Our Sponsors ❤️
DeviceTvmCertificateInfoDeviceInfoDeviceTvmSoftwareVulnerabilities
MDE Digi Cert Global Root G2
SigninLogs
Correlation Id Equals Tenant Id In Peculiar Password Spray
DeviceEventsDeviceNetworkEventsDeviceProcessEvents
Suspicious MS Build Remote Thread
DeviceProcessEvents
Pod Containerexec
DeviceFileEvents
Executable Files Program Data Folder
DeviceInfo
MDE Device Groups
DeviceInfo
MDE Device Active Inactive
EmailEventsEmailUrlInfo
KQL Techniques For Email URL Redirect Hunting
IdentityAccountInfoIdentityInfo
MDI Identity Password Security Posture Assessment
OfficeActivityCloudAppEvents
MDO Auto Forwarding Mode
resources
Azure Resource Graph APIM With Basic Auth Enabled
AuditLogs
Entra Account Disabled
AuditLogs
Entra Group Changes
AuditLogs
Entra Password Resets
AuditLogs
User Deleted From Entra
AuditLogs
Device Deleted From Entra
resources
Audit Logic Apps With Office365 Connections Using Resource Query
DeviceProcessEvents
Executables In App Data Local Roaming
resourcechanges
Azure Resource VM Sku Sizes Changes
IdentityInfo
UEBA Find Onpremise Users With Password Not Required
resourcechanges
Azure Resource VM Sku Sizes
DeviceEvents
MDI Automatic Windows Auditing Configuration
TorExitNodesHistoricDeviceNetworkEvents
IC Tor Exit Browser Hunting Based On Device Events
DeviceProcessEventsDeviceImageLoadEvents
Rustdeskexecution
ExposureGraphNodesExposureGraphEdges
Hunt Critical Credentials On Non Cred Guard Devices
DeviceFileEventsDeviceNetworkEvents
Data Staging File Zilla Ps FTP Winscp
DeviceProcessEvents
Veeam PSQL Dump
DeviceEvents
DNS Zone Export
DeviceProcessEvents
Sshtunneltoexternalhost
DeviceProcessEvents
NTD Sdumpwbadmin
DeviceProcessEvents
Bumblee Bee Initiailaccess
DeviceProcessEvents
TH Obfuscated Or Encoded Commandline
DeviceInfoDeviceNetworkInfoDeviceNetworkEvents
LM Internal Threat Hunting Over Routers Devices
DeviceNetworkEvents
Detecting Abuse Of Sync Thing Tool To Steal Data
DeviceImageLoadEventsDeviceEventsDeviceNetworkEvents
Sliver C2beacon Loaded
AlertEvidence
NRT Auto IR High Impact Alert
SigninLogs
Entra Identify And Map Authentication Context Usage
AuditLogs
Access Review On Role Assignable Group Auto Deleted
AlertEvidenceAlertInfo
XDR Upn Alerts
DeviceRegistryEvents
Detecting Modification Of Windows Security Audit Policy Auditpolexe
DeviceProcessEvents
Detecting Execution Of Windows Security Audit Policy Auditpolexe
IdentityLogonEventsDeviceNetworkInfoDeviceInfo
Detect Suspicious Spn Logon From Workstation
DeviceNetworkEvents
Detect Dump Guard Ntlm Challenge
OfficeActivity
Third Party Phishing Report Malfunction
AuditLogs
Audit When PIM Fails To Remove An Eligible Member From Role
EmailAttachmentInfoDeviceFileEventsDeviceEvents
Detect Last Pass Hack Emails Attempts To Trick Users Into Installing Malware
DeviceFileEvents
Identifying File Exfiltration Via RDP Sessions
DeviceProcessEvents
Cache Smuggle
DeviceFileEvents
NTDS File Create Modify
IdentityLogonEvents