Detections.AI/KQL at main · SlimKQL/Detections.AI

Repository navigation

ReadMe.txt

This is folder is sync from Detections.ai SlimKQL 2026 group

Name		Name	Last commit message	Last commit date
parent directory ..
CVE-2026-26119-Privilege-Escalation-in-Windows-Admin-Center.kql		CVE-2026-26119-Privilege-Escalation-in-Windows-Admin-Center.kql
ReadMe.txt		ReadMe.txt
a-360-surveillance-kql-for-monitoring-potential-risks-from-entra-and-mde-endpoint-activities-amid-the-usisraeliran-escalation.kql		a-360-surveillance-kql-for-monitoring-potential-risks-from-entra-and-mde-endpoint-activities-amid-the-usisraeliran-escalation.kql
admin-consent-for-m365-connector-for-claude.kql		admin-consent-for-m365-connector-for-claude.kql
agent-365--detecting-autonomous-agents-awaiting-commands.kql		agent-365--detecting-autonomous-agents-awaiting-commands.kql
agent-365--local-ai-agent-installation-detection.kql		agent-365--local-ai-agent-installation-detection.kql
agent365-autojack-detection.kql		agent365-autojack-detection.kql
ai-agent-high-severity-exposure-check.kql		ai-agent-high-severity-exposure-check.kql
ai-mcp-agent-visibility--risk-assessment.kql		ai-mcp-agent-visibility--risk-assessment.kql
analysis-of-kali365-by-asn-over-past-30-days.kql		analysis-of-kali365-by-asn-over-past-30-days.kql
analyzing-ai-mcp-saas-usage-in-your-mde-environment.kql		analyzing-ai-mcp-saas-usage-in-your-mde-environment.kql
arpa-under-siege-cybercriminals-weaponize-the-dns-infrastructure.kql		arpa-under-siege-cybercriminals-weaponize-the-dns-infrastructure.kql
axios-compromise-detection-via-3rd-party.kql		axios-compromise-detection-via-3rd-party.kql
bitwarden-cli-compromised-detection.kql		bitwarden-cli-compromised-detection.kql
btr-reforged-detection.kql		btr-reforged-detection.kql
catch-them-if-you-can.kql		catch-them-if-you-can.kql
citrix-netscaler-check.kql		citrix-netscaler-check.kql
claudefix-shared-claude-chats-meet-clickfix.kql		claudefix-shared-claude-chats-meet-clickfix.kql
clickfix-nslookup-abuse-detection-enhanced.kql		clickfix-nslookup-abuse-detection-enhanced.kql
clickfix-nslookup-abuse-detection.kql		clickfix-nslookup-abuse-detection.kql
cloudflare-eviltokens-gotta-catchem-all.kql		cloudflare-eviltokens-gotta-catchem-all.kql
crosstenant-helpdesk-impersonation-to-data-exfiltration.kql		crosstenant-helpdesk-impersonation-to-data-exfiltration.kql
cve-2026-26117-hijacking-azure-arc-on-windows-for-local-privilege-escalation--cloud-identity-takeover.kql		cve-2026-26117-hijacking-azure-arc-on-windows-for-local-privilege-escalation--cloud-identity-takeover.kql
cve-2026-26128-kerberos-reflection-bypass-detection.kql		cve-2026-26128-kerberos-reflection-bypass-detection.kql
cve-2026-31431-copyfail.kql		cve-2026-31431-copyfail.kql
cve-2026-33829-snipping-tool-ntlm-leak.kql		cve-2026-33829-snipping-tool-ntlm-leak.kql
cve-2026-48095-surface-attack-area.kql		cve-2026-48095-surface-attack-area.kql
cve-2026-62911-check.kql		cve-2026-62911-check.kql
cve202614191--winrar-rce-detection.kql		cve202614191--winrar-rce-detection.kql
cve202641089-cvss-98-detection.kql		cve202641089-cvss-98-detection.kql
debull-detection.kql		debull-detection.kql
defenderxdr-bluehammer-detection.kql		defenderxdr-bluehammer-detection.kql
