Steven Lim
@KQLWizardKQLWizard.comTrusted contributorCompletionist
579 followers2,219 downloads21,194 copies871 likes151,520 views
546 detections
Filters
Last updated
All Time
Detection languages
544
2
Categories
107
71
61
60
58
Platforms
204
148
139
31
31
Products / Services
164
160
62
60
35
MITRE Techniques
215
201
182
167
137
CVEs
2
1
1
1
1
KQL Query
This rule detects the creation of a process named 'conhost.exe' with 'System' integrity level, where the initiating process is an executable file with low global prevalence. This behavior can be indicative of malicious activity, as adversaries might use conhost.exe to execute commands or maintain persistence, especially when launched by an uncommon or suspicious executable.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/
KQL Query from file: CVE-2026-31431 CopyFail
MC1293480: https://admin.cloud.microsoft/?ref=MessageCenter/:/messages/MC1293480
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
This rule detects successful sign-ins to specific Microsoft 365 applications (identified by ApplicationId '08ad6f98-a4f8-4635-bb8d-f1a3044760f0' or '07c030f6-5743-41b7-ba00-0a6e85f37c17') from devices that have previously established a network connection with a process named 'cowork-svc'. The rule correlates network connection events with Azure AD sign-in events over a 30-day lookback period to identify potentially legitimate or suspicious activity related to 'cowork-svc' application usage.
https://socket.dev/blog/bitwarden-cli-compromised
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631
Page 9 of 55