microsoft/Microsoft-365-Defender-Hunting-Queries issues and pull requests

#438 - Devices without successful AV scan in the last n days

Pull Request - State: closed - Opened by f-bader almost 3 years ago - 1 comment

#437 - Create Suspicious PowerShell curl flags.md

Pull Request - State: closed - Opened by dreadphones almost 3 years ago

#436 - specified Windows Powershell

Pull Request - State: closed - Opened by hollsy almost 3 years ago - 1 comment

#435 - Create SAM-Name-Changes-CVE-2021-42278

Pull Request - State: closed - Opened by danaim1 almost 3 years ago - 1 comment

#434 - Create Qakbot Craigslist Domains.md

Pull Request - State: closed - Opened by dreadphones almost 3 years ago

#433 - Microsoft-365-Defender-Hunting-Queries/M365-PowerBi Dashboard/: Table 'Software' contains a duplicate value

Issue - State: open - Opened by KhaaliTurbo almost 3 years ago

#432 - Graph Role Management permission grant and Admin promotion via Admin Directory Role

Pull Request - State: closed - Opened by Cyb3rWard0g almost 3 years ago - 1 comment

#431 - Add modification-of-exefile-shell-open-key.md

Pull Request - State: open - Opened by Karneades almost 3 years ago - 1 comment

#430 - Qakbot campaign process injection query is not correct

Issue - State: open - Opened by ionsor about 3 years ago

#429 - Update qakbot-campaign-process-injection.md

Pull Request - State: open - Opened by ionsor about 3 years ago

#428 - Update insider-threat-detection-queries.md

Pull Request - State: open - Opened by sei-nitc about 3 years ago

#427 - Create Qakbot Craigslist Domains.md

Pull Request - State: closed - Opened by mcyr5 about 3 years ago

#426 - Update Imminent Ransomware.md

Pull Request - State: closed - Opened by endisphotic about 3 years ago

#425 - Create Use of MSBuild as LOLBin.md

Pull Request - State: closed - Opened by dreadphones about 3 years ago

#424 - Create l33tspeak 11 Oct 2021 - externaldata and query partitioning.csl

Pull Request - State: closed - Opened by mjmelone about 3 years ago

#423 - Update Airlift 2021 - Lets Invoke.csl

Pull Request - State: open - Opened by KustoKing about 3 years ago

#422 - Attack Surface Reduction Rules Device Events

Pull Request - State: open - Opened by deanpickering about 3 years ago - 1 comment

#421 - Adding Airlift 2021 content

Pull Request - State: closed - Opened by mjmelone about 3 years ago

#420 - Create Suspicious Registry Keys.md

Pull Request - State: closed - Opened by dreadphones about 3 years ago

#419 - Updated to use the new UsbDriveMounted event

Pull Request - State: open - Opened by mjmelone about 3 years ago

#418 - Updating URL list

Pull Request - State: closed - Opened by mjmelone about 3 years ago

#417 - Update Qakbot discovery activies.md

Pull Request - State: open - Opened by cbresponse about 3 years ago

#416 - Update DetectTorRelayConnectivity.md

Pull Request - State: closed - Opened by Dylan-J about 3 years ago

#415 - improved malicious SMB named pipe detection

Pull Request - State: closed - Opened by Iveco about 3 years ago

#414 - Create EarthBaku-APT-41-files-domains.txt

Pull Request - State: open - Opened by Phoenix9032 about 3 years ago

#413 - Initial commit for rclone hunting queries

Pull Request - State: open - Opened by LoZio about 3 years ago - 1 comment

#412 - rclone hashes for all version released

Issue - State: closed - Opened by LoZio about 3 years ago - 1 comment

#411 - Create successive-tk-domain-calls.md

Pull Request - State: closed - Opened by alimajalt about 3 years ago

#411 - Create successive-tk-domain-calls.md

Pull Request - State: closed - Opened by alimajalt about 3 years ago

#410 - Create deimos-component-execution.md

Pull Request - State: closed - Opened by alimajalt about 3 years ago

#409 - Update evasive-powershell-executions.md

Pull Request - State: closed - Opened by alimajalt about 3 years ago

#408 - C2 Framework detection by SMB named pipes

Pull Request - State: closed - Opened by Iveco about 3 years ago - 1 comment

#407 - Create JNLP-File-Attachment.md

Pull Request - State: closed - Opened by mcyr5 about 3 years ago - 1 comment

#407 - Create JNLP-File-Attachment.md

Pull Request - State: closed - Opened by mcyr5 about 3 years ago - 1 comment

#406 - Moving LemonDuck-component-names.md

Pull Request - State: closed - Opened by alimajalt about 3 years ago

#406 - Moving LemonDuck-component-names.md

Pull Request - State: closed - Opened by alimajalt about 3 years ago

#405 - Create LemonDuck-component-download-structure.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#404 - Create LemonDuck-defender-exclusions.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#404 - Create LemonDuck-defender-exclusions.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#403 - Create LemonDuck-competition-killer.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#403 - Create LemonDuck-competition-killer.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#402 - Create LemonDuck-id-generation.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#402 - Create LemonDuck-id-generation.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#401 - Create LemonDuck-component-names.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#401 - Create LemonDuck-component-names.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#400 - Create LemonDuck-control-structure.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#400 - Create LemonDuck-control-structure.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#399 - Create LemonDuck-registration-function

