Initial Access

← All KQL categories

MITRE ATT&CK Tactic

Initial Access

19 queries tagged with this tactic.
View on MITRE ATT&CK →

• Analytics Rules Detect Excel Xll Addin Spawning Shell Or Network

  Excel loading an XLL add-in that then spawns a shell or beacons out — the spreadsheet-as-shell malware delivery vector.

• Analytics Rules Detect Nextjs Middleware Authorization Bypass

  Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

• Analytics Rules Detect Peoplesoft Process Spawning Unexpected Shell

  Oracle PeopleSoft server processes (psadmin, psappsrv, java) spawning cmd, bash, whoami, curl, or net — post-exploitation shape of a PeopleSoft RCE.

• Analytics Rules Detect Smartconnect Session Without Signin

  Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.

• Analytics Rules Detect Successful Login Following Distributed Ssh Brute Force

  Successful SSH login against a host that just weathered a distributed brute-force campaign. Pair with the Act-I hunt to know if the lightning hit anything.

• Analytics Rules Detect Vpn Session Without Prior Authentication

  PAN-OS GlobalProtect VPN sessions established without a matching auth event in the preceding 5 minutes — the shape of CVE-2026-0257. Uses windowed leftouter, not range-predicate leftanti.

• Email & Phishing Top Blocked Malware Email Events

  Top blocked malware email events. Does what it says on the tin.

• Email & Phishing Top Phishing Domains

  Top phishing *sender domains* with severity categorized by volume.

• Email & Phishing Top Phishing Sender Recipient Pairs

  Top phishing volume grouped by *(recipient, sender-domain)* pair — useful for spotting targeted campaigns against specific users.

• Email & Phishing Top Phishing Targets

  Top *recipients* of phishing emails (targeted individuals) with severity by volume.

• Email & Phishing Whos Clicking On Junk Mail

  Users who clicked links in messages that landed in the Junk folder — a strong "who needs training" signal.

• Hunting Hunt Cloud Storage Bucket Lookalike References

  References to cloud storage buckets whose names are lookalikes of your real ones — homoglyphs, dashes-for-underscores, plausibly-typosquatted variants.

• Hunting Hunt Credential Compromise Signin Audit Alert Three Table

  Three-table credential-compromise chain: joins risky sign-ins, audit follow-up, and downstream SecurityAlert on the same user.

• Hunting Hunt Npm Postinstall Config Modification No User Context

  npm postinstall/lifecycle scripts that modified config without a corresponding interactive user command — AsyncAPI-shaped supply-chain compromise.

• Hunting Hunt Npm Postinstall Grandchild Network Payload

  npm supply-chain worms where the payload runs two process generations down — 'sins of the grandfather' shape. Traces npm → sh -c → curl.

• Hunting Hunt Teams Phishing Then Suspicious Login Correlation

  Teams phishing messages correlated with subsequent suspicious sign-ins for the same recipient — deals with ExternalAccess not being populated by falling back to sender-domain-outside-org.

• Hunting / User Activity Whos Logging In And When

  Timestamped feed of RDP logon (4624/LogonType 10), logoff (4634), and reconnect/disconnect (4778/4779) events over 30 days.

• Posture Inventory Exposed Spring Boot Actuator Endpoints

  Inventory of Spring Boot Actuator endpoints that answer 200 anywhere in your estate — flips the entity from "who scanned us" (infinite) to "which of my services answer" (finite and fixable). Recovers the real management base path from traffic.

• Posture Inventory Installed Npm Packages With Lifecycle Scripts

  Inventory of npm packages installed across your fleet that carry postinstall / preinstall / install lifecycle scripts — the finite, closable population for sins-of-the-grandfather class attacks.