Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,416 copies852 likes146,790 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
This KQL detect public internet facing WordPress installation that is susceptible to WP2Shell a pre-auth RCE chain in core that lets anonymous attackers run code on default installs, no plugins required.
https://www.okta.com/en-au/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/
https://zerobec.com/blog/inside-forg365-telegram-distributed-sneaky2fa-style-phaas
KQL Query from file: LegacyHive Duo Detection
https://zerobec.com/blog/debull-storm-2372-microsoft-device-code-phishing-graphspy
KQL Query from file: Agent365 AutoJack Detection
KQL Query from file: Preemptive Search for ARToken PhaaS Domain Lures
KQL Query from file: Forg365 PhaaS Detection Using Silent Push
KQL Query from file: Tenant MCP Server Connectivity Risk Assessment
KQL Query from file: MDVM Zero-Day Impact Analysis
Page 5 of 55