Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,219 downloads21,193 copies871 likes151,517 views
546 detections
Filters
Last updated
All Time
Detection languages
544
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query from file: Agent 365 – Local AI Agent Installation Detection
https://github.com/MSNightmare/GreatXML
KQL Query from file: Exposure Management: AI Agents Inventory
https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler
Based on eSentire TRU dataset:
https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat
https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
KQL Query from file: CVE-2026-48095 Surface Attack Area
KQL Query from file: VSCode Extension Inventory In Your MDE Tenant
KQL Query
KQL Query from file: Email Bombing and Teams Impersonation Detection
Page 8 of 55