Threat hunting queries written by the Lupovis Intelligence team and published in the Lupovis Weekly Threat Brief. Each query is a standalone file with a header that states what it looks for, which tables it needs, and the MITRE ATT&CK techniques it covers. Copy the file into your SIEM and adjust the tuning notes at the top.
New queries are added here as each brief goes out. Watch the repository to be notified.
| Query | Platform | Data sources | ATT&CK | Brief |
|---|---|---|---|---|
| MikroTik RouterOS SSH Exploit Attempts by IoC Username | Microsoft Sentinel | Syslog | T1190, T1078, T1068 | 2026-09-11 |
| Inbox Rule and New Multifactor Authentication Method | Microsoft Sentinel | OfficeActivity, AuditLogs | T1564.008, T1556.006, T1098 | 2026-09-18 |
| Inbox Rule from a Previously Unseen ASN | Microsoft Sentinel | OfficeActivity, SigninLogs | T1564.008, T1078.004 | 2026-09-18 |
Several MikroTik RouterOS CVEs were reported as actively exploited in the wild. CVE-2026-67276 causes only part of an RSA key to be checked during SSH authentication: the key type and modulus are validated but the exponent is not, so an attacker can use an exponent of 1. CVE-2026-86060 is a privilege escalation in the same authentication path, where usernames starting with prohibited characters can yield a session with full admin privileges. The username "-2" (the stderr file descriptor, read by RouterOS as a policy mask) and the username "ops" have been reported as IoCs. The MikroTik query above hunts Syslog in Sentinel for SSH activity using either username.
A mailbox belonging to an employee is a high-value target. A long email history can contain information about the business, company dynamics, and credentials for other services. A compromised account can also send further phishing emails or lend a convincing cover to business email compromise (BEC), where an attacker impersonates a trusted figure or organisation for access to sensitive data or financial gain.
Attackers use inbox rules to hide their activity from the genuine mailbox owner, often moving specific subsets of email into folders that are rarely checked. Searching for an account that sets inbox rules combined with other behaviours that suggest compromise identifies malicious activity even when the attacker uses a non-standard folder or rule name. The two queries above pair inbox rule changes with a new MFA registration and with a sign-in from an ASN that is new for that account.
queries/
<platform>/ one folder per query language or SIEM
<name>.kql one query per file, header comment first, query second
Platform folders in use: microsoft-sentinel (KQL). Add a new folder for other platforms
such as Splunk SPL, Elastic, or Sigma when the first query for that platform lands.
Lupovis runs a global network of decoys and provides a threat intelligence feed with full IoCs, attacker infrastructure visibility, and CVE exploitation telemetry. Learn more at lupovis.io or contact us.