Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

One-Click ANY RUN Storm-1747 KQL Scan

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•71

KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan

Microsoft Sentinel (KQL)

Tags

G0031 - Dust Storm G1046 - Storm-1811 C0016 - Operation Dust Storm T1586.002 - Email Accounts T1566.001 - Spearphishing Attachment T1114 - Email Collection DS0022 - File T1070.004 - File Deletion T1204.002 - Malicious File T1126 - Network Share Connection Removal T1070.007 - Clear Network Connection History and Configurations T1070.005 - Network Share Connection Removal TA0042 - Resource Development TA0001 - Initial Access TA0009 - Collection TA0005 - Defense Evasion TA0002 - Execution Email Attachment Downloaded Email Malware Detected Network Connection File Creation File Modification File Access File Download HTTP Request Windows Office 365 M365 Unified Audit Log Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?