Sample queries for Advanced hunting in Microsoft 365 Defender

License: MIT License

Jupyter Notebook 100.00%

microsoft-365-defender-hunting-queries's Introduction

page_type

languages

products

description

sample

kusto

Microsoft 365 Defender

Microsoft 365 Defender repository for Advanced Hunting

Deprecated

We moved to Microsoft threat protection community, the unified Microsoft Sentinel and Microsoft 365 Defender repository.

Microsoft SIEM and XDR Community provides a forum for the community members, aka, Threat Hunters, to join in and submit these contributions via GitHub Pull Requests or contribution ideas as GitHub Issues. Hunting queries for Microsoft 365 Defender will provide value to both Microsoft 365 Defender and Microsoft Sentinel products, hence a multiple impact for a single contribution. These contributions can be just based on your idea of the value to enterprise your contribution provides or can be from the GitHub open issues list or even enhancements to existing contributions.

Contribute your queries to the Microsoft 365 Defender folder in the Hunting Queries section.
Specifics on what is required for Hunting queries is in the Query Style Guide.
Webcasts content can be found in the Tutorials folder.
Power BI example can be found in the Tools folder.

microsoft-365-defender-hunting-queries's People

Contributors

Stargazers

Watchers

Forkers

mjcaparas jkadeesh jksg cgcfad techlord-rce gregcottingham elflorio siowcy aprakash13 neo4reo outkastti rick-bryant mattiasborg82 hesaad jobaror explife0011 noodled miladca miflower jing-microsoft westkey jreisdorffer rickengle gajasurve x0xa wg135 shalinoid secpfe yqyunjie killbugs freecamel 0utcode sathishdsgithub thered xfixic mollypeters sasqwatch milgaluppang cyb5r4gene bulbafett srknthcse cephurs bennysenone abirghattas therealericolson fzxcp3 siriusanalyst spinmanuk-zz anthonws proton6500 alexverboon jangeisbauer projectboot datagarbage danielmy sco-sim marcspieler vdedyukhin kwhooley midnightslacker sersofohio daiqian4869 jyamo imulmul shinedazzle phoenixml jumars sunilmoriya00 kevinbollengier james2060 guardacyber jimraine mrpreis attackgithub ebartocci10 hypervguy docbrown1981 sbousseaden mmb-exp itguysocal manuelhauch 5up3rc makislev pasilva-msft sunnyc7 ajust300800 tzviday deomaximo 5l1v3r1 blue-infosec akefallonitis billy-sec iftikhariqbal shashank-1729 rosenmoore marcushawley anvascon roth1002 an0n1m1z3 miladaslaner

microsoft-365-defender-hunting-queries's Issues

Persistence: Run key

Web Traffic data hunt

Trying to write a script that will show me all internet/web traffic data for a specific person/machine for a specific amount of a time range.

Example: I want to see what Joe Smith did for the past 30 days with web searching.

Can't seem to find anything that will fit this nor can I seem to write a usable script in Defender.

Can anyone help? Please :)

Incident Query and Isolation history query

Hi
I want to query about "Incidents" list, but can't find any query
also can't find Action history query. such as isolation, virus scan...

Web Content Filtering - status across devices query

Hello Microsoft Team,

Not sure if this is planned already, It would be great to get few queries for a new Web Content Filtering feature. Here are few suggestions:

Web Content Filtering health across endpoints - to show which nodes has a most recent policy
Web Content Filtering events overall stats - to show number of events coming from endpoints
Web Content Filtering details for specific endpoint - show all hits and categories for named endpoint

Regards,
Serg

Data Exfiltration

I'm trying to write a query that will detect two events together. USB storage device attached and then write operation or file creating activity performed on that device.

rclone hashes for all version released

Sorry for not being able to create a PR, but I was looking for rClone in one network (bad guys use it to exfiltrate data) and created a csv containing all the SHA1 hashes of the released versions from 0.96 to current 1.56 (from https://downloads.rclone.org/)
There's the hash of the zip file and the hashes for the windows executables (both x64 and 32 bit).
You can use them to hunt for processes or files. Something like:

