Windows DNS Threat Hunting

Kenji Choy@kchoy

•updated Jul 4, 2026•27•1•111

This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.