This repository was archived by the owner on Mar 7, 2023. It is now read-only.

Files

AzSentinel
KQL_apt_apt29_thinktanks.txt
KQL_apt_babyshark.txt
KQL_apt_bear_activity_gtr19.txt
KQL_apt_cloudhopper.txt
KQL_apt_dragonfly.txt
KQL_apt_elise.txt
KQL_apt_empiremonkey.txt
KQL_apt_equationgroup_dll_u_load.txt
KQL_apt_hurricane_panda.txt
KQL_apt_judgement_panda_gtr19.txt
KQL_apt_pandemic.txt
KQL_apt_slingshot.txt
KQL_apt_sofacy.txt
KQL_apt_sofacy_zebrocy.txt
KQL_apt_ta17_293a_ps.txt
KQL_apt_tropictrooper.txt
KQL_apt_turla_namedpipes.txt
KQL_apt_unidentified_nov_18.txt
KQL_apt_zxshell.txt
KQL_auditligs_pim_requests
KQL_auditlogs_newly_created_users
KQL_azureactivity_new_role_assignments
KQL_azureactivity_password_reset_linux
KQL_azurediagnostics_sql_logins
KQL_crime_fireball.txt
KQL_officeactivity_get_exchange_events
KQL_officeactivity_onedrive_events
KQL_officeactivity_sentinel
KQL_officeactivity_sharepoint_onedrive_events
KQL_powershell_xor_commandline.txt
KQL_securityalerts_mcas
KQL_securityevents_windows_logins
KQL_signinlogs_AzurePortal
KQL_syslog_cron_events
KQL_sysmon_susp_rdp.txt
KQL_threatintelligenceindicator
KQL_win_GPO_scheduledtasks.txt
KQL_win_account_backdoor_dcsync_rights.txt
KQL_win_account_discovery.txt
KQL_win_admin_rdp_login.txt
KQL_win_admin_share_access.txt
KQL_win_alert_active_directory_user_control.txt
KQL_win_alert_ad_user_backdoors.txt
KQL_win_alert_enable_weak_encryption.txt
KQL_win_alert_hacktool_use.txt
KQL_win_atsvc_task.txt
KQL_win_attrib_hiding_files.txt
KQL_win_bypass_squiblytwo.txt
KQL_win_cmdkey_recon.txt
KQL_win_cmstp_com_object_access.txt
KQL_win_dcsync.txt
KQL_win_disable_event_logging.txt
KQL_win_exploit_cve_2015_1641.txt
KQL_win_exploit_cve_2017_0261.txt
KQL_win_exploit_cve_2017_11882.txt
KQL_win_exploit_cve_2017_8759.txt
KQL_win_hack_rubeus.txt
KQL_win_impacket_secretdump.txt
KQL_win_lethalhta.txt
KQL_win_lm_namedpipe.txt
KQL_win_mal_adwind.txt
KQL_win_mal_lockergoga.txt
KQL_win_mal_ursnif.txt
KQL_win_mal_wannacry.txt
KQL_win_mal_wceaux_dll.txt
KQL_win_malware_dridex.txt
KQL_win_malware_notpetya.txt
KQL_win_malware_script_dropper.txt
KQL_win_malware_wannacry.txt
KQL_win_mavinject_proc_inj.txt
KQL_win_mshta_spawn_shell.txt
KQL_win_net_ntlm_downgrade.txt
KQL_win_netsh_fw_add.txt
KQL_win_netsh_port_fwd.txt
KQL_win_netsh_port_fwd_3389.txt
KQL_win_office_shell.txt
KQL_win_overpass_the_hash.txt
KQL_win_pass_the_hash.txt
KQL_win_plugx_susp_exe_locations.txt
KQL_win_possible_applocker_bypass.txt
KQL_win_powershell_amsi_bypass.txt
KQL_win_powershell_b64_shellcode.txt
KQL_win_powershell_dll_execution.txt
KQL_win_powershell_download.txt
KQL_win_powershell_renamed_ps.txt
KQL_win_powershell_suspicious_parameter_variation.txt
KQL_win_process_creation_bitsadmin_download.txt
KQL_win_psexesvc_start.txt
KQL_win_rdp_bluekeep_poc_scanner.txt
KQL_win_rdp_localhost_login.txt
KQL_win_rdp_reverse_tunnel.txt
KQL_win_sdbinst_shim_persistence.txt
KQL_win_shell_spawn_susp_program.txt
KQL_win_spn_enum.txt
KQL_win_susp_add_sid_history.txt
KQL_win_susp_bcdedit.txt
KQL_win_susp_calc.txt
KQL_win_susp_certutil_command.txt
KQL_win_susp_certutil_encode.txt
KQL_win_susp_cli_escape.txt
KQL_win_susp_dsrm_password_change.txt
KQL_win_susp_failed_logon_reasons.txt
KQL_win_susp_interactive_logons.txt
KQL_win_susp_kerberos_manipulation.txt
KQL_win_susp_lsass_dump.txt
KQL_win_susp_mshta_execution.txt
KQL_win_susp_net_recon_activity.txt
KQL_win_susp_psexec.txt
KQL_win_susp_raccess_sensitive_fext.txt
KQL_win_susp_rc4_kerberos.txt
KQL_win_susp_sdelete.txt
KQL_win_susp_security_eventlog_cleared.txt
KQL_win_susp_time_modification.txt
KQL_win_svcctl_remote_service.txt
KQL_win_user_added_to_local_administrators.txt
LICENSE
README.md

KQL_win_powershell_amsi_bypass.txt

Aug 28, 2019

fc1547b · Aug 28, 2019