Microsoft Defender ATP Hunting Queries

Report Bug · Request Feature

About The Project

This repository comprises Microsoft Defender Hunting queries. These queries have been developed using telemetry data provided by Defender ATP.This queries were used as Detection rules in production enviroment, They are a result of my own work and inspiration drawn from the contributions of the exceptional community members acknowledged below. Please don't hesitate to propose any additional queries for inclusion in this repository.

Roadmap

• [ ✅ ] Add detections based on ASR rules
• Add detections based on windows API's logged

See the open issues for a full list of proposed features (and known issues).

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement".

License

Distributed under the MIT License. See LICENSE.txt for more information.

Acknowledgments

• https://github.com/SigmaHQ/sigma
• https://github.com/FalconForceTeam/FalconFriday
• https://detection.fyi/
• https://github.com/elastic/detection-rules/tree/main/rules