let rcloneexeonlyhashes = dynamic([
"713d4a18177e9091c91a1e885d846e084fd19ebe",
"c7f41e8349d93f581704fc7d46a0a86451b701bf",
"713d4a18177e9091c91a1e885d846e084fd19ebe",
"c7f41e8349d93f581704fc7d46a0a86451b701bf",
"f11acf701130422f0b291e74a29b5c0c82967e22",
"575ed20f418d6c84d74c527c40d098c7c145ba49",
"f11acf701130422f0b291e74a29b5c0c82967e22",
"575ed20f418d6c84d74c527c40d098c7c145ba49",
"0774c3fad552dffac99ef4089f9d18838dc391f2",
"0774c3fad552dffac99ef4089f9d18838dc391f2",
"9ab49d4dd789eea3f2491406a2cda8ca1eb97999",
"07da4a6aff4596d286f60c44fc0e340179d080ce",
"9ab49d4dd789eea3f2491406a2cda8ca1eb97999",
"07da4a6aff4596d286f60c44fc0e340179d080ce",
"54e4146c3a72dca28287cfec84dc398d4bf9da66",
"af3a8302fb7fe9cc8345b52ae45e531ad17b5959",
"54e4146c3a72dca28287cfec84dc398d4bf9da66",
"af3a8302fb7fe9cc8345b52ae45e531ad17b5959",
"7114bd9865f2dfc7651d9fe05ef9fbf5df8affa2",
"eec2bcb14105ab778ad7c220a40714283a9b9ff7",
"7114bd9865f2dfc7651d9fe05ef9fbf5df8affa2",
"eec2bcb14105ab778ad7c220a40714283a9b9ff7",
"9b7eea8b59a078ec6c0ee2934cfbd45d535e96eb",
"5bc41e54d81c80ed01ea75c4089678af71c9f964",
"9b7eea8b59a078ec6c0ee2934cfbd45d535e96eb",
"5bc41e54d81c80ed01ea75c4089678af71c9f964",
"587cdd23bf627ad7d326ce1f6ba88a7234bce51d",
"d4bd849dd9e74b8e6e7300d456ef5b0141dd5b5a",
"587cdd23bf627ad7d326ce1f6ba88a7234bce51d",
"d4bd849dd9e74b8e6e7300d456ef5b0141dd5b5a",
"e512016cbe67dbd7922cc8f2437c2b94fdf4045b",
"08da698c5c817f1799630c6edc207f049e07b4da",
"e512016cbe67dbd7922cc8f2437c2b94fdf4045b",
"08da698c5c817f1799630c6edc207f049e07b4da",
"e2f09c54f5324b439904b09591fe2084178ab83b",
"8a739e6cde1d0a7b5cf1e54a5fe21a7b73693d00",
"e2f09c54f5324b439904b09591fe2084178ab83b",
"8a739e6cde1d0a7b5cf1e54a5fe21a7b73693d00",
"7069d578c390c50e2277d174079532b72e5753d4",
"90f618e7772327c6193cd9df242a3a1c80d70143",
"7069d578c390c50e2277d174079532b72e5753d4",
"90f618e7772327c6193cd9df242a3a1c80d70143",
"fc02d5739e7174fa98a47cd4e32ad8b5d86f37d9",
"59d76dda2e878942d01e352eb2a1ba938dd0a894",
"fc02d5739e7174fa98a47cd4e32ad8b5d86f37d9",
"59d76dda2e878942d01e352eb2a1ba938dd0a894",
"173b81e84b0dd815f15f650859feebc32ca0e001",
"ff17f910f6927a634deaeeb29cb1baeb99d08513",
"173b81e84b0dd815f15f650859feebc32ca0e001",
"ff17f910f6927a634deaeeb29cb1baeb99d08513",
"f9abe4d61972a816635df8e365bb310a8e61e65a",
"df6363ca6e9ff658b929daa31791642efb320c5f",
"f9abe4d61972a816635df8e365bb310a8e61e65a",
"df6363ca6e9ff658b929daa31791642efb320c5f",
"d4a0888b93bca42b3581fc049b0476bbe13d503b",
"1d24fb905b5bcf910e81d354990dd8e76c6baeb0",
"d4a0888b93bca42b3581fc049b0476bbe13d503b",
"1d24fb905b5bcf910e81d354990dd8e76c6baeb0",
"872348ff87d82dbf47133a080b0154746f540909",
"2a9673f9c6698ffdc26dc63881b739aa7048e4f7",
"872348ff87d82dbf47133a080b0154746f540909",
"2a9673f9c6698ffdc26dc63881b739aa7048e4f7",
"a87edb3df5e22aad29e32ef8c1c6e01358a6b2c2",
"ccd1d542390ce2daac302142447727462bf780a1",
"a87edb3df5e22aad29e32ef8c1c6e01358a6b2c2",
"ccd1d542390ce2daac302142447727462bf780a1",
"bf80ee04ef669df2cb65f8ea87825dacde9b612c",
"47e5264da85973037ea3577651934677f5897927",
"bf80ee04ef669df2cb65f8ea87825dacde9b612c",
"47e5264da85973037ea3577651934677f5897927",
"64d5216d9e039238cf7ccb755ab8efbfca2d24de",
"bd38a1311858c6bfbf78247572ebde6dc6a4f601",
"64d5216d9e039238cf7ccb755ab8efbfca2d24de",
"bd38a1311858c6bfbf78247572ebde6dc6a4f601",
"086c9ed833769162b84313c5616141e081fece49",
"adb0112f007874d18bb3389e56bb9593808d9110",
"086c9ed833769162b84313c5616141e081fece49",
"adb0112f007874d18bb3389e56bb9593808d9110",
