Awais Munir
@iawaishttps://threatnexus.onlineTrusted contributorCompletionist
15 followers193 downloads1,508 copies159 likes54,085 views
76 detections
Filters
Last updated
All Time
Detection languages
67
9
Categories
18
14
14
10
9
Platforms
69
6
2
2
2
Products / Services
43
13
5
4
3
MITRE Techniques
16
13
12
9
7
CVEs
2
Hunts for abuse of Microsoft 365’s Direct Send feature where attackers send spoofed emails appearing internal, bypassing filters. Includes detection of suspicious DNS queries, outbound network connections, and PowerShell abuse for insider misuse.
This hunting query detects potential abuse of the MS-RPC protocol for DoS/DDoS attacks by monitoring outbound LDAP-related DNS queries originating from Domain Controllers.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
Purpose: Hunts for risky OAuth applications in Microsoft 365 with overly permissive Microsoft Graph permissions.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
Detects .lnk (shortcut) files launched by scripting engines (e.g., PowerShell, CMD, WScript) exhibiting suspicious traits like hidden execution, embedded commands, or admin privilege requests. Common in phishing, LOLBin abuse, and initial access.
This KQL query hunts for suspicious activities in Microsoft Defender for Endpoint that may indicate attempts to disable or manipulate Windows Event Logging, such as clearing logs, stopping the Event Log service, or modifying audit policies. It targets processes and commands associated with MITRE ATT&CK technique T1562.002 to identify potential defense evasion tactics.
Hunt malicious abuse of BITS (Background Intelligent Transfer Service) for file transfers, code execution, and persistence, analyzing command-line patterns and suspicious process chains commonly used by attackers.
Detects potential email harvesting using PowerShell cmdlets with export parameters, stealth flags, and uncommon parent processes.
Detects instances where sensitive process lsass.exe is accessed by potentially malicious or abused utilities like powershell.exe, cmd.exe, rundll32.exe, or wmic.exe, which may indicate credential dumping or reconnaissance activity.
It also captures admin tools commonly abused for credential dumping, including memory dump indicators via DLLs like comsvcs.dll.
It also captures admin tools commonly abused for credential dumping, including memory dump indicators via DLLs like comsvcs.dll.
This query identifies suspicious use of appcmd.exe to install IIS native-code modules via command line, excluding legitimate installations initiated by iissetup.exe. It’s useful for spotting potential backdoor deployments like RGDoor or other malicious IIS extensions.
This query identifies devices with frequent outbound HTTP/HTTPS connections to external IPs, suggesting possible chunked data exfiltration.
Page 7 of 8