A curated collection of production-ready KQL hunting and detection queries for Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel, aimed at SOC teams hunting threats in their own tenants.
| Tool | benscha/KQLAdvancedHunting — production-ready KQL detection and hunting queries for Microsoft Defender XDR, Sentinel, and Purview |
| Category | Defensive detection content / SIEM query library |
| Primary Use | Threat hunting, UEBA baselining, and detection rule deployment via KQL across Device*, SigninLogs, CloudAppEvents, and EmailEvents tables |
| Safe Use | Purely defensive: run queries in your own authorized Defender XDR tenant or Sentinel workspace during incident response, proactive hunting, and SOC operations |
| Telemetry Note | Read-only analytics: queries consume existing telemetry in your workspace and leave no footprint on endpoints; query execution is fully logged in Sentinel/Defender audit trails |
KQLAdvancedHunting is a curated repository of production-ready KQL (Kusto Query Language) queries maintained by Benjamin Zulliger, a Microsoft MVP in Security (SIEM & XDR). The collection targets three Microsoft surfaces: Microsoft Defender XDR Advanced Hunting, Microsoft Sentinel as SIEM, and Microsoft Purview. This is a purely defensive asset — there is no exploitation tooling here, only detection logic for analysts, SOC teams, and incident responders working within tenants they are authorized to operate in. The repo has accumulated 183 stars and is written primarily in PowerShell for deployment automation, with the queries themselves being KQL files.
The README organizes coverage into five functional pillars, each mapped to the specific Advanced Hunting and Sentinel tables it queries. The first pillar is behavior analytics and baseline hunting, built on SigninLogs, AADSignInLogs, BehaviorAnalytics, and IdentityLogonEvents. The stated ambition here goes beyond static filtering: the queries implement multi-vector anomaly detection, looking for uncommon combinations of IP address, User-Agent, and operating system to surface first-time or rare account activity. That is effectively hand-rolled UEBA — historically baselined sign-in behavior expressed directly in KQL, which is valuable for teams that lack a mature UEBA product or want to tune the logic themselves.
The second pillar covers endpoint security and vulnerability context through DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents, DeviceRegistryEvents, and DeviceInfo. The README calls out hunting for process anomalies, Living-off-the-Land (LotL) techniques, unauthorized debugger registration via IFEO (Image File Execution Options registry tampering), Windows shell security feature bypasses, and even VS Code extension hunting — a nice touch given how often legitimate developer tooling is abused as a persistence or execution vehicle. These map cleanly onto well-documented attacker tradecraft, making the queries useful starting points for detection engineering against techniques catalogued in frameworks like MITRE ATT&CK.
Identity and access management is the third pillar, drawing from IdentityLogonEvents, AADSignInEvents-adjacent logs, SigninLogs, and IdentityInfo. Coverage includes brute force detection, MFA bypass patterns, adversary-in-the-middle (AiTM) phishing correlation via link clicks, privilege escalation, and cross-tenant identity validation. The AiTM angle is particularly relevant given the shift toward token theft and session hijacking in modern phishing kits; correlating a phishing link click with subsequent authentication events in the same KQL statement is exactly the kind of cross-table join that makes Advanced Hunting worth the licensing cost.
The fourth pillar extends into cloud, governance, and DevOps telemetry: CloudAppEvents, OfficeActivity, AuditLogs, and AzureDevOpsAuditing. Detection scope includes data exfiltration, shadow IT discovery, malicious app registrations, service principal abuse for high-privilege takeover, and critical configuration changes in Azure DevOps CI/CD pipelines. The DevOps inclusion is a differentiator — many community KQL collections stop at M365 and endpoint tables, while this one acknowledges that pipeline tampering and OAuth app abuse are now primary intrusion vectors. The fifth pillar handles email and collaboration via EmailEvents, EmailUrlInfo, EmailAttachmentInfo, and CloudAppEvents for Teams, covering advanced phishing, Business Email Compromise (BEC), and malicious URL or domain hits inside Teams messages.
From a workflow standpoint, the README positions every query as incident-response ready: optimized for fast execution and directly deployable either in the Microsoft Defender XDR portal or in a Sentinel Log Analytics workspace. The author emphasizes clean, modular code structures with adjustable timeframes, thresholds, and variables so SOC teams can align detections with their institutional baselines rather than running them verbatim. That tunability matters — a threshold for rare sign-in combinations in a 50-user tenant and a 50,000-user tenant should not be the same number, and the repo's design acknowledges this.
Getting started is straightforward: clone the repository with git clone https://github.com/benscha/KQLAdvancedHunting and browse the query files for the tables you already license. Because KQL is interpreted inside the Microsoft portals, there is no build step; you paste a query into the Advanced Hunting editor in Defender XDR or into a Sentinel Log Analytics query blade and execute it. For anything you want to promote from hunting to detection, the natural next step is wrapping the query in a Sentinel Analytics Rule or a Defender XDR custom detection, setting your own schedule and threshold values.
A notable credibility signal is that queries from the repository are indexed on community platforms kqlsearch.com and detections.ai, which function as public aggregators for detection content. Community indexing provides at least mild external review and makes it easier to discover individual queries without cloning the whole repo. The maintainer also publishes KQL tips on LinkedIn, suggesting the collection is actively maintained rather than a one-time dump — important in detection engineering, where table schemas and Microsoft product names shift frequently.
For defenders adopting this content, a few operational cautions apply. Treat every community query as a starting hypothesis, not a finished detection: validate the table references against your tenant's licensing (some Identity* and BehaviorAnalytics tables require specific SKUs), and run hunting queries read-only before promoting them to scheduled analytics rules. Expect false-positive tuning work, especially on the UEBA-style baselining queries where rare-but-legitimate behavior (new hires, travel, infrastructure changes) will trip initially. The repo explicitly claims false-positive minimization, but that always needs validation against your own environment.
In sum, KQLAdvancedHunting is a solid addition to the blue-team toolbox: it converts modern attacker tradecraft — AiTM phishing, LotL, IFEO tampering, service principal abuse, DevOps config changes — into concrete, tunable KQL across the full Microsoft security stack. For security teams operating their own Defender XDR and Sentinel estates, it compresses the detection engineering backlog considerably, and its modular, variable-driven structure makes the content genuinely reusable rather than copy-paste theater.
benscha/KQLAdvancedHunting.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.