Hunting

 KQL Library / Hunting

Hunting

Ad-hoc investigative queries. These aren't packaged as Sentinel Analytics Rules — they're the "let me pull on this thread" queries you reach for during triage, incident response, or when a stakeholder asks a specific question.

← All KQL categories

Standalone

• Hunt Azure Diagnostic Setting Deletions hunt-azure-diagnostic-setting-deletions.kql

  Deletions of Azure diagnostic settings — the moment an attacker turns off logging (T1562.008). Step 1 of a two-step sequence.

• Hunt Blockchain Rpc C2 Dead Drop hunt-blockchain-rpc-c2-dead-drop.kql

  C2 traffic hidden inside blockchain-RPC calls to public utilities (QuickNode, Alchemy) — 'the dead drop is a public utility.'

• Hunt C2 Beacon By Connection Window Rhythm hunt-c2-beacon-by-connection-window-rhythm.kql

  Low-and-slow C2 beacon hunt that counts distinct hourly time windows a process was connected in — not raw connection volume.

• Hunt Cav3rn Endpoint Local Log File Artifact hunt-cav3rn-endpoint-local-log-file-artifact.kql

  Endpoint-side hunt for Project CAV3RN's local file artifact (`logAzure.txt` and family) — config persistence written by the module.

• Hunt Cloud Metadata Ssrf Normalized Forms hunt-cloud-metadata-ssrf-normalized-forms.kql

  Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.

• Hunt Cloud Storage Bucket Lookalike References hunt-cloud-storage-bucket-lookalike-references.kql

  References to cloud storage buckets whose names are lookalikes of your real ones — homoglyphs, dashes-for-underscores, plausibly-typosquatted variants.

• Hunt Credential Compromise Signin Audit Alert Three Table hunt-credential-compromise-signin-audit-alert-three-table.kql

  Three-table credential-compromise chain: joins risky sign-ins, audit follow-up, and downstream SecurityAlert on the same user.

• Hunt Distributed Ssh Brute Force Per Target hunt-distributed-ssh-brute-force-per-target.kql

  SSH brute-force hunt that pivots on the target host, not the source IP — catches distributed attacks that stay under per-source thresholds by using thousands of IPs.

• Hunt DNS Aaaa Record Covert Recovery Channel hunt-dns-aaaa-record-covert-recovery-channel.kql

  Project CAV3RN's DNS AAAA-record recovery channel — IPv6 addresses returned in AAAA queries that decode as ASCII or structured config.

• Hunt Encoded Command Usage Across Fleet Time Baseline hunt-encoded-command-usage-across-fleet-time-baseline.kql

  Encoded-command executions correlated across the fleet against a rolling per-host time baseline. TimeBucket alone as the join key — deliberately no DeviceId.

• Hunt First Time Admin Operation User Baseline hunt-first-time-admin-operation-user-baseline.kql

  Baselines identities that have ever executed admin operations, then alerts when an account outside that set succeeds — 'the admin who has never administered.'

• Hunt Inflated File Payload Evading Size Based Av Scan hunt-inflated-file-payload-evading-size-based-av-scan.kql

  File downloads anomalously large for their kind — Vidar's null-byte padding trick to slip past AV scanners that skip files above a size ceiling.

• Hunt Linux Process Argv0 Vs Executable Mismatch hunt-linux-process-argv0-vs-executable-mismatch.kql

  Linux processes where argv[0] doesn't match the actual binary that was executed — a process wearing another process's name tag.

• Hunt Metadata IP Any Encoded Form Inspecting DNS Answer hunt-metadata-ip-any-encoded-form-inspecting-dns-answer.kql

  Inspects what DNS actually resolved to (the Answer field), not what the caller wrote — catches every obfuscated string form of the metadata IPs at the resolver level.

• Hunt Npm Postinstall Config Modification No User Context hunt-npm-postinstall-config-modification-no-user-context.kql

  npm postinstall/lifecycle scripts that modified config without a corresponding interactive user command — AsyncAPI-shaped supply-chain compromise.

• Hunt Npm Postinstall Grandchild Network Payload hunt-npm-postinstall-grandchild-network-payload.kql

  npm supply-chain worms where the payload runs two process generations down — 'sins of the grandfather' shape. Traces npm → sh -c → curl.

