Defense Evasion

← All KQL categories

MITRE ATT&CK Tactic

Defense Evasion

14 queries tagged with this tactic.
View on MITRE ATT&CK →

• Analytics Rules Detect Diagnostic Deletion Then Tenant Activity Same Session

  Enhanced log-suppression sequence detection that further requires the follow-on activity to share the same CallerIpAddress — same session, not just same identity.

• Analytics Rules Detect Diagnostic Deletion Then Tenant Activity Sequence

  T1562.008 sequence: Azure diagnostic-setting deletion followed by any activity from the same Caller within 60 minutes.

• Analytics Rules Detect Dll Masquerading As Microsoft Defender

  DLLs pretending to be Microsoft Defender via resource-level publisher/original-filename metadata — a Vidar Stealer TTP.

• Analytics Rules Detect Nextjs Middleware Authorization Bypass

  Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

• Analytics Rules Detect Oauth Token Used From Novel Country

  OAuth token used from a country the user has never signed in from — ToddyCat/Umbrij downstream shape where the token itself is the payload.

• Analytics Rules Detect Sharepoint Toolshell Rce Encoded Command

  SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.

• Analytics Rules Detect Smartconnect Session Without Signin

  Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.

• Analytics Rules Detect Unsigned Dll Load Verified Signing State

  Unsigned DLL loads, using IsSigned/SigningStatus rather than treating an empty SHA256 as unsigned (the field is documented as usually-populated, not always).

• Analytics Rules Detect Vpn Session Without Prior Authentication

  PAN-OS GlobalProtect VPN sessions established without a matching auth event in the preceding 5 minutes — the shape of CVE-2026-0257. Uses windowed leftouter, not range-predicate leftanti.

• Hunting Hunt Azure Diagnostic Setting Deletions

  Deletions of Azure diagnostic settings — the moment an attacker turns off logging (T1562.008). Step 1 of a two-step sequence.

• Hunting Hunt Cloud Metadata Ssrf Normalized Forms

  Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.

• Hunting Hunt Encoded Command Usage Across Fleet Time Baseline

  Encoded-command executions correlated across the fleet against a rolling per-host time baseline. TimeBucket alone as the join key — deliberately no DeviceId.

• Hunting Hunt Inflated File Payload Evading Size Based Av Scan

  File downloads anomalously large for their kind — Vidar's null-byte padding trick to slip past AV scanners that skip files above a size ceiling.

• Hunting Hunt Linux Process Argv0 Vs Executable Mismatch

  Linux processes where argv[0] doesn't match the actual binary that was executed — a process wearing another process's name tag.