avatar

Steven Lim

@KQLWizard
KQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,420 copies852 likes146,821 views

541 detections

612 Cloudflare phishing domains by @whichbuffer from EclecticIQ

KQL
https://gist.github.com/whichbuffer/4dab8a4d4ce4fea0dbfe73b7e3c3f6a7
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
16491,413

Detecting OAuth Persistence After AiTM Attacks

KQL
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
14672,091

Detecting DefenderWrite Exploitation in Microsoft Defender for Endpoint

KQL
KQL Query
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
86141,591

CVE-2025-49144: Notepad++ Privilege Escalation Vulnerability

KQL
KQL Query
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
7581,369

Detecting Threat Actor Storm-2657

KQL
KQL Query from file: Detecting Threat Actor Storm-2657
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
6563,046

Hunting MSIX Malware: Combining Splunk Insights with DefenderXDR Precision

KQL
KQL Query
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
174564

Correlating DeviceInfo and CommonSecurityLog to Detect Operation Zero Disco

KQL
KQL Query
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
161505

Lab539: Tracking ClickFix Infrastructure

KQL
KQL Query from file: Lab539: Tracking ClickFix Infrastructure
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
4961,224

Detection for Sudo Chroot Privilege Escalation (CVE-2025-32463)

KQL
KQL Query
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
3071,000

7-Zip CVE-2025-11002 Detection

KQL
KQL Query from file: 7-Zip CVE-2025-11002 Detection
avatar
Steven Lim@KQLWizard
avatar
SlimKQL
1 year ago
3931,252
Page 14 of 55