EXPLORE DETECTIONS
Kerberos attacks
#### Risk
Kinsing miner download
This query was originally published in the threat analytics report, *Sysrv botnet evolution*.
Known exploited vulnerabilities by CISA still active on devices
The CISA has made an active list were the current exploited vulnerabilities are listed, this query uses that information to enrich your vulnerabilitiy management process. This is done by matching the CISA CVEids with the CVEids that are currently active on your devices. This can help prioritize the vulnerabilities that need patching.
KQL Regex List
This page will be used as a quick reference guide for KQL regex queries. Those regular expressions can be used within your detection rules. For additional information see the [Regex RE2 Library from Microsoft](https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/re2-library).
KQLQuery Visits
Visualize the visits to [KQLQuery.com](KQLQuery.com) in a columnchart.
KQLSearch Visits
Visualize the visits to [kqlsearch.com](kqlsearch.com) in a columnchart.
Large Number of Analytics Rules Deleted
This query can be used to detect when a large number of Sentinel Analytics Rules is deleted in a short timeframe. This could be part of the detection lifecycle, but it could also have been done with malicious intent.
Large Number of Virtual Machines started
This query detects when a Large Number of Virtual Machines is started within a short timeframe. The query uses two inputs; Threshold and TimeFrame. The threshold determines the number of machines from when the query should output results. The timeframe determines how long the period is to reach the threshold.
Last Heartbeat Arc Machines
This query lists the latest heartbeat for each Azure Arc onboarded machine.
Last Password Change Time with Account Creation Time
| where Department contains @"Cyber" or JobTitle contains "architect" //Example of further filtering
Last Password Change User
This query lists the last PasswordChangeTime based on Active Directory logs. In case you asked a user to perform a password reset, you can confirm using this query if it was actually performed.
Latest Antivirus Scan Status
This query lists the latest completed antivirus scan for each device. The query filters all devices that have performed a successful scan today.
Launching questd ransomware using osascript
This query was originally published in the threat analytics report, *EvilQuest signals the rise of Mac ransomware*.
LDAPNightmare Exploitation Attempt
The query below detects the inital connection made to try and run the LDAPNightmare exploit. The intial connection connects to the victim server, which sends a DNS SRV query. If the query below triggers it does not necessarily mean that the exploit worked, if the system is patched or the RPC access is denied the exploit cannot be executed but the query will return results. By this you can also hunt for attempts, if the victim is still vulnerable for the vulnerability it is likely exploited.
List *.All MS Graph Permissions Added
This rule detects the usage of *.All Microsoft Graph permissions that are added. *.All permissions should be scoped if possible, this ensures that the least privilege principle can still be applied. You should monitor for overpermissive applications and rare permissions that are added to applications.
List *.All MS Graph Permissions Added by application.
This rule detects the usage of *.All Microsoft Graph permissions that are added. *.All permissions should be scoped if possible, this ensures that the least privilege principle can still be applied. You should monitor for overpermissive applications and rare permissions that are added to applications. This query summarize the results for each ServicePrincipalAppId, especially applications that have been granted multiple *.All permissions should be investigated.
List Activities Compromised Device Can Perform as Source
```KQL
List Activities Compromised Device Can Perform as Source
```KQL
List AD Delegations
This query is aimed to Monitor different types of delegation in the environment.
List Alert Supression Actions
This query lists all the supressions that have been added to Defender XDR. This gives you an overview of what rules are added, by who and why they have been added.
List all AuditLog activities of a user
```KQL
List all AuditLog activities of a user
```KQL
List all Cloud Permissions of a Compromised User
```KQL
List all Cloud Permissions of a Compromised User
```KQL