Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,075 downloads19,418 copies852 likes146,808 views
541 detections
Filters
Last updated
All Time
Detection languages
539
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
MC1293480: https://admin.cloud.microsoft/?ref=MessageCenter/:/messages/MC1293480
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
This rule detects successful sign-ins to specific Microsoft 365 applications (identified by ApplicationId '08ad6f98-a4f8-4635-bb8d-f1a3044760f0' or '07c030f6-5743-41b7-ba00-0a6e85f37c17') from devices that have previously established a network connection with a process named 'cowork-svc'. The rule correlates network connection events with Azure AD sign-in events over a 30-day lookback period to identify potentially legitimate or suspicious activity related to 'cowork-svc' application usage.
https://socket.dev/blog/bitwarden-cli-compromised
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631
https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/
https://github.com/Nightmare-Eclipse/UnDefend
https://github.com/Nightmare-Eclipse/RedSun/blob/main/README.md
https://github.com/blackarrowsec/redteam-research/tree/master/CVE-2026-33829
KQL Query from file: DefenderXDR BlueHammer Detection
Page 9 of 55