GitHub - kraken8585/AdvancedHunting: Advanced Hunting Queries for Microsoft Security Products

kraken8585 / AdvancedHunting Public

forked from jangeisbauer/AdvancedHunting

Notifications You must be signed in to change notification settings
Fork 0
Star 1

Advanced Hunting Queries for Microsoft Security Products

Notifications

Name		Name	Last commit message	Last commit date
Latest commit History 58 Commits
Phish Hunting		Phish Hunting
AADIds_with_multiple_DeviceNames		AADIds_with_multiple_DeviceNames
AntiVirusReporting		AntiVirusReporting
AzSentinel_AuditLogs_AppPermissions		AzSentinel_AuditLogs_AppPermissions
Create Non_intended_user_logon.txt		Create Non_intended_user_logon.txt
Detect_Possible_Disablement_of_MDE		Detect_Possible_Disablement_of_MDE
Detect_Possible_Disablement_of_MDE_MDI-Edition		Detect_Possible_Disablement_of_MDE_MDI-Edition
Detected new Vuln in Enterprise		Detected new Vuln in Enterprise
Example_WorkingWithJSON		Example_WorkingWithJSON
Executed_Scripts_after_download		Executed_Scripts_after_download
Join_and_summarize_example		Join_and_summarize_example
Log4J-Reporting		Log4J-Reporting
Phish-Impersonation		Phish-Impersonation
ProcessTokenModification		ProcessTokenModification
SW-VLN-found-got-email-with-payload.txt		SW-VLN-found-got-email-with-payload.txt
SimpleTimespanFileCreation.txt		SimpleTimespanFileCreation.txt
Sort_By_Severity		Sort_By_Severity
SpringShell		SpringShell
asrReportingWithLookup		asrReportingWithLookup
coronamap.txt		coronamap.txt
detect_ETW_Bypassing_Net		detect_ETW_Bypassing_Net
device_auth_phishing		device_auth_phishing
dynamic_lolbin_hunting		dynamic_lolbin_hunting
hunt_for_lolbins		hunt_for_lolbins
hunt_for_ps_download_activity_and_subsequent_process_creation		hunt_for_ps_download_activity_and_subsequent_process_creation
hunting_active_rdp_connections		hunting_active_rdp_connections
hunting_proc_creation_from_ps_or_cmd		hunting_proc_creation_from_ps_or_cmd
report_devices_older_than		report_devices_older_than
report_local_admins		report_local_admins
report_pua		report_pua
search-for-zapped-email		search-for-zapped-email
which_mailitem_were_accessed		which_mailitem_were_accessed
which_user_has_vuln_app_installed		which_user_has_vuln_app_installed
wsreset and new-item events in short timeframe		wsreset and new-item events in short timeframe