ASimDnsActivityLogs
Search and discover KQL queries for Microsoft Sentinel, Defender, and Azure Monitor
Our Sponsors
ASimDnsActivityLogs
08 DNS Data Exfil Long Labels
SecurityEvent
03 DNS Click Fix Nslookup Payload
ASimDnsActivityLogs
02 DNS C2 Beaconing Periodic
ASimDnsActivityLogs
01 DNS Tunneling TXT High Volume
ASimDnsActivityLogs
12 DNS NXDOMAIN DGA Flood
ASimDnsActivityLogs
13 DNS NULL ANY Tunneling
ASimDnsActivityLogs
18 DNS Do H Bypass
ASimDnsActivityLogs
06 DNS Amplification Open Resolver
ASimDnsActivityLogs
15 DNS Subdomain Enum Brute Force
ASimDnsActivityLogs
10 DNS Internal Recon Sweep
SecurityEvent
11 DNS Certutil LOL Bin Chain
SecurityEvent
16 DNS DNS Admin DLL Injection
ASimDnsActivityLogs
09 DNS WPAD Abuse
ASimDnsActivityLogs
17 DNS ADIDNS Wildcard Abuse
ASimDnsActivityLogs
21 DNS Suspicious TLD Volume
ASimDnsActivityLogs
14 DNS MX Payload Staging
ASimDnsActivityLogs
20 DNS Dynamic DNS Provider Abuse
ThreatIntelIndicatorsASimDnsActivityLogs
19 DNS Threat Intel Domain Match
ASimDnsActivityLogs
07 DNS Rebinding Rapid TTL
AADServicePrincipalSignInLogs
HUNT 18 SP Signin New Country
AzureActivity
HUNT 15 Identity Ops Anomaly Deep Dive
AzureActivity
HUNT 08 Privileged Ops Outside Hours
SigninLogsAADServicePrincipalSignInLogs
HUNT 26 Risky Anonymizer Signin Timeline
AzureActivity
HUNT 21 Caller IP Concentration
AzureActivity
HUNT 25 Storage Data Protection Changes
AuditLogs
HUNT 23 MFA Auth Method Changes
StorageBlobLogs
HUNT 03 Storage Blob Exfiltration
AzureActivity
HUNT 17 Key Vault Bulk Read
AzureActivity
HUNT 14 Sentinel Config Changes
AzureActivity
HUNT 09 New SP Key Vault Access
AzureActivity
HUNT 12 NSG Firewall Change History
AuditLogs
HUNT 24 Guest Invite Privileged Role
AuditLogsAzureActivity
HUNT 06 Orphaned Privileged Roles
AzureActivity
HUNT 16 First Seen Resource Provider Per Identity
SigninLogs
HUNT 20 Signin Anomalous ASN
AuditLogs
HUNT 19 Consent Grant Burst
AzureActivity
RULE 15 VM Custom Script Extension
AzureActivityStorageBlobLogs
RULE 04 Storage SAS Token Bulk Generation
StorageBlobLogs
RULE 13 Storage Anonymous Public Access
AzureActivity
RULE 03 Mass Privileged Role Assignments
AzureActivity
RULE 17 Anomalous Management Operations
AzureActivity
RULE 09 Privileged Ops New IP
AzureActivitySigninLogsAADServicePrincipalSignInLogs
RULE 12 Mass Resource Creation
AzureActivitySigninLogsAADServicePrincipalSignInLogs
RULE 11 Mass Resource Deletion
AzureActivity
RULE 16 Sentinel Analytics Rule Deleted
AADServicePrincipalSignInLogsAzureActivity
RULE 10 SP CA Bypass Management Ops
SigninLogsAADServicePrincipalSignInLogsAzureActivity