• Hunt Outlook Calendar C2 Far Future Standing Meeting hunt-outlook-calendar-c2-far-future-standing-meeting.kql

  Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.

• Hunt Suspicious User Consented Oauth App Grants hunt-suspicious-user-consented-oauth-app-grants.kql

  'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.

• Hunt Teams Phishing Then Suspicious Login Correlation hunt-teams-phishing-then-suspicious-login-correlation.kql

  Teams phishing messages correlated with subsequent suspicious sign-ins for the same recipient — deals with ExternalAccess not being populated by falling back to sender-domain-outside-org.

Eventid Forensics

Investigative queries organized around a specific Windows Event ID — the "who, where, when, how often" set. Replace the sample `EventID` value in each query with the one you're chasing.

• How Many Times Does This Eventid Fire From This Machine how-many-times-does-this-eventid-fire-from-this-machine.kql

  Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

• Which Accounts Are Throwing This Eventid which-accounts-are-throwing-this-eventid.kql

  Which accounts fire a specific Event ID and how often, per day.

• Which Devices Are Throwing This Eventid which-devices-are-throwing-this-eventid.kql

  Which computers fire a specific Event ID and how often, per day.

• Which Eventid Fires The Most In A Month which-eventid-fires-the-most-in-a-month.kql

  Noisiest Event IDs across the last month — good for spotting new noise sources.

• Which Eventids Are Suddenly Acting Weird With Context which-eventids-are-suddenly-acting-weird-with-context.kql

  Same deviation analysis as the basic variant, joined with `Computer` and `Account` so you can see which host or user is driving the spike in one shot. Uses a 30-day recent window to reduce join noise.

• Which Eventids Are Suddenly Acting Weird which-eventids-are-suddenly-acting-weird.kql

  Which Event IDs have recently spiked (7d) versus their 90-day baseline, sorted by deviation ratio. Basic variant — just EventID + counts.

File Activity

File-level activity queries — the "prove to an auditor we can track this" set, plus artifact-based detections that read files as evidence of network events.

• Detect Spring Boot Heapdump Artifact On Disk detect-spring-boot-heapdump-artifact-on-disk.kql

  Detects Spring Boot Actuator heap-dump theft by the artifact Spring writes to disk during the request (`heapdumpgt;[-live]gt;.hprof`). The filename is proof an HTTP request hit the endpoint even when the web tier didn't log the URL.

• File Activity Audit file-activity-audit.kql

  Timestamped file activity (open, read, modify, delete, create) by user and device. Written for a client that needed to demonstrate this capability to an auditor.

User Activity

"What has this user been doing?" queries. Powerful enough to be worth handling carefully — some of these return browsing history and file access details, so mind your GDPR/privacy obligations before running them in prod.

• RDP Logins Per Day Per User rdp-logins-per-day-per-user.kql

  RDP logins per user per day (30d) rendered as a timechart. Use for baselining "normal" login volume before hunting for anomalies.

• Whats This User Doing whats-this-user-doing.kql

  Unions `DeviceEvents`, `DeviceNetworkEvents`, and `DeviceFileEvents` to give a timestamped activity trace for a single user, including URLs touched. Swiss-army knife for user investigations — includes a Facebook-usage example.

• Whos Logging In And When whos-logging-in-and-when.kql

  Timestamped feed of RDP logon (4624/LogonType 10), logoff (4634), and reconnect/disconnect (4778/4779) events over 30 days.

Web Tier

Hunts against web session / HTTP telemetry — ASIM Web Session (`_Im_WebSession`) and its `CommonSecurityLog` fallback for non-ASIM workspaces.

• Hunt Spring Boot Heapdump Exfiltration Asim hunt-spring-boot-heapdump-exfiltration-asim.kql

  Hunts Spring Boot Actuator heap-dump exfiltration in ASIM Web Session data by matching the endpoint ID as a path segment (position-independent) instead of hardcoding `/actuator/heapdump`. Recovers the real base path from traffic and ranks by response-size verdict.

• Hunt Spring Boot Heapdump Exfiltration Commonsecuritylog hunt-spring-boot-heapdump-exfiltration-commonsecuritylog.kql

  Non-ASIM (`CommonSecurityLog`) variant of the heap-dump hunt. Uses correct CEF field names (`ReceivedBytes` / `SentBytes`) and carries both byte directions because CEF doesn't tell you which side is the response.