Windows

← All KQL categories

Platform

Windows

34 queries tagged with this platform.

• Analytics Rules Detect Dll Masquerading As Microsoft Defender

  DLLs pretending to be Microsoft Defender via resource-level publisher/original-filename metadata — a Vidar Stealer TTP.

• Analytics Rules Detect Excel Xll Addin Spawning Shell Or Network

  Excel loading an XLL add-in that then spawns a shell or beacons out — the spreadsheet-as-shell malware delivery vector.

• Analytics Rules Detect Peoplesoft Process Spawning Unexpected Shell

  Oracle PeopleSoft server processes (psadmin, psappsrv, java) spawning cmd, bash, whoami, curl, or net — post-exploitation shape of a PeopleSoft RCE.

• Analytics Rules Detect Remote Shell Command Arrival Over Wire

  Shell command that arrived over the network — outbound-then-inbound-executed script pattern uncommon in legitimate remote code execution.

• Analytics Rules Detect Sharepoint Toolshell Rce Encoded Command

  SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.

• Analytics Rules Detect Telegram Tdata Session Theft File Access

  Theft of Telegram's tdata session directory by an unexpected process. Uses actual DeviceFileEvents ActionTypes (FileCreated/Modified) — `FileRead` doesn't exist.

• Analytics Rules Detect Unsigned Dll Load Verified Signing State

  Unsigned DLL loads, using IsSigned/SigningStatus rather than treating an empty SHA256 as unsigned (the field is documented as usually-populated, not always).

• Cost & Ingest / Cost By Eventid Cost Of Eventid By Computer

  Breaks the cost of a specific Event ID out by originating computer (defaults to `EventID == 4672`).

• Cost & Ingest / Cost By Eventid Cost Of Eventid

  Estimated cost of a single Event ID over a time window, using your effective per-GB rate.

• Cost & Ingest / Cost By Eventid Eventid By Billedsize

  Ingest volume in GB per Event ID from the `SecurityEvent` table.

• Cost & Ingest / Cost By Eventid Top 10 Eventids Windows Securityevents

  Top 10 most expensive Event IDs from the `SecurityEvent` table over the last 90 days.

• Cost & Ingest / Cost By Eventid Top 10 Windowsevent Eventids

  Top 10 most expensive Event IDs from the `WindowsEvent` table (AMA-shipped) over the last 90 days.

• Cost & Ingest / Cost By Table Cost Of Workstations Logging Direct To Sentinel

  Find workstations shipping logs directly to Sentinel and estimate what it's costing you.

• Cost & Ingest / Cost By Table Top 10 Security Events With Cost Enhanced

  Top `SecurityEvent` `EventID`s (30d) with GiB, emoji cost-tier, and formatted `$X.XX` string.

• Cost & Ingest / Cost By Table Top 10 Security Events With Cost

  Top `SecurityEvent` `EventID`s with `Activity` (30d) and numeric `CostUSD`.

• Hunting Hunt C2 Beacon By Connection Window Rhythm

  Low-and-slow C2 beacon hunt that counts distinct hourly time windows a process was connected in — not raw connection volume.

• Hunting Hunt Cav3rn Endpoint Local Log File Artifact

  Endpoint-side hunt for Project CAV3RN's local file artifact (`logAzure.txt` and family) — config persistence written by the module.

• Hunting Hunt DNS Aaaa Record Covert Recovery Channel

  Project CAV3RN's DNS AAAA-record recovery channel — IPv6 addresses returned in AAAA queries that decode as ASCII or structured config.

• Hunting Hunt Encoded Command Usage Across Fleet Time Baseline

  Encoded-command executions correlated across the fleet against a rolling per-host time baseline. TimeBucket alone as the join key — deliberately no DeviceId.

• Hunting Hunt Inflated File Payload Evading Size Based Av Scan

  File downloads anomalously large for their kind — Vidar's null-byte padding trick to slip past AV scanners that skip files above a size ceiling.

• Hunting Hunt Npm Postinstall Config Modification No User Context

  npm postinstall/lifecycle scripts that modified config without a corresponding interactive user command — AsyncAPI-shaped supply-chain compromise.

• Hunting Hunt Npm Postinstall Grandchild Network Payload

  npm supply-chain worms where the payload runs two process generations down — 'sins of the grandfather' shape. Traces npm → sh -c → curl.

• Hunting / Eventid Forensics How Many Times Does This Eventid Fire From This Machine

  Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

• Hunting / Eventid Forensics Which Accounts Are Throwing This Eventid

  Which accounts fire a specific Event ID and how often, per day.

• Hunting / Eventid Forensics Which Devices Are Throwing This Eventid

  Which computers fire a specific Event ID and how often, per day.

• Hunting / Eventid Forensics Which Eventid Fires The Most In A Month

  Noisiest Event IDs across the last month — good for spotting new noise sources.

• Hunting / Eventid Forensics Which Eventids Are Suddenly Acting Weird With Context

  Same deviation analysis as the basic variant, joined with `Computer` and `Account` so you can see which host or user is driving the spike in one shot. Uses a 30-day recent window to reduce join noise.

• Hunting / Eventid Forensics Which Eventids Are Suddenly Acting Weird

  Which Event IDs have recently spiked (7d) versus their 90-day baseline, sorted by deviation ratio. Basic variant — just EventID + counts.

• Hunting / File Activity Detect Spring Boot Heapdump Artifact On Disk

  Detects Spring Boot Actuator heap-dump theft by the artifact Spring writes to disk during the request (`heapdumpgt;[-live]gt;.hprof`). The filename is proof an HTTP request hit the endpoint even when the web tier didn't log the URL.

• Hunting / File Activity File Activity Audit

  Timestamped file activity (open, read, modify, delete, create) by user and device. Written for a client that needed to demonstrate this capability to an auditor.

• Hunting / User Activity RDP Logins Per Day Per User

  RDP logins per user per day (30d) rendered as a timechart. Use for baselining "normal" login volume before hunting for anomalies.

• Hunting / User Activity Whos Logging In And When

  Timestamped feed of RDP logon (4624/LogonType 10), logoff (4634), and reconnect/disconnect (4778/4779) events over 30 days.

• Identity Who Deleted An AD User

  Who deleted an AD user (`SecurityEvent` EventID `4726`) over the last 90 days.

• Posture Inventory Installed Npm Packages With Lifecycle Scripts

  Inventory of npm packages installed across your fleet that carry postinstall / preinstall / install lifecycle scripts — the finite, closable population for sins-of-the-grandfather class attacks.