"916313e0a2e351c82dc99f543ff738fa4cd888f9",
"32bb3dac48ef079acd62254d901fe4119ddac440",
"916313e0a2e351c82dc99f543ff738fa4cd888f9",
"32bb3dac48ef079acd62254d901fe4119ddac440",
"1fd69a06e8a4530d62c53c62eabc957e7575cd72",
"24716ddb72d6fb33287b3da2a4d1b3f18ecb9390",
"1fd69a06e8a4530d62c53c62eabc957e7575cd72",
"24716ddb72d6fb33287b3da2a4d1b3f18ecb9390",
"97a0b46efb4d86a5241a104f4a64261b7a80dcd5",
"44774ad6aa7ac68b48038555ff7e9a8bef66a2a7",
"97a0b46efb4d86a5241a104f4a64261b7a80dcd5",
"44774ad6aa7ac68b48038555ff7e9a8bef66a2a7",
"5c2513d14f2ff15b15e2494dff4b89ff968a9e82",
"c924530ea27f5a9c15fa8a46fd1b1d10e0681654",
"5c2513d14f2ff15b15e2494dff4b89ff968a9e82",
"c924530ea27f5a9c15fa8a46fd1b1d10e0681654",
"1f76dd9f672b3290ae91ad8f8f19b6c5779e53c3",
"a9d6536efecfae3925666d858c19a811c4b12a98",
"1f76dd9f672b3290ae91ad8f8f19b6c5779e53c3",
"a9d6536efecfae3925666d858c19a811c4b12a98",
"30350bda781eecee69b8e6e38ff48791e24406ea",
"af56bb89b9b40c7c490e1979af790ac3e03930a6",
"30350bda781eecee69b8e6e38ff48791e24406ea",
"af56bb89b9b40c7c490e1979af790ac3e03930a6",
"2971fb77060ed53fe093abb4b86341a3e546d6e4",
"60dfcf54f11dd7e20cdb310e52a35326fe6ef7d3",
"2971fb77060ed53fe093abb4b86341a3e546d6e4",
"60dfcf54f11dd7e20cdb310e52a35326fe6ef7d3",
"493994b0557351bd58535a46e20a88bc5cfa82d7",
"5e12eee87f1a5cbcdbe525fe7da1d435d5c8e0ce",
"493994b0557351bd58535a46e20a88bc5cfa82d7",
"5e12eee87f1a5cbcdbe525fe7da1d435d5c8e0ce",
"df15b2e543d4126aa67e1a64fc136cc3259a10d8",
"5b86a86fb66f271f32f4f41f1e0c57bab793826f",
"df15b2e543d4126aa67e1a64fc136cc3259a10d8",
"5b86a86fb66f271f32f4f41f1e0c57bab793826f",
"695130ce7b634cf6b75491385fadde9137fc145c",
"06de267e53935bac592a801e33ff9c3a5b72f4dd",
"695130ce7b634cf6b75491385fadde9137fc145c",
"06de267e53935bac592a801e33ff9c3a5b72f4dd",
"6202d2e8af574cf41ed0eb15f3dd3800a7d19eb3",
"75b7ba658ac0df4136a8c99e45a89e8963ee6cb4",
"6202d2e8af574cf41ed0eb15f3dd3800a7d19eb3",
"75b7ba658ac0df4136a8c99e45a89e8963ee6cb4",
"b122a17f59fdacd477aa3d62ab970b0d9d409960",
"e04eb69ed8fd2913e4f8a975d67b3f153b94532f",
"b122a17f59fdacd477aa3d62ab970b0d9d409960",
"e04eb69ed8fd2913e4f8a975d67b3f153b94532f",
"6c5f10a16ddc155ca3fce274b15d8fade2dbccd5",
"6dabbbfde6355d2e1dda40daefd512f7a5920a32",
"6c5f10a16ddc155ca3fce274b15d8fade2dbccd5",
"6dabbbfde6355d2e1dda40daefd512f7a5920a32",
"0e678dc1c66e314f01cfa92a80cb39d3d6d9b2a9",
"32f503544584cec4d138f56ea2128c27444fd66a",
"0e678dc1c66e314f01cfa92a80cb39d3d6d9b2a9",
"32f503544584cec4d138f56ea2128c27444fd66a",
"577dd42cc92de8d3cad62fcee5f5abbe051169ae",
"fa27d6bb10cd51f5f7f4347b44f75e7979d70efa",
"577dd42cc92de8d3cad62fcee5f5abbe051169ae",
"fa27d6bb10cd51f5f7f4347b44f75e7979d70efa",
"a19af76c5260dc6638fab5a6bf57cf79779032e9",
"17daa702fe03dc6a77d196eb486eed000436063c",
"a19af76c5260dc6638fab5a6bf57cf79779032e9",
"17daa702fe03dc6a77d196eb486eed000436063c",
"4393bdedd3e0b040c23993c327205daccfdf7f2f",
"a9f1f5ccd6624f90808b89fa104a0f0d8a68ee5d",
"4393bdedd3e0b040c23993c327205daccfdf7f2f",
"a9f1f5ccd6624f90808b89fa104a0f0d8a68ee5d",
"3890d4f8612db194a0f102749445617893d49aea",
"6937c4f4be5cab1a694eccefee940c4ab76b0d3d",
"3890d4f8612db194a0f102749445617893d49aea",
"6937c4f4be5cab1a694eccefee940c4ab76b0d3d",
"85fab3f9ae03cf33afe60df7f687e48c467abf7e",
"fc7f0b1126959e0a3f71ea346ea0de3e0e9d8e00",
"85fab3f9ae03cf33afe60df7f687e48c467abf7e",
"fc7f0b1126959e0a3f71ea346ea0de3e0e9d8e00",
"0b9d7accc6d0425551edbbeb27603d7676a2a1a3",
"d844a250ff898c706a08a2e91dba227f52124da2",
"0b9d7accc6d0425551edbbeb27603d7676a2a1a3",
