Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,219 downloads21,204 copies871 likes151,523 views
546 detections
Filters
Last updated
All Time
Detection languages
544
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query
KQL Query
A DefenderXDR Custom Detection for CVE-2025-56383
This KQL audit all your AD service accounts ( account with PasswordNeverExpires attribute set) whether the password was updated based your service account password rotation policy. (E.g In this KQL it's set to one year)
This rule identifies Cisco network devices within Microsoft Defender for Endpoint (MDE) telemetry that are running Cisco IOS or Cisco XE operating systems, excluding version '17.15.4a'. The exclusion of a specific OS version suggests the rule is designed to pinpoint devices that may be vulnerable to a known security flaw, potentially CVE-2025-20352 as indicated by the rule's title. It helps in mapping exposure to specific vulnerabilities by identifying potentially unpatched or vulnerable network infrastructure components.
KQL Query from file: Homoglyph Attack Indicators
This KQL provide a detailed audit listing of your tenant consented OAuth apps and their granted permissions and number of users consented.
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
On October 14, 2025, less than one month from now, Exchange Server 2016 and Exchange Server 2019 will reach end of support. It’s critical to upgrade now to remain supported and secure. This query check for all possible builds of Exchange Server 2016 and Exchange Server 2019.
Port scanning is a common precursor to ransomware attacks, typically occurring during the reconnaissance phase. With Entra Global Secure Access deployed across your endpoints for zero-trust access, you can leverage KQL to detect port scan activity indicative of early-stage threat behavior.
Page 16 of 55