Rian Alsagheer

@Ralsagheer

0 followers0 downloads19 copies0 likes46 views

1 detection

Filters

Last updated

All Time

Detection languages

Microsoft Sentinel (KQL)1

MITRE Techniques

T1018 - Remote System Discovery1

T1027 - Obfuscated Files or Information1

T1078.002 - Domain Accounts1

T1218 - System Binary Proxy Execution1

T1557 - Adversary-in-the-Middle1

Windows DNS Threat Hunting

KQL

This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.

Rian Alsagheer@Ralsagheer

Detections.ai Community

3 months ago

19046