defenderxdr-cloudflare-win--r-clickfix-detection.kql		defenderxdr-cloudflare-win--r-clickfix-detection.kql
defending-against-kerberloss-cve-2026-25177.kql		defending-against-kerberloss-cve-2026-25177.kql
detect-77-evil-twin-open-vsx-extensions.kql		detect-77-evil-twin-open-vsx-extensions.kql
detect-brave-alias-abuse-for-phishing.kql		detect-brave-alias-abuse-for-phishing.kql
detect-certighost-cve-2026-54121.kql		detect-certighost-cve-2026-54121.kql
detect-compromised-npm-packages-keyv-and-cacheable-via-socket-ioc.kql		detect-compromised-npm-packages-keyv-and-cacheable-via-socket-ioc.kql
detect-dirk-jan-mollemas-borrowing-windows-hello-keys-for-authentication-and-persistence.kql		detect-dirk-jan-mollemas-borrowing-windows-hello-keys-for-authentication-and-persistence.kql
detect-o365-activities-from-openai-ip-addresses.kql		detect-o365-activities-from-openai-ip-addresses.kql
detect-phishing-callback-from-azure-monitor-alerts.kql		detect-phishing-callback-from-azure-monitor-alerts.kql
detect-solidity-pro-vs-code-extensions-steal-crypto-wallets-api-keys-and-credentials.kql		detect-solidity-pro-vs-code-extensions-steal-crypto-wallets-api-keys-and-credentials.kql
detect-teams-based-helpdesk-impersonation-attack-mail-bomb-follow-by-social-engineering-attack.kql		detect-teams-based-helpdesk-impersonation-attack-mail-bomb-follow-by-social-engineering-attack.kql
detect-whatsapp-vbscript-campaign.kql		detect-whatsapp-vbscript-campaign.kql
detecting-lpe-associated-with-either-dirtyfrag-or-copyfail.kql		detecting-lpe-associated-with-either-dirtyfrag-or-copyfail.kql
detecting-ntlm-leakage-in-windows-search.kql		detecting-ntlm-leakage-in-windows-search.kql
detecting-svg-payload-phishing-campaign.kql		detecting-svg-payload-phishing-campaign.kql
detecting-teams-impersonation-via-rmm-exfiltration.kql		detecting-teams-impersonation-via-rmm-exfiltration.kql
detection-rules-for-mois-campaign.kql		detection-rules-for-mois-campaign.kql
docmagic-impersonation-campaign-redirects-users-to-tycoon2fa-phishing-pages.kql		docmagic-impersonation-campaign-redirects-users-to-tycoon2fa-phishing-pages.kql
edrchoker-detection.kql		edrchoker-detection.kql
email-bombing-and-teams-impersonation-detection.kql		email-bombing-and-teams-impersonation-detection.kql
entra-mfa-report---sms-and-voice-authentication.kql		entra-mfa-report---sms-and-voice-authentication.kql
exo-retirement-of-legacy-tls-versions-for-pop-and-imap-connections.kql		exo-retirement-of-legacy-tls-versions-for-pop-and-imap-connections.kql
exposure-management-ai-agents-inventory.kql		exposure-management-ai-agents-inventory.kql
external-copilot-prompt-attack-detection-.kql		external-copilot-prompt-attack-detection-.kql
forg365-phaas-detection-using-silent-push.kql		forg365-phaas-detection-using-silent-push.kql
greatkql-detection-for-greatxml.kql		greatkql-detection-for-greatxml.kql
helpdesk-theme-impersonation-attack-detection.kql		helpdesk-theme-impersonation-attack-detection.kql
high-fidelity-artoken-detection.kql		high-fidelity-artoken-detection.kql
high-fidelity-device-code-phishing-abuse-detection.kql		high-fidelity-device-code-phishing-abuse-detection.kql
high-fidelity-forg365-phaas-detection.kql		high-fidelity-forg365-phaas-detection.kql
high-precision-teams-impersonation-detection.kql		high-precision-teams-impersonation-detection.kql