"d844a250ff898c706a08a2e91dba227f52124da2",
"4e67194b36ca9e4a4aa87c36624c623d0066e4ea",
"1041c8f88b5fdb2952405e1994a6c8d36f26eb20",
"4e67194b36ca9e4a4aa87c36624c623d0066e4ea",
"1041c8f88b5fdb2952405e1994a6c8d36f26eb20",
"1eb9ca36973b8d255140f5e7c7f81697aa5adfe1",
"540e7bb7a77d6e6bebf6100879670073f081b0e9",
"1eb9ca36973b8d255140f5e7c7f81697aa5adfe1",
"540e7bb7a77d6e6bebf6100879670073f081b0e9",
"e4cc1e6957e59a170aff4973b6ab7df274af4fed",
"29c02d1fdb368dc909ca74ef711ae5bc978f6194",
"e4cc1e6957e59a170aff4973b6ab7df274af4fed",
"29c02d1fdb368dc909ca74ef711ae5bc978f6194",
"eb46f3058d1baa93b341057d2d83766cce8d8e96",
"cce5322a4826f779488d54c61b7f8dfb41fb9f57",
"eb46f3058d1baa93b341057d2d83766cce8d8e96",
"cce5322a4826f779488d54c61b7f8dfb41fb9f57",
"2a0afb10b70599a72450be67459bca868760b0b2",
"cdc05654c21cbd68c79d81d9ae7bb26fc1c19e30",
"2a0afb10b70599a72450be67459bca868760b0b2",
"cdc05654c21cbd68c79d81d9ae7bb26fc1c19e30",
"f999b33519d88ea244192c42635c549033341eb0",
"48a139a63a8cba24b11fe45ac08976fad310c3cd",
"f999b33519d88ea244192c42635c549033341eb0",
"48a139a63a8cba24b11fe45ac08976fad310c3cd",
"80aac08385b576311649afc91a05a3647acbd6fc",
"230266e82466584ae822516ed152e9b2814181f6",
"80aac08385b576311649afc91a05a3647acbd6fc",
"230266e82466584ae822516ed152e9b2814181f6",
"92218e6de8ee11943895900bee49b2f5f1a0ba69",
"b1b015aebc22c86fac3815c12861ea46bf417459",
"92218e6de8ee11943895900bee49b2f5f1a0ba69",
"b1b015aebc22c86fac3815c12861ea46bf417459",
"3ccbf8182b2f76308f60c3e344fd3786b1ec8619",
"200b2bf002ca66ec36a9f4d2eaa70102a21cac93",
"3ccbf8182b2f76308f60c3e344fd3786b1ec8619",
"200b2bf002ca66ec36a9f4d2eaa70102a21cac93",
"903479536adefa864fe9f95e94808ae5a0a9375e",
"d3e253638e824b0d7d5da534ca4b08595f8a77a9",
"903479536adefa864fe9f95e94808ae5a0a9375e",
"d3e253638e824b0d7d5da534ca4b08595f8a77a9",
"a7e4f7074c79ea601a8ce01c424da36a29394246",
"c3cef2f746e7abaed2aae53432ed7ef4d6fc177b",
"a7e4f7074c79ea601a8ce01c424da36a29394246",
"c3cef2f746e7abaed2aae53432ed7ef4d6fc177b",
"d185a15cdca09f45e499b426f2b1a7ef27b93c65",
"53b0f9859750ef4120dc3c59dae94f166cf490e8",
"d185a15cdca09f45e499b426f2b1a7ef27b93c65",
"53b0f9859750ef4120dc3c59dae94f166cf490e8",
"2a38de9ece554e053f09adcc83101e7822716957",
"a270f0cd351390cddfd0a205427ecfc7477c6eac",
"2a38de9ece554e053f09adcc83101e7822716957",
"a270f0cd351390cddfd0a205427ecfc7477c6eac",
"6e1bd107a19eb7bad598a535b68ec99a4230f9c4",
"31fd15abc83f3d6977d7cead1064081b65264fea",
"6e1bd107a19eb7bad598a535b68ec99a4230f9c4",
"31fd15abc83f3d6977d7cead1064081b65264fea",
"b963b04d2821c7cd45ffd5e8700ce323ccbb1311",
"d0e2fc09187f2446609537149231b0d241c72b4c",
"b963b04d2821c7cd45ffd5e8700ce323ccbb1311",
"d0e2fc09187f2446609537149231b0d241c72b4c",
"9511ad84fb413f7b5b25b7b9982fb9f20d85a86c",
"f3f5049b0660b44f759fe6444081ee8f963862e8",
"9511ad84fb413f7b5b25b7b9982fb9f20d85a86c",
"f3f5049b0660b44f759fe6444081ee8f963862e8",
"659e6d8cd7876c1d841e1f2cd835187b4d90005e",
"0575f660be4d504970521af9d940c5e2673e6f55",
"659e6d8cd7876c1d841e1f2cd835187b4d90005e",
"0575f660be4d504970521af9d940c5e2673e6f55",
"5a0600e3f3022ca2a572c2f535202780667dc890",
"bca44267dc28b0b8ac5ecfc81d5da1f6a8974f3e",
"5a0600e3f3022ca2a572c2f535202780667dc890",
"bca44267dc28b0b8ac5ecfc81d5da1f6a8974f3e",
"22430fd8f04f9c8430b62745d49af3949a0c3969",
"fad587ceb801ed5bd1e3a820402e44ad55427a2b",
"22430fd8f04f9c8430b62745d49af3949a0c3969",
"fad587ceb801ed5bd1e3a820402e44ad55427a2b",
"0684a0ea1bc6da8aba0c69e2fa97657a24573598",
"41a2a433e9a9323258f3add05e84740e937677c5",
