Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,219 downloads21,193 copies871 likes151,517 views
546 detections
Filters
Last updated
All Time
Detection languages
544
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query from file: Prompt Injector Analysis Report
https://guard.io/labs/hermeticreader---the-vulnerability-that-turned-adobe-300m-install-extension-into-a-full-whatsapp-takeover
This KQL detect public internet facing WordPress installation that is susceptible to WP2Shell a pre-auth RCE chain in core that lets anonymous attackers run code on default installs, no plugins required.
https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/
KQL Query from file: LegacyHive Duo Detection
This KQL detect public internet facing WordPress installation that is susceptible to WP2Shell a pre-auth RCE chain in core that lets anonymous attackers run code on default installs, no plugins required.
https://www.okta.com/en-au/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/
https://zerobec.com/blog/inside-forg365-telegram-distributed-sneaky2fa-style-phaas
KQL Query from file: LegacyHive Duo Detection
https://zerobec.com/blog/debull-storm-2372-microsoft-device-code-phishing-graphspy
Page 5 of 55