Search: #KQL

Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
I owe something to @alexverboon for far too long. I promised him that I will find a way to update the hunting lists in my repo related to @spamhaus and @Netcraft so people can run #KQL and hunt for internet's most notorious TLDs. This time has come and with a bit of a help from AI, both lists are being updated weekly so you can take advantage of your #KQL setup to hunt for potentially malicious emails. Check the hunting lists here: github.com/cyb3rmik3/Hunting… Make sure to familiarize yourself with externaldata operator to leverage the lists: michalos.net/2024/01/22/harn…
GitHub - cyb3rmik3/Hunting-Lists: A repository of curated lists with elements such as IoCs to use...

GitHub - cyb3rmik3/Hunting-Lists: A repository of curated lists with elements such as IoCs to use...

A repository of curated lists with elements such as IoCs to use for threat hunting & detection queries. - cyb3rmik3/Hunting-Lists

github.com
1
11
1
47
2,454
Using KQL to investigate potential RDP brute-force activity on a Windows endpoint. Filtering failed authentication events (Event ID 4625) to identify suspicious remote login attempts. #KQL #MicrosoftSentinel #CyberSecurity #SOCAnalyst #BlueTeam
2
89
🎃 No tricks. Just KQL. ​ Hunting threats, building detections, and sharing with the community. Happy Halloween! 👻 ​ #KQL #MicrosoftSentinel #DefenderXDR #KQLWizard
Image from Steven Lim (@0x534c)
2
3
55
2,553
Creating custom detection rules in Microsoft Defender for Endpoint? Remember to include Timestamp, ReportId, and DeviceId in your query results. They help identify the original event and associate alerts with the correct device. #MicrosoftDefender #KQL
4
187
Troubleshooting Windows endpoints in Microsoft Sentinel? Heartbeat | take 10 Add a TimeGenerated filter to check for recent heartbeat records. This helps verify whether heartbeat data from your Windows endpoint is reaching the Log Analytics workspace. #MicrosoftSentinel #KQL
3
152
SecurityEvent | where EventID == 4625 | summarize FailedAttempts = count() by TargetAccount | order by FailedAttempts desc #KQL #MicrosoftSentinel #SOCAnalyst
1
4
145
A good KQL query does more than return results. It helps detect suspicious behaviour and supports effective investigations. It’s not just about writing queries. It’s about knowing what you’re detecting and why. #CyberSecurity #KQL #SOCAnalyst
2
142
With all the recent app compromises: when hunting or detecting credential changes on Entra apps, don't stop at secrets and certs. Many (Sentinel Content Hub) detections only cover those. Federated credentials can be added just as quietly. 👇 #KQL #Entra #Security #ITDR #DFIR
Image from Nicola Suter (@nicolonsky)
3
1
10
693
Have you ever wondered what the schema of nested fields like AdditionalFields, RawEventData, AuthenticationDetails is? There was no real docs until now Based on real (lab) data I generated a breath of synthesized samples and schemas. Happy detection engineering #KQL #XDR #KUSTO
Image from Fabian Bader (@fabian_bader)
Image from Fabian Bader (@fabian_bader)
3
15
69
4,556
800⭐️ 4 years in the making, what a journey... #KQL #KustoQueryLanguage
Image from ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs (@Cyb3rMik3)
3
1
14
597
🎉 I earned the Microsoft Applied Skills: Implement a Real-Time Intelligence Solution with Microsoft Fabric badge! Tough but worth it. 🚀 Learned about: ✅ Eventstream ✅ Eventhouse ✅ KQL (Kusto Query Language) ✅ Real-Time Intelligence in Fabric #MicrosoftFabric #KQL
Image from Oluwapelumi Arowosaye (@Pelumi_Analyst)
1
14
390
KQL is live in the investigations. Every operation already carried its logs. You could read them. Now you can query them. Nothing to install, no dataset. What do you run first? #KQL #SOCSimulator #SOCAnalyst
1
1
4
123
Interesting repo to check out with some #KQL and #SPL hunting queries. github.com/sims718718/Unifie…
GitHub - sims718718/UnifiedThreatHunting: A threat hunting process

GitHub - sims718718/UnifiedThreatHunting: A threat hunting process

A threat hunting process. Contribute to sims718718/UnifiedThreatHunting development by creating an account on GitHub.

github.com
30
1
176
8,882
Raw data floods from Azure, Sentinel & more? KQL turns it into automated risk intelligence. Experts break down exactly how. #KQL #InfoSec go.rodtrent.com/go/7j66g48
Image from Speaker 25 (@rodtrent)
7
662
Cloud data keeps growing fast, and KQL is becoming the must-have skill for data scientists working in it. This eBook lays out the essentials clearly. #KQL #DataScience slingagent.com/go/pax964j
Image from Speaker 25 (@rodtrent)
3
620
You might want to run something like this..... #KQL #MDE #Defender #Cyber #Windows #Microsoft DeviceProcessEvents | where TimeGenerated > ago(90d) | where ProcessCommandLine contains "--remote-debugging-port=" | project DeviceName, ProcessCommandLine, AccountName
4
10
1
70
6,949
When logs and security data keep growing, advanced KQL skills become non-negotiable. This eBook delivers exactly that depth. #KQL #Azure slingagent.com/go/tqz6xze
Image from Speaker 25 (@rodtrent)
1
9
814
Kql Detection Of The Week: A Meeting In 2050 (detecting Project Cav3rn's Outlook Calendar C2 And Dns Aaaa Recovery Channel) hanley.cloud/2026-07-27-KQL-… #MustLearnKQL #KQL #KQLMysteries

Kql Detection Of The Week: A Meeting In 2050 (detecting Project Cav3rn's Outlook Calendar C2 And...

There is a meeting on your calendar for 13 May 2050. Nobody will ever attend it. Nobody has ever scrolled there — a quarter-century out, in a fixed one-hour window between 22:00 and 23:00 UTC, parked...

hanley.cloud
4
732
KustoCon 2026 on Oct 30, Microsoft Switzerland + online. Free online sessions, onsite ticket includes the KQL workshop. Register: kustocon.com/registration #KustoCon #KQL
Image from Gianni (@castello_johnny)
1
5
8
605
Hybrid identity attacks hide between AD and cloud telemetry. Jul 30, see KQL examples for sync-layer activity and the visibility gaps Storm-0501 exploits. 🔗 buff.ly/Lo8Pybd #KQL #IdentitySecurity
Image from SANS Cloud Security (@SANSCloudSec)
2
5
559
Load more