"0684a0ea1bc6da8aba0c69e2fa97657a24573598",
"41a2a433e9a9323258f3add05e84740e937677c5",
"10094035a607ee3df6d875f41cce079926409b00",
"de0701164f33842031ba14134035f05990534c0f",
"10094035a607ee3df6d875f41cce079926409b00",
"de0701164f33842031ba14134035f05990534c0f",
"e65674c658dc0060f951315961720809e4ffb7b3",
"c86841eaae03f0090db9ffacd11d0db574aebf43",
"e65674c658dc0060f951315961720809e4ffb7b3",
"c86841eaae03f0090db9ffacd11d0db574aebf43",
"122bb9c7c72d134f537beba9425b29d6dab69016",
"b402d5f3d163ab932000fce7dbfe2c16d64561e5",
"122bb9c7c72d134f537beba9425b29d6dab69016",
"b402d5f3d163ab932000fce7dbfe2c16d64561e5",
"e1ac0c9d4c69807bc5fea5900c75b1c7a8f8e0a4",
"dd7af4dfd19a62982a0d5de8b35e331a481a6aad",
"e1ac0c9d4c69807bc5fea5900c75b1c7a8f8e0a4",
"dd7af4dfd19a62982a0d5de8b35e331a481a6aad",
"b18fa9e6594faef3247f5624d1bed351d5f65002",
"35c414a9563608296babbe83d751eefafbba2696",
"b18fa9e6594faef3247f5624d1bed351d5f65002",
"35c414a9563608296babbe83d751eefafbba2696",
"45da041fd04e173caa32b6d8006be79d6e12abbc",
"fc09069b25f42cb8dc6960eea76980a0ea8a768c",
"45da041fd04e173caa32b6d8006be79d6e12abbc",
"fc09069b25f42cb8dc6960eea76980a0ea8a768c",
"026e32404ac362a69e30f16d8e296f0019c328d5",
"0aba89d49b3a32e6be4874b954390a9a50b97d85",
"026e32404ac362a69e30f16d8e296f0019c328d5",
"0aba89d49b3a32e6be4874b954390a9a50b97d85",
"8f2f3c5af309911e0a58f01b03bfe204fcdb222a",
"2dd2b0caf193a21bd5588985a8c5e8a3a40c4790",
"8f2f3c5af309911e0a58f01b03bfe204fcdb222a",
"2dd2b0caf193a21bd5588985a8c5e8a3a40c4790",
"7f6fc39e9270a2119ce4f5dee21c1545551fb9e4",
"52d05230724cc874df7c4b4a0bbfd39d4b6085c7",
"7f6fc39e9270a2119ce4f5dee21c1545551fb9e4",
"52d05230724cc874df7c4b4a0bbfd39d4b6085c7",
"cc153155125660d02bb9fc542bb496668dc6e058",
"f54bf6a4c6f7c3d0077d152a094e3c7738cf0bd1",
"cc153155125660d02bb9fc542bb496668dc6e058",
"f54bf6a4c6f7c3d0077d152a094e3c7738cf0bd1",
"db62ba86c86fbfc024df2908ecab10eebab3893d",
"fcfcf1e45e8d5cdca0450b8dc90754b68e8e4673",
"db62ba86c86fbfc024df2908ecab10eebab3893d",
"fcfcf1e45e8d5cdca0450b8dc90754b68e8e4673",
"e57311dc19d624ec0db73b5f4f312f4afe699ffa",
"f88a948b0fd137d4b14cf5aec0c08066cb07e08d",
"e57311dc19d624ec0db73b5f4f312f4afe699ffa",
"f88a948b0fd137d4b14cf5aec0c08066cb07e08d",
"53239726e6b5c599f56d7890368e33cc99191ddb",
"c8c1a9b3ce4d3840538e7918603e9a0d99002545",
"53239726e6b5c599f56d7890368e33cc99191ddb",
"c8c1a9b3ce4d3840538e7918603e9a0d99002545",
"e90f4d7e69609567994f20d43c45e4dc74d57070",
"69599cb14da68fb05ba508d22a751233967bebda",
"e90f4d7e69609567994f20d43c45e4dc74d57070",
"69599cb14da68fb05ba508d22a751233967bebda",
"913f2649046c764d54f6f9c86336ff555e571e35",
"6afa1451bdabb3905168af6ee30a4cbb54caf5b1",
"913f2649046c764d54f6f9c86336ff555e571e35",
"6afa1451bdabb3905168af6ee30a4cbb54caf5b1",
"fd044badaf8a08c40af7b6f633cc270084cb0ca0",
"08466db9a488f46261453511a3da6462032ddaaf",
"fd044badaf8a08c40af7b6f633cc270084cb0ca0",
"08466db9a488f46261453511a3da6462032ddaaf",
"c90aaae48ec6775d2dd40fb7c84c2c47332942b9",
"c2a8776e21403eb00b38bfccd36d1c03dffb009e",
"c90aaae48ec6775d2dd40fb7c84c2c47332942b9",
"c2a8776e21403eb00b38bfccd36d1c03dffb009e",
"a1d985e13c07eddfa2721b14f7c9f869b0d733c9",
"c00cfb456fc6af0376fbea877b742594c443df97",
"a1d985e13c07eddfa2721b14f7c9f869b0d733c9",
"c00cfb456fc6af0376fbea877b742594c443df97"
]);
let rname = "rclone";
DeviceProcessEvents  
| where Timestamp >= ago(1d)
| where SHA1 in (rcloneexeonlyhashes) or FileName contains rname or ProcessVersionInfoCompanyName contains rname

