Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,416 copies852 likes146,790 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
https://www.manifold.security/blog/open-vsx-evil-twin-extensions
https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix
KQL Query from file: Indirect Prompt Injection Risk Assessment
KQL Query from file: Prompt Injector Analysis Report
https://guard.io/labs/hermeticreader---the-vulnerability-that-turned-adobe-300m-install-extension-into-a-full-whatsapp-takeover
This KQL detect public internet facing WordPress installation that is susceptible to WP2Shell a pre-auth RCE chain in core that lets anonymous attackers run code on default installs, no plugins required.
https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/
KQL Query from file: LegacyHive Duo Detection
Page 4 of 55