Deep Dive

← All KQL categories

Deep Dive

Deep Dive

42 queries backed by a KQL Detection of the Week Deep Dive article — long-form research explaining the design rationale, telemetry assumptions, tuning, and ATT&CK context behind each detection.

• Analytics Rules Detect Autogen Studio Agent Tool Execution Anomaly

  AutoGen Studio-hosted AI agent taking code-execution or sensitive-tool actions outside its baseline set — the 'AutoJack' agent-abuse shape.

• Analytics Rules Detect Ci Build Egress To First Seen Domain

  CI/CD build process reaching out to a domain never seen from your build fleet before — 'the build that called a stranger.'

• Analytics Rules Detect Diagnostic Deletion Then Tenant Activity Same Session

  Enhanced log-suppression sequence detection that further requires the follow-on activity to share the same CallerIpAddress — same session, not just same identity.

• Analytics Rules Detect Diagnostic Deletion Then Tenant Activity Sequence

  T1562.008 sequence: Azure diagnostic-setting deletion followed by any activity from the same Caller within 60 minutes.

• Analytics Rules Detect Dll Masquerading As Microsoft Defender

  DLLs pretending to be Microsoft Defender via resource-level publisher/original-filename metadata — a Vidar Stealer TTP.

• Analytics Rules Detect Excel Xll Addin Spawning Shell Or Network

  Excel loading an XLL add-in that then spawns a shell or beacons out — the spreadsheet-as-shell malware delivery vector.

• Analytics Rules Detect Nextjs Middleware Authorization Bypass

  Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

• Analytics Rules Detect Oauth Token Used From Novel Country

  OAuth token used from a country the user has never signed in from — ToddyCat/Umbrij downstream shape where the token itself is the payload.

• Analytics Rules Detect Peoplesoft Process Spawning Unexpected Shell

  Oracle PeopleSoft server processes (psadmin, psappsrv, java) spawning cmd, bash, whoami, curl, or net — post-exploitation shape of a PeopleSoft RCE.

• Analytics Rules Detect Remote Shell Command Arrival Over Wire

  Shell command that arrived over the network — outbound-then-inbound-executed script pattern uncommon in legitimate remote code execution.

• Analytics Rules Detect Sharepoint Toolshell Rce Encoded Command

  SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.

• Analytics Rules Detect Smartconnect Session Without Signin

  Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.

• Analytics Rules Detect Successful Login Following Distributed Ssh Brute Force

  Successful SSH login against a host that just weathered a distributed brute-force campaign. Pair with the Act-I hunt to know if the lightning hit anything.

• Analytics Rules Detect Telegram Tdata Session Theft File Access

  Theft of Telegram's tdata session directory by an unexpected process. Uses actual DeviceFileEvents ActionTypes (FileCreated/Modified) — `FileRead` doesn't exist.

• Analytics Rules Detect Unsigned Dll Load Verified Signing State

  Unsigned DLL loads, using IsSigned/SigningStatus rather than treating an empty SHA256 as unsigned (the field is documented as usually-populated, not always).

• Analytics Rules Detect Vpn Session Without Prior Authentication

  PAN-OS GlobalProtect VPN sessions established without a matching auth event in the preceding 5 minutes — the shape of CVE-2026-0257. Uses windowed leftouter, not range-predicate leftanti.

• Hunting Hunt Azure Diagnostic Setting Deletions

  Deletions of Azure diagnostic settings — the moment an attacker turns off logging (T1562.008). Step 1 of a two-step sequence.

• Hunting Hunt Blockchain Rpc C2 Dead Drop

  C2 traffic hidden inside blockchain-RPC calls to public utilities (QuickNode, Alchemy) — 'the dead drop is a public utility.'

• Hunting Hunt C2 Beacon By Connection Window Rhythm

  Low-and-slow C2 beacon hunt that counts distinct hourly time windows a process was connected in — not raw connection volume.

• Hunting Hunt Cav3rn Endpoint Local Log File Artifact

  Endpoint-side hunt for Project CAV3RN's local file artifact (`logAzure.txt` and family) — config persistence written by the module.

• Hunting Hunt Cloud Metadata Ssrf Normalized Forms

  Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.

• Hunting Hunt Cloud Storage Bucket Lookalike References

  References to cloud storage buckets whose names are lookalikes of your real ones — homoglyphs, dashes-for-underscores, plausibly-typosquatted variants.

