication From Public IP
This query can be used to identify devices that are publicly disclosed to the internet by monitoring for inbound authentication attempts.
Inbound SSH Connection to Vulnerable XZ Machine
This KQL query can be used to detect post exploitation activities related to CVE-2024-3094. This vulnerability is related to reports of malicious code being embedded in XZ Utils versions 5.6.0 and 5.6.1. Multiple sources suggest that the malicious code is ingested in functions that SSHD leverages to bypass authentication features, this is yet to be confirmed.
Incidents to Mitre ATTACK navigator
This query takes incidents from Defender, checks MITRE technique and then creates attack navigator format for upload to https://mitre-attack.github.io/attack-navigator/
Ingestion Delays
This query can be used to calculate ingestion delays of the unified security platform. In this specific case the GraphAPIAuditEvents and MicrosoftGraphActivityLogs are compared, but these tablenames can be changed to any other table. For all EDR logs you can for example use *union withsource=TableName Device* * to filter on all tables starting with Device.
Ingestion Size Security Events
The query below returns the top 10 Windows Security Events with the biggest footprint in your Sentinel environment. The query can be used to determine value for money, as more events increase the cost of your Sentinel environment. The size of each event depends on the amount of data in the columns.
IPv4 command detected in lolbin execution
This query returns all LOLbins that refer to a remote IP in the commandline. These remote IPs can be used to make connections for lateral movement or to remotely upload or download files.
ISO (Virtual DVD-ROM) file mount
Mounting of virtual Dvd ROM i.e. ISO files - useful for hunting Rougeplanet.
JA3 Fingerprint Blacklist
```KQL
Java process executing command line to download and execute PowerShell script
This query was originally published in the threat analytics report, *Sysrv botnet evolution*.
Javascript use by Qakbot malware
This query was originally published in the threat analytics report, *Qakbot blight lingers, seeds ransomware*