Skip to content
BranchesTags

Latest commit

 

History

63 Commits

Folders and files

NameName
Last commit message
Last commit date
Phish Hunting
Phish Hunting
 
 
AADIds_with_multiple_DeviceNames
AADIds_with_multiple_DeviceNames
 
 
AntiVirusReporting
AntiVirusReporting
 
 
AzSentinel_AuditLogs_AppPermissions
AzSentinel_AuditLogs_AppPermissions
 
 
Create Non_intended_user_logon.txt
Create Non_intended_user_logon.txt
 
 
Detect_Possible_Disablement_of_MDE
Detect_Possible_Disablement_of_MDE
 
 
Detect_Possible_Disablement_of_MDE_MDI-Edition
Detect_Possible_Disablement_of_MDE_MDI-Edition
 
 
Detected new Vuln in Enterprise
Detected new Vuln in Enterprise
 
 
Example_WorkingWithJSON
Example_WorkingWithJSON
 
 
Executed_Scripts_after_download
Executed_Scripts_after_download
 
 
Join_and_summarize_example
Join_and_summarize_example
 
 
Log4J-Reporting
Log4J-Reporting
 
 
Phish-Impersonation
Phish-Impersonation
 
 
ProcessTokenModification
ProcessTokenModification
 
 
Report_Legacy_Software_Usage
Report_Legacy_Software_Usage
 
 
Report_by_Devicegroup
Report_by_Devicegroup
 
 
SW-VLN-found-got-email-with-payload.txt
SW-VLN-found-got-email-with-payload.txt
 
 
SimpleTimespanFileCreation.txt
SimpleTimespanFileCreation.txt
 
 
Sort_By_Severity
Sort_By_Severity
 
 
SpringShell
SpringShell
 
 
asrReportingWithLookup
asrReportingWithLookup
 
 
coronamap.txt
coronamap.txt
 
 
detect_ETW_Bypassing_Net
detect_ETW_Bypassing_Net
 
 
device_auth_phishing
device_auth_phishing
 
 
dynamic_lolbin_hunting
dynamic_lolbin_hunting
 
 
hunt_for_lolbins
hunt_for_lolbins
 
 
hunt_for_ps_download_activity_and_subsequent_process_creation
hunt_for_ps_download_activity_and_subsequent_process_creation
 
 
hunt_for_reverse_proxy_tunnels
hunt_for_reverse_proxy_tunnels
 
 
hunting_active_rdp_connections
hunting_active_rdp_connections
 
 
hunting_proc_creation_from_ps_or_cmd
hunting_proc_creation_from_ps_or_cmd
 
 
report_devices_older_than
report_devices_older_than
 
 
report_local_admins
report_local_admins
 
 
report_pua
report_pua
 
 
search-for-zapped-email
search-for-zapped-email
 
 
which_mailitem_were_accessed
which_mailitem_were_accessed
 
 
which_user_has_vuln_app_installed
which_user_has_vuln_app_installed
 
 
wsreset and new-item events in short timeframe
wsreset and new-item events in short timeframe
 
 

About

Advanced Hunting Queries for Microsoft Security Products

Activity

Stars

108 stars

Watchers

14 watching

Forks

20 forks
Report repository

Releases

Packages

Contributors