• Hunting Hunt Credential Compromise Signin Audit Alert Three Table

  Three-table credential-compromise chain: joins risky sign-ins, audit follow-up, and downstream SecurityAlert on the same user.

• Hunting Hunt Distributed Ssh Brute Force Per Target

  SSH brute-force hunt that pivots on the target host, not the source IP — catches distributed attacks that stay under per-source thresholds by using thousands of IPs.

• Hunting Hunt DNS Aaaa Record Covert Recovery Channel

  Project CAV3RN's DNS AAAA-record recovery channel — IPv6 addresses returned in AAAA queries that decode as ASCII or structured config.

• Hunting Hunt Encoded Command Usage Across Fleet Time Baseline

  Encoded-command executions correlated across the fleet against a rolling per-host time baseline. TimeBucket alone as the join key — deliberately no DeviceId.

• Hunting Hunt First Time Admin Operation User Baseline

  Baselines identities that have ever executed admin operations, then alerts when an account outside that set succeeds — 'the admin who has never administered.'

• Hunting Hunt Inflated File Payload Evading Size Based Av Scan

  File downloads anomalously large for their kind — Vidar's null-byte padding trick to slip past AV scanners that skip files above a size ceiling.

• Hunting Hunt Linux Process Argv0 Vs Executable Mismatch

  Linux processes where argv[0] doesn't match the actual binary that was executed — a process wearing another process's name tag.

• Hunting Hunt Metadata IP Any Encoded Form Inspecting DNS Answer

  Inspects what DNS actually resolved to (the Answer field), not what the caller wrote — catches every obfuscated string form of the metadata IPs at the resolver level.

• Hunting Hunt Npm Postinstall Config Modification No User Context

  npm postinstall/lifecycle scripts that modified config without a corresponding interactive user command — AsyncAPI-shaped supply-chain compromise.

• Hunting Hunt Npm Postinstall Grandchild Network Payload

  npm supply-chain worms where the payload runs two process generations down — 'sins of the grandfather' shape. Traces npm → sh -c → curl.

• Hunting Hunt Outlook Calendar C2 Far Future Standing Meeting

  Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.

• Hunting Hunt Suspicious User Consented Oauth App Grants

  'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.

• Hunting Hunt Teams Phishing Then Suspicious Login Correlation

  Teams phishing messages correlated with subsequent suspicious sign-ins for the same recipient — deals with ExternalAccess not being populated by falling back to sender-domain-outside-org.

• Hunting / File Activity Detect Spring Boot Heapdump Artifact On Disk

  Detects Spring Boot Actuator heap-dump theft by the artifact Spring writes to disk during the request (`heapdumpgt;[-live]gt;.hprof`). The filename is proof an HTTP request hit the endpoint even when the web tier didn't log the URL.

• Hunting / Web Tier Hunt Spring Boot Heapdump Exfiltration Asim

  Hunts Spring Boot Actuator heap-dump exfiltration in ASIM Web Session data by matching the endpoint ID as a path segment (position-independent) instead of hardcoding `/actuator/heapdump`. Recovers the real base path from traffic and ranks by response-size verdict.

• Hunting / Web Tier Hunt Spring Boot Heapdump Exfiltration Commonsecuritylog

  Non-ASIM (`CommonSecurityLog`) variant of the heap-dump hunt. Uses correct CEF field names (`ReceivedBytes` / `SentBytes`) and carries both byte directions because CEF doesn't tell you which side is the response.

• Posture Inventory Exposed Spring Boot Actuator Endpoints

  Inventory of Spring Boot Actuator endpoints that answer 200 anywhere in your estate — flips the entity from "who scanned us" (infinite) to "which of my services answer" (finite and fixable). Recovers the real management base path from traffic.

• Posture Inventory Installed Npm Packages With Lifecycle Scripts

  Inventory of npm packages installed across your fleet that carry postinstall / preinstall / install lifecycle scripts — the finite, closable population for sins-of-the-grandfather class attacks.

• Posture Which Devices Are Internet Facing

  Identify internet-facing devices — walks through what "public" actually means for both IPv4 and IPv6 before matching.

• Posture Which Devices Or Software Are EOL

  Devices running at least one end-of-support / end-of-life software title or version, from `DeviceTvmSoftwareInventory`.