Just filter the CSV using powershell/awk/Excel...
Hope this helps
rclone_hashes_sha1.csv

Credential Access: Brute force

Identify brute force or password spray through logon events

CreateUser as part of RDP session

Query for users being created locally right after a remote interactive logon occurs.
This combination of lateral movement and persistence was seen before on several occurences.

Abnormal logon

Add queries that find abnormal logons - e.g.:

first logon by user on a machine
first logon by user from a machine
logon peak (using avg() and stdev())
using ML time-series outliers (using series_outliers() )
logon from an external machine - one that is not onboarded to this WDATP tenant

Can't pull from branch because of file name

Hi.

When I try to pull the latest changes from the main branch, I keep getting an error:

invalid path 'Exfiltration/Data copied to other location than C:.txt'

Looks like Git is confused by this file name. Is there a work-around?

\Windows\assembly\NativeImages_v4.0.30319_64

Hi - any concerns about ignoring these events in Advanced Hunting or ignoring the folder \Windows\assembly\NativeImages_v4.0.30319_64 in ATP/Intune? i'm getting a lot of hits (ExploitGuardNonMicrosoftSignedBlocked) for what appear to be Defender/Microsoft workflows. Thanks for any advice (Kusto example below).

MiscEvents
| where ActionType startswith "ExploitGuard"
| where FolderPath !contains "NativeImages_v4.0.30319_64"
| summarize AllEvents = count() by ActionType, FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, SHA1
| summarize by AllEvents, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, SHA1
| sort by AllEvents, ActionType

User ID's Monitoring

Hello Team,

In our workstations , we have set of applications access from the browser. We want to monitor if any one logged in the respective applications with one particular user ID. Is there any way to monitor and get an alerts by using custom scripts and any other way? Any solution will be really appreciable.

Does not work for Server 2016 or 2019

When I run the query, it only returns WIN 10 machines and none of the Server 2016/2019 in my environment. Is this an issue or not supported or when will it be supported? Thanks.

let avmodetable = DeviceTvmSecureConfigurationAssessment
| where ConfigurationId == "scid-2010" and isnotnull(Context)
| extend avdata=parsejson(Context)
| extend AVMode = iif(tostring(avdata[0][0]) == '0', 'Active' , iif(tostring(avdata[0][0]) == '1', 'Passive' ,iif(tostring(avdata[0][0]) == '4', 'EDR Blocked' ,'Unknown')))
| project DeviceId, AVMode;
DeviceTvmSecureConfigurationAssessment
| where ConfigurationId == "scid-2011" and isnotnull(Context)
| extend avdata=parsejson(Context)
| extend AVSigVersion = tostring(avdata[0][0])
| extend AVEngineVersion = tostring(avdata[0][1])
| extend AVSigLastUpdateTime = tostring(avdata[0][2])
| project DeviceId, DeviceName, AVSigVersion, OSPlatform, AVEngineVersion, AVSigLastUpdateTime, IsCompliant, IsApplicable
| join avmodetable on DeviceId
| project-away DeviceId1

