Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Near real-time (NRT) custom DefenderXDR detection & isolation for Windows Whatsapp security risk

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•42

KQL Query

Microsoft Sentinel (KQL)

Tags

T1059.007 - JavaScript T1105 - Ingress Tool Transfer T1071.001 - Web Protocols TA0002 - Execution TA0011 - Command and Control T1059 - Command and Scripting Interpreter T1064 - Scripting T1100 - Web Shell T1505.003 - Web Shell T1059.004 - Unix Shell TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation File Creation Script Execution Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?