Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,421 copies852 likes146,830 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
ESET has identified spearphishing campaigns leveraging malicious RAR attachments to exploit CVE-2025-8088—a WinRAR zero-day vulnerability. This technique delivers RomCom backdoors, attributed to threat actor Storm-0978 (aka Tropical Scorpius / UNC2596).
A post-authentication vulnerability (CVE-2025-53786) in Microsoft Exchange hybrid-joined configurations.
Use MDE device discovery to determine if a SonicWall firewall present in your enterprise environment.
This detection detect non corporate devices running agentic AI programs attempting
KQL Query from file: Detect DeerStealer Delivered via Obfuscated .LNK
https://www.nextron-systems.com/2025/08/01/plague-a-newly-discovered-pam-based-backdoor-for-linux/
KQL Query from file: Chrome extension hard coded credential exposure
KQL Query from file: Phishing Attacks Using Google Apps Script
KQL Query from file: Mail Bomb Attack Visualization
KQL Query from file: Interlock Ransomware Detection
Page 18 of 55