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#399 - Create LemonDuck-registration-function

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#398 - Create LemonDuck-email-subjects

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#398 - Create LemonDuck-email-subjects

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#397 - Create Stolen Images Execution.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#397 - Create Stolen Images Execution.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#396 - ProxyShell.md

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#396 - ProxyShell.md

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#395 - Create Processes Created from Files with Non-ASCII Characters.md

Pull Request - State: open - Opened by mjmelone over 3 years ago

#395 - Create Processes Created from Files with Non-ASCII Characters.md

Pull Request - State: open - Opened by mjmelone over 3 years ago

#394 - Create referral-phish-emails.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#394 - Create referral-phish-emails.md

Pull Request - State: closed - Opened by alimajalt over 3 years ago

#393 - Create Ousaban Banking Trojan.md

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#393 - Create Ousaban Banking Trojan.md

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#392 - Create RunDLL Suspicious Network Connection.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#392 - Create RunDLL Suspicious Network Connection.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#391 - Update Malicious Excel Delivery.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#391 - Update Malicious Excel Delivery.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#390 - Update Bazacall Emails.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#390 - Update Bazacall Emails.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#389 - Update Bazacall Emails.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#389 - Update Bazacall Emails.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#388 - Create Pulse Secure.md

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#388 - Create Pulse Secure.md

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#387 - Create CVE-2021-36934 usage detection.md

Pull Request - State: closed - Opened by YulelogPagoda over 3 years ago

#387 - Create CVE-2021-36934 usage detection.md

Pull Request - State: closed - Opened by YulelogPagoda over 3 years ago

#386 - Create MosaicLoader

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago

#386 - Create MosaicLoader

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago

#385 - Create SolarWinds -CVE-2021-35211

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago

#385 - Create SolarWinds -CVE-2021-35211

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago

#384 - Solarwinds another zero-day

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago - 1 comment

#384 - Solarwinds another zero-day

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago - 1 comment

#383 - Update MD AV Signature and Platform Version.md

Pull Request - State: closed - Opened by yujiaoMSFT over 3 years ago - 1 comment

#383 - Update MD AV Signature and Platform Version.md

Pull Request - State: closed - Opened by yujiaoMSFT over 3 years ago - 1 comment

#382 - Update MD AV Signature and Platform Version.md

Pull Request - State: closed - Opened by yujiaoMSFT over 3 years ago - 1 comment

#382 - Update MD AV Signature and Platform Version.md

Pull Request - State: closed - Opened by yujiaoMSFT over 3 years ago - 1 comment

#381 - Create SolarWinds -CVE-2021-35211

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#381 - Create SolarWinds -CVE-2021-35211

Pull Request - State: open - Opened by Shivammalaviya over 3 years ago

#380 - Create SolarWinds - CVE-2021-35211

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago

#380 - Create SolarWinds - CVE-2021-35211

Pull Request - State: closed - Opened by Shivammalaviya over 3 years ago

#379 - Update document title

Pull Request - State: closed - Opened by mikepowell over 3 years ago

#379 - Update document title

Pull Request - State: closed - Opened by mikepowell over 3 years ago

#378 - BazaCall additions

Pull Request - State: closed - Opened by martyav over 3 years ago

#378 - BazaCall additions

Pull Request - State: closed - Opened by martyav over 3 years ago

#377 - Change the format ro align it with others query

Pull Request - State: closed - Opened by darioongit over 3 years ago

#377 - Change the format ro align it with others query

Pull Request - State: closed - Opened by darioongit over 3 years ago

#376 - Change the format ro align it with others query

Pull Request - State: closed - Opened by darioongit over 3 years ago

#376 - Change the format ro align it with others query

Pull Request - State: closed - Opened by darioongit over 3 years ago

#375 - Create Spoolsv Spawning Rundll32.md

Pull Request - State: closed - Opened by endisphotic over 3 years ago

#375 - Create Spoolsv Spawning Rundll32.md

Pull Request - State: closed - Opened by endisphotic over 3 years ago

#374 - Update Suspicious Spoolsv Child Process.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#374 - Update Suspicious Spoolsv Child Process.md

Pull Request - State: closed - Opened by dreadphones over 3 years ago

#373 - Update Suspicious Spoolsv Child Process.md

Pull Request - State: open - Opened by endisphotic over 3 years ago

GitHub / microsoft/Microsoft-365-Defender-Hunting-Queries issues and pull requests