Analytics Rules

 KQL Library / Analytics Rules

Analytics Rules

Queries designed (or used) as the body of a Sentinel Analytics Rule — they're written to produce discrete detection events on a schedule rather than to be run interactively.

← All KQL categories

Standalone

• Detect Autogen Studio Agent Tool Execution Anomaly detect-autogen-studio-agent-tool-execution-anomaly.kql

  AutoGen Studio-hosted AI agent taking code-execution or sensitive-tool actions outside its baseline set — the 'AutoJack' agent-abuse shape.

• Detect Ci Build Egress To First Seen Domain detect-ci-build-egress-to-first-seen-domain.kql

  CI/CD build process reaching out to a domain never seen from your build fleet before — 'the build that called a stranger.'

• Detect Diagnostic Deletion Then Tenant Activity Same Session detect-diagnostic-deletion-then-tenant-activity-same-session.kql

  Enhanced log-suppression sequence detection that further requires the follow-on activity to share the same CallerIpAddress — same session, not just same identity.

• Detect Diagnostic Deletion Then Tenant Activity Sequence detect-diagnostic-deletion-then-tenant-activity-sequence.kql

  T1562.008 sequence: Azure diagnostic-setting deletion followed by any activity from the same Caller within 60 minutes.

• Detect Dll Masquerading As Microsoft Defender detect-dll-masquerading-as-microsoft-defender.kql

  DLLs pretending to be Microsoft Defender via resource-level publisher/original-filename metadata — a Vidar Stealer TTP.

• Detect Excel Xll Addin Spawning Shell Or Network detect-excel-xll-addin-spawning-shell-or-network.kql

  Excel loading an XLL add-in that then spawns a shell or beacons out — the spreadsheet-as-shell malware delivery vector.

• Detect Nextjs Middleware Authorization Bypass detect-nextjs-middleware-authorization-bypass.kql

  Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

• Detect Oauth Token Used From Novel Country detect-oauth-token-used-from-novel-country.kql

  OAuth token used from a country the user has never signed in from — ToddyCat/Umbrij downstream shape where the token itself is the payload.

• Detect Peoplesoft Process Spawning Unexpected Shell detect-peoplesoft-process-spawning-unexpected-shell.kql

  Oracle PeopleSoft server processes (psadmin, psappsrv, java) spawning cmd, bash, whoami, curl, or net — post-exploitation shape of a PeopleSoft RCE.

• Detect Remote Shell Command Arrival Over Wire detect-remote-shell-command-arrival-over-wire.kql

  Shell command that arrived over the network — outbound-then-inbound-executed script pattern uncommon in legitimate remote code execution.

• Detect Sharepoint Toolshell Rce Encoded Command detect-sharepoint-toolshell-rce-encoded-command.kql

  SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.

• Detect Smartconnect Session Without Signin detect-smartconnect-session-without-signin.kql

  Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.

• Detect Successful Login Following Distributed Ssh Brute Force detect-successful-login-following-distributed-ssh-brute-force.kql

  Successful SSH login against a host that just weathered a distributed brute-force campaign. Pair with the Act-I hunt to know if the lightning hit anything.

• Detect Telegram Tdata Session Theft File Access detect-telegram-tdata-session-theft-file-access.kql

  Theft of Telegram's tdata session directory by an unexpected process. Uses actual DeviceFileEvents ActionTypes (FileCreated/Modified) — `FileRead` doesn't exist.

• Detect Unsigned Dll Load Verified Signing State detect-unsigned-dll-load-verified-signing-state.kql

  Unsigned DLL loads, using IsSigned/SigningStatus rather than treating an empty SHA256 as unsigned (the field is documented as usually-populated, not always).

• Detect Vpn Session Without Prior Authentication detect-vpn-session-without-prior-authentication.kql

  PAN-OS GlobalProtect VPN sessions established without a matching auth event in the preceding 5 minutes — the shape of CVE-2026-0257. Uses windowed leftouter, not range-predicate leftanti.

Failed Logins

Brute-force / failed-login threshold rules.

• Failed Login Attempts failed-login-attempts.kql

  3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.

Password Spray

Detections for password-spray patterns against Entra ID sign-in logs (`SigninLogs`). Both queries are heuristic — tune the thresholds to your environment before promoting to an Analytics Rule.

• Detect Low And Slow Password Spray detect-low-and-slow-password-spray.kql

  Low-and-slow spray pattern (Storm-0940-shaped): many unique users from the *same* IP in a day, with roughly one failed attempt per user; includes optional legacy-user-agent hints.

• Detect Wide Low Volume Password Sprays detect-wide-low-volume-password-sprays.kql

  Wide, low-volume spray: from a single IP, exactly one failed attempt per user in a day, but against many different users.