Discovery

← All KQL categories

MITRE ATT&CK Tactic

Discovery

11 queries tagged with this tactic.
View on MITRE ATT&CK →

• Hunting Hunt Cloud Metadata Ssrf Normalized Forms

  Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.

• Hunting Hunt Metadata IP Any Encoded Form Inspecting DNS Answer

  Inspects what DNS actually resolved to (the Answer field), not what the caller wrote — catches every obfuscated string form of the metadata IPs at the resolver level.

• Hunting / Eventid Forensics How Many Times Does This Eventid Fire From This Machine

  Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

• Hunting / Eventid Forensics Which Accounts Are Throwing This Eventid

  Which accounts fire a specific Event ID and how often, per day.

• Hunting / Eventid Forensics Which Devices Are Throwing This Eventid

  Which computers fire a specific Event ID and how often, per day.

• Hunting / Eventid Forensics Which Eventid Fires The Most In A Month

  Noisiest Event IDs across the last month — good for spotting new noise sources.

• Hunting / Eventid Forensics Which Eventids Are Suddenly Acting Weird With Context

  Same deviation analysis as the basic variant, joined with `Computer` and `Account` so you can see which host or user is driving the spike in one shot. Uses a 30-day recent window to reduce join noise.

• Hunting / Eventid Forensics Which Eventids Are Suddenly Acting Weird

  Which Event IDs have recently spiked (7d) versus their 90-day baseline, sorted by deviation ratio. Basic variant — just EventID + counts.

• Hunting / File Activity File Activity Audit

  Timestamped file activity (open, read, modify, delete, create) by user and device. Written for a client that needed to demonstrate this capability to an auditor.

• Hunting / User Activity RDP Logins Per Day Per User

  RDP logins per user per day (30d) rendered as a timechart. Use for baselining "normal" login volume before hunting for anomalies.

• Hunting / User Activity Whats This User Doing

  Unions `DeviceEvents`, `DeviceNetworkEvents`, and `DeviceFileEvents` to give a timestamped activity trace for a single user, including URLs touched. Swiss-army knife for user investigations — includes a Facebook-usage example.