Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,418 copies852 likes146,808 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
https://www.sentinelone.com/vulnerability-database/cve-2026-41089/
KQL Query from file: AI MCP Agent Visibility & Risk Assessment
KQL Query from file: Rise in Kali365 .de domains
KQL Query from file: EDRChoker Detection
KQL Query
KQL Query from file: Agent 365 – Local AI Agent Installation Detection
https://github.com/MSNightmare/GreatXML
KQL Query from file: Exposure Management: AI Agents Inventory
https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler
Based on eSentire TRU dataset:
https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat
https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat
Page 7 of 55