Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,418 copies852 likes146,810 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query from file: Admin consent for M365 Connector for Claude
KQL Query
KQL Query from file: M365 Connector for Claude Detection
KQL Query from file: KQL Detection for MDI Password Protection Insight
KQL Query from file: Axios Compromise Detection via 3rd Party
https://blog.checkpoint.com/research/iran-nexus-password-spray-campaign-targeting-cloud-environments-with-a-focus-on-the-middle-east/
KQL Query
Detects presence of X-Antibot-Token header in HTTP requests
Detects presence of X-Antibot-Token header in HTTP requests
This rule detects inbound emails from 'azure-noreply@microsoft.com' that are delivered to the inbox, are the first contact from this sender, and contain specific keywords in the subject line such as 'severity', 'activated', 'deactivated', 'alert', 'invoice', 'payment', 'order', or 'fund'. This could indicate phishing attempts or social engineering using a spoofed Microsoft sender to deliver urgent or financially-themed messages.
Page 10 of 55