T1027.010

← All KQL categories

MITRE ATT&CK Technique

T1027.010

1 query tagged with this technique.
View on MITRE ATT&CK →

• Hunting Hunt Encoded Command Usage Across Fleet Time Baseline

  Encoded-command executions correlated across the fleet against a rolling per-host time baseline. TimeBucket alone as the join key — deliberately no DeviceId.