Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,420 copies852 likes146,821 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query
KQL Query from file: Shuyal Stealer Detection
KQL Query from file: Palo Alto Scanning Surges Detection
KQL Query
KQL Query from file: New Redis RCE Alert: CVE-2025-49844
KQL Query
KQL Query
A DefenderXDR Custom Detection for CVE-2025-56383
This KQL audit all your AD service accounts ( account with PasswordNeverExpires attribute set) whether the password was updated based your service account password rotation policy. (E.g In this KQL it's set to one year)
This rule identifies Cisco network devices within Microsoft Defender for Endpoint (MDE) telemetry that are running Cisco IOS or Cisco XE operating systems, excluding version '17.15.4a'. The exclusion of a specific OS version suggests the rule is designed to pinpoint devices that may be vulnerable to a known security flaw, potentially CVE-2025-20352 as indicated by the rule's title. It helps in mapping exposure to specific vulnerabilities by identifying potentially unpatched or vulnerable network infrastructure components.
Page 15 of 55