Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,420 copies852 likes146,821 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query from file: Homoglyph Attack Indicators
This KQL provide a detailed audit listing of your tenant consented OAuth apps and their granted permissions and number of users consented.
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
On October 14, 2025, less than one month from now, Exchange Server 2016 and Exchange Server 2019 will reach end of support. It’s critical to upgrade now to remain supported and secure. This query check for all possible builds of Exchange Server 2016 and Exchange Server 2019.
Port scanning is a common precursor to ransomware attacks, typically occurring during the reconnaissance phase. With Entra Global Secure Access deployed across your endpoints for zero-trust access, you can leverage KQL to detect port scan activity indicative of early-stage threat behavior.
🧩 What This Reveals
🔵Inter-VNet Routing: You’re mapping out which VNets are configured to route traffic to other VNets.
🔵Potential Exposure Paths: This can help identify unintended or overly permissive routing configurations.
🔵Topology Insight: Useful for visualizing network architecture or validating segmentation policies.
🔵Inter-VNet Routing: You’re mapping out which VNets are configured to route traffic to other VNets.
🔵Potential Exposure Paths: This can help identify unintended or overly permissive routing configurations.
🔵Topology Insight: Useful for visualizing network architecture or validating segmentation policies.
https://www.bleepingcomputer.com/news/security/virustotal-finds-hidden-malware-phishing-campaign-in-svg-files/
KQL Query from file: Sentinel TI DNS Tunneling Detection
https://any.run/cybersecurity-blog/salty2fa-technical-analysis/
KQL Query
Page 16 of 55