Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,219 downloads21,204 copies871 likes151,526 views
546 detections
Filters
Last updated
All Time
Detection languages
544
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
Detect suspicious graph user activity with behavioral analytics (UEBA)
A user inadvertently granted consent to an external, unverified OAuth application. Exploiting the high-level permissions obtained, a threat actor initiated an attack targeting the tenant’s environment via Microsoft Graph.
DefenderXDR Custom Detection
A KQL query designed to monitor for potential exploitation of CVE-2025-6218—a directory traversal vulnerability in WinRAR—until the affected infrastructure is fully patched and secured.
KQL Query from file: 🕷️The Hunt for Spidy Phishing Domains 🎣
KQL Query
KQL Query from file: Storm 1811 SE Attack Detection
KQL Query from file: Hunting Exposed JDWP
KQL Query from file: Direct Send Abuse Detection
Page 21 of 55