hunting-adversaries-abusing-google-goto-urls.kql		hunting-adversaries-abusing-google-goto-urls.kql
hunting-anthropic-ai-model-hacking.kql		hunting-anthropic-ai-model-hacking.kql
hunting-nanoclaw.kql		hunting-nanoclaw.kql
hunting-novacookies-campaign.kql		hunting-novacookies-campaign.kql
hunting-nullclaw.kql		hunting-nullclaw.kql
hunting-paypal-dkim-replay-attacks.kql		hunting-paypal-dkim-replay-attacks.kql
hunting-redsun.kql		hunting-redsun.kql
indirect-prompt-injection-risk-assessment.kql		indirect-prompt-injection-risk-assessment.kql
kongtukes-unmasked--defenderxdr-detection-of-evolved-modelorat.kql		kongtukes-unmasked--defenderxdr-detection-of-evolved-modelorat.kql
kql-detection-for-mdi-password-protection-insight.kql		kql-detection-for-mdi-password-protection-insight.kql
legacyhive-duo-detection.kql		legacyhive-duo-detection.kql
m365-connector-for-claude-detection.kql		m365-connector-for-claude-detection.kql
m365-connector-for-claude-whos-accessing-your-workloads.kql		m365-connector-for-claude-whos-accessing-your-workloads.kql
malicious-teams-call-attempts-check.kql		malicious-teams-call-attempts-check.kql
mde-platform-analyzing-ai-model-provider-usage.kql		mde-platform-analyzing-ai-model-provider-usage.kql
mdvm-zero-day-impact-analysis.kql		mdvm-zero-day-impact-analysis.kql
microsoft-sentinel-detection-for-adwsdomaindump.kql		microsoft-sentinel-detection-for-adwsdomaindump.kql
mikrotik-routers-under-attack---cert-polska.kql		mikrotik-routers-under-attack---cert-polska.kql
miniplasma-detection.kql		miniplasma-detection.kql
modelorat-detection-crashfix-campaign.kql		modelorat-detection-crashfix-campaign.kql
monitoring-claude-cowork-on-microsoft-365.kql		monitoring-claude-cowork-on-microsoft-365.kql
monitoring-exploitation-of-windows-shell-cve-2026-32202.kql		monitoring-exploitation-of-windows-shell-cve-2026-32202.kql
oauth-ms-phish-targeting-docusign-users.kql		oauth-ms-phish-targeting-docusign-users.kql
oauth-redirection-abuse-detection.kql		oauth-redirection-abuse-detection.kql
oauthmsphish-detection.kql		oauthmsphish-detection.kql
one-click-defenderxdr-axios-supply-chain-compromise-scan.kql		one-click-defenderxdr-axios-supply-chain-compromise-scan.kql
one-click-exposure-check-for-litellm-ai-supply-chain-attack.kql		one-click-exposure-check-for-litellm-ai-supply-chain-attack.kql
openclaw-installation-detection-on-mde.kql		openclaw-installation-detection-on-mde.kql
preemptive-search-for-artoken-phaas-domain-lures.kql		preemptive-search-for-artoken-phaas-domain-lures.kql
prompt-injector-analysis-report.kql		prompt-injector-analysis-report.kql
reduce-unnecessary-inbound-internet-exposure-on-internet-facing-devices.kql		reduce-unnecessary-inbound-internet-exposure-on-internet-facing-devices.kql
rise-in-kali365-de-domains.kql		rise-in-kali365-de-domains.kql
sentinel-kql-for-oauth-redirection-abuse-enables-phishing-and-malware-delivery.kql		sentinel-kql-for-oauth-redirection-abuse-enables-phishing-and-malware-delivery.kql
shinyhunters-infrastructure-detection.kql		shinyhunters-infrastructure-detection.kql
stop-jadepuffer.kql		stop-jadepuffer.kql
storm-2755-high-fidelity-kql-scan.kql		storm-2755-high-fidelity-kql-scan.kql
symleak-detection-via-git-clone-ntlm-hash-disclosure.kql		symleak-