Suspicious behavior by LOLBIN
Aggregating and translating to KQL the collection of detection of LOLBINs from the LOLBAS project: https://lolbas-project.github.io/ Some of the detections will likely be noisy based on the environment, so tuning is required before deploying. NRT applicable when running in Defender portal
Microsoft Sentinel (KQL)
