hybridbrothers/hunting-queries-detection-rulesThe purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious behavior
The purpose of this repository is to share KQL queries that can be used by anyone and are understandable. These queries are intended to increase detection coverage through the logs of Microsoft Security products. Not all suspicious activities generate an alert by default, but many of those activities can be made detectable through the logs. These queries include Detection Rules, Hunting Queries, Security misconfigurations and Visualisations. Anyone is free to use the queries.
Presenting this material as your own is illegal and forbidden. A reference to Twitter @RobbeVdDaele or Github RobbeVandenDaele is much appriciated when sharing or using the content.
@BertJanCyber - The content structure of this repository was adopted from Bert-Jan's KQL repository
