Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,418 copies852 likes146,808 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
KQL Query from file: CVE-2026-48095 Surface Attack Area
KQL Query from file: VSCode Extension Inventory In Your MDE Tenant
KQL Query
KQL Query from file: Email Bombing and Teams Impersonation Detection
KQL Query
This rule detects the creation of a process named 'conhost.exe' with 'System' integrity level, where the initiating process is an executable file with low global prevalence. This behavior can be indicative of malicious activity, as adversaries might use conhost.exe to execute commands or maintain persistence, especially when launched by an uncommon or suspicious executable.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/
KQL Query from file: CVE-2026-31431 CopyFail
Page 8 of 55