Search and discover KQL queries for Microsoft Sentinel, Defender, and Azure Monitor
Our Sponsors ❤️
DeviceProcessEvents
Git Abuse High Fidelity
DeviceProcessEvents
Execution Git Commit Amend No Verify
DeviceProcessEvents
Execution Batch Git Abuse
DeviceProcessEvents
Defense Evasion Time Change Git
DeviceProcessEvents
Defense Evasion Git Config Masquerade
DeviceProcessEvents
Correlation Git And VS Code Task Abuse
DeviceProcessEvents
Git Force Push
DeviceLogonEventsDeviceNetworkEvents
Privileged RDP Session Source Mismatch
DeviceRegistryEvents
IFEO Unauthorized Debugger Registration
DeviceProcessEvents
Mac OS Suspicious Shell Or Direct Process Execution From Browser
DeviceTvmSecureConfigurationAssessmentDeviceTvmSecureConfigurationAssessmentKB
Device TVM Secure Configuration Assessment Summary
DeviceNetworkEvents
Node C2polinder
DeviceFileEvents
Vs Code Persistence
DeviceProcessEvents
Polin Rider Node
AzureActivity
Azure Azure Activity Compromised Account
EntraIdSignInEventsSigninLogs
Successful Signin From Suspicious User Agent
DeviceProcessEvents
Local Administrator Account Added By Scheduled Task
DeviceEvents
Defender IOC Warning Bypass Or Monitor Mode MDA Bypass
DeviceInfo
List Devices Array
SecurityEvent
Security Event Unusual User Account Authentication
EmailAttachmentInfoEmailEvents
IC Catching Emojis Into Email Attachment Files Names
DeviceFileEvents
IC Catching Emojis Into File Names
EmailEventsUrlClickEvents
IC Catching Emojis On Email Subjects
FileMaliciousContentInfo
MDO File Malicious Content Info
SentinelHealth
Sentinel Health Scheduled Analytics Rule Runs Anomaly
DeviceProcessEvents
Advanced Multi Stage Windows Enumeration Post Exploitation Detector
DeviceNetworkEvents
Potential Beaconing Activity
DeviceProcessEvents
Advanced Multi Stage Linux Enumeration Post Exploitation Detector
DeviceEvents
Process Primary Token Elevated To Se Debug Priv
DeviceEvents
Scheduled Tasks From App Data Created Or Updated
DeviceProcessEventsDeviceEvents
Defender Exclusion Events
DeviceEvents
Rare Lnk File Created On Desktop
AuditLogsAADSignInEventsBeta
Detection Of High Risk Sign Ins From New Or Uncommon I Ps With User Agent Or OS Changes
DeviceNetworkEvents
Monitoring Explorer Initiated External Traffic
CopilotActivity
Excessive Copilot Prompt Activity
CopilotActivity
Microsoft Copilot Access To External Resources XPIA
CloudAppEvents
Microsoft Copilot Jailbreak Detected
DeviceProcessEvents
Attempt To Disable Syslog Service
DeviceProcessEvents
Attempt To Disable Auditd Service
ADOAuditLogs_CL
Azure Dev Ops Activity From Newor Rare IP Outside Business Hours
ADOAuditLogs_CL
Azure Dev Ops Critical Search Queries
ADOAuditLogs_CL
Azure Dev Ops Critical Permission Modification
LOLDriversDeviceEvents
MDE Asr Vulnerable Signed Driver Blocked
DeviceProcessEvents
Click Fix Lo L Bin Abuse
DeviceProcessEvents
Click Fix Nslookup DNS Staging
DeviceRegistryEvents
Run MRU Click Fix Detection
SecurityIncidentSecurityAlert
Alert Efficiency
EntraIdSignInEvents
Entra Id Sign In Events Suspicious User Agent
EntraIdSignInEvents
Entra Id Sign In Events Hunting Potential Seamless SSO Usage
DeviceEventsDeviceNetworkInfo