Query improvements - Exfiltration to Competitor

Hi,

I believe the query "Detect Exfiltration to Competitor Organization" could be improved. Instead of filtering on the string "competitor", cant we just put the domain of the competitors:

EmailEvents
| where RecipientEmailAddress contains "competitor.com" // domain of the competitor.

Persistence: Create new service

Data Exfiltration to email account

Hello Team,

Is it possible to detect if anyone Exfiltration the Data from the Device/one Drive/corporate email id to there personal email ID's using custom detection rules?

Qakbot campaign process injection query is not correct

I would like to bring to your attention that the Process injection by Qakbot malware is misleading since the query is actually for the cookie and browsing history theft of the same malware family.
I checked with the report "Qakbot blight lingers, seeds ransomware" and did a pull request #429 for the correction needed.

The query
DeviceProcessEvents | where FileName == "esentutl.exe" | where ProcessCommandLine has "WebCache" | where ProcessCommandLine has_any ("V01", "/s", "/d") | project ProcessCommandLine, InitiatingProcessParentFileName, DeviceId, Timestamp

is corresponding to cookie and browsing history theft and should have it's separate file.

WMI queries

Add queries on top of WMIC executions and on remote WMI queries

Persistence: startup folder

A machines First Seen timestamp via Advanced Hunting Query

Looking to actively track newly on-boarded Defender ATP assets at scale.

[Use Case:]

-Multiple assets identified which have Defender ATP connection issues
-Raise with IT Team who need to on-board assets accordingly so that SOC Team has the necessary visibility into asset, and so that the asset is adequately protected.
-Using this query would allow us to track IT Team's Defender ATP on-boarding progress.

Microsoft-365-Defender-Hunting-Queries/M365-PowerBi Dashboard/: Table 'Software' contains a duplicate value

Log from Power BI Desktop x64, Version: 2.99.782.0 64-bit (November 2021):

AadUsers
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
Alerts
Load was cancelled by an error in loading a previous table.
ConfigurationScore
Load was cancelled by an error in loading a previous table.
ExposureScore
Load was cancelled by an error in loading a previous table.
ExposureScoreByMachineGroups
Load was cancelled by an error in loading a previous table.
Indicators
Load was cancelled by an error in loading a previous table.
Investigations
Load was cancelled by an error in loading a previous table.
MachineActions
Load was cancelled by an error in loading a previous table.
Machines
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
Recommendations
Load was cancelled by an error in loading a previous table.
Software
Column 'name' in Table 'Software' contains a duplicate value 'chromium' and this is not allowed for columns on the one side of a many-to-one relationship or for columns that are used as the primary key of a table.
SoftwareInventoryByMachine
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
SoftwareVulnerabilitiesByMachine
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
Vulnerabilities
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
EndpointAgentHealthStatus
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
ConnectivityFailure
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
MicrosoftEOSStatus
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.
SecureConfigurationsAssessmentByMachine
OLE DB or ODBC error: Exception from HRESULT: 0x80040E4E.

Using M365-PowerBi Dashboard/Microsoft Threat Protection - API Dashboard.pbit, 76b3d2c
Please advise.

Persistence: scheduled task

M365 Defender API Dashboard error

Indicators:
OLE DB or ODBC error: [DataSource.Error] OData: Incompatible type kinds were found. Found type kind 'Primitive' instead of the expected kind 'None'..

https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/M365-PowerBi%20Dashboard

If I then go to the advanced editor and ignore the indicators column - the report will load fine. Not sure exactly how to fix correctly

PSEXEC queries

Add queries on PSEXEC commandline, or on the PSEXECSVC installed and executed on the target.

Query for Country code

Hi i try to write a query to see any communication from specific country.
Example
I would like to see if there is any network activity from russia by example or any country

Lateral movement: identify source machines not onboarded to WDATP

TVM Reports

Advance hunting quey to get a Report on Missing KB From All devices.

Protection | Windows Filtering Events

@TomerAlpert @makislev
Has there been a change in event forwarding? This query is no longer returning any ActionTypes - re: Firewall.
https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Protection%20events/Windows%20filtering%20events%20(Firewall).txt
// Get all filtering events done by the Windows filtering platform.
// This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
// When no Firewall rules are configured, the default behavior is to block all incoming network connections.
DeviceEvents
| where ActionType in ("FirewallOutboundConnectionBlocked", "FirewallInboundConnectionBlocked", "FirewallInboundConnectionToAppBlocked")
| project DeviceId , Timestamp , InitiatingProcessFileName , InitiatingProcessParentFileName, RemoteIP, RemotePort, LocalIP, LocalPort
| summarize MachineCount=dcount(DeviceId) by RemoteIP
| top 100 by MachineCount desc

Thanks,

Rich

new query

Hi all,

Could you please provide a query that looks if a certain software is installed on a machine and print the result of machines that don't have the software

Thanks

Semantic error in Delivery/Pivot from detections to related downloads.txt

When I entered this into Advanced Hunting I got this error message:

'project' operator: Failed to resolve scalar expression named 'SHA1'

Unable to query events from prior than 7 days

Hi,

When running a query the console only enabled the viewing of the past 7 days even if its been specified differently within the query itself. I am trying to create a query that shows how many incidents are being created on a monthly basis to confirm if securing our systems is improving or not.

Thank you

365 Hunting Query data refresh

Adding Powerbi Report to powerbi webapp causes data refresh to break due to "dynamic data sources" no documentation online.

Persistence drive detection

Can we detect any workstation having persistence drive using any query in defender?

USB file writes

This query executes fine, but I want to turn it into a custom detection and I’m have trouble adding Timestamp and DeviceId. Assistance appreciated.

MiscEvents
| where EventTime > ago(1d)
| where ActionType == "UsbDriveMount"
| project USBMountTime = EventTime, MachineId, AdditionalFields
| extend DriveLetter = tostring(todynamic(AdditionalFields).DriveLetter)
| join (
FileCreationEvents
| where EventTime > ago(1d)
| where ActionType == "FileCreated"
| where FileName endswith ".docx" or FileName endswith ".pptx"
| parse FolderPath with DriveLetter '\' *
| extend DriveLetter = tostring(DriveLetter)
)
on MachineId, DriveLetter
| where (EventTime - USBMountTime) between (0min .. 15min)
| summarize DistinctFilesCopied = dcount(SHA1), Events=makeset(pack("AccountName", InitiatingProcessAccountName, "EventTime", EventTime, "ReportId", ReportId, "FileName", FileName, "AdditionalDriveProperties", AdditionalFields)) by MachineId, bin(EventTime, 15m)
| where DistinctFilesCopied > 10
| mv-expand Events
| extend EventTime = Events.EventTime, FileName = Events.FileName, AccountName = Events.AccountName, ReportId = Events.ReportId, AdditionalDriveProperties = Events.AdditionalDriveProperties

Missing USB file write events

I have been using the below query (with some lens commented out) to try and capture files being written to USB.

However knowing that some people wrote to USB they didn't show up with this query. I can prvide this with a simple query loking for filecreation on a folderpath containing "D:" (i know the USB drive was a D drive) and I get the expected results.

I did some searching and it seems the action type "UsbDriveMount" is the problem. I find that it doesn't pick up everything and sometimes I have to use ActionType == "PnpDeviceConnected". Problem is PnpDeviceConnected picks up a whole lot of pnp devices. How can I ensure that this query is getting all USB storage devices. Right now i am not confident it is.

// THIS IS THE FIRST QUERY
DeviceEvents
| where Timestamp > ago(90d)
| where ActionType == "UsbDriveMount"
| project USBMountTime = Timestamp, DeviceId, AdditionalFields
| extend DriveLetter = tostring(todynamic(AdditionalFields).DriveLetter)
| join (
DeviceFileEvents
| where Timestamp > ago(90d)
| where ActionType == "FileCreated"
// | where FileName endswith ".docx" or FileName endswith ".pptx"
| parse FolderPath with DriveLetter '\' *
| extend DriveLetter = tostring(DriveLetter)
)
on DeviceId, DriveLetter
// | where (Timestamp - USBMountTime) between (0min .. 15min)
| summarize DistinctFilesCopied = dcount(SHA1), Events=makeset(pack("AccountName", InitiatingProcessAccountName, "Timestamp", Timestamp, "ReportId", ReportId, "FileName", FileName, "AdditionalDriveProperties", AdditionalFields)) by DeviceId, bin(Timestamp, 15m)
// | where DistinctFilesCopied > 10
| mv-expand Events
| extend Timestamp = todatetime(Events.Timestamp), FileName = Events.FileName, AccountName = Events.AccountName, ReportId = tolong(Events.ReportId), AdditionalDriveProperties = Events.AdditionalDriveProperties

Add Health State and Date last seen

Can you add Health state and Date last seen to the query? I added onto your query but it doesnt work and it also only queries 1 machine and not all the machines with this CVE.

DeviceTvmSoftwareVulnerabilities
| where CveId contains "CVE-2021-26897"
| join kind =inner(DeviceInfo) on DeviceId
| join kind =inner(DeviceNetworkInfo) on DeviceId
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, PublicIP, DnsAddresses, IPv4Dhcp, IPAddresses, CveId, MachineGroup, VulnerabilitySeverityLevel
| limit 100

microsoft / microsoft-365-defender-hunting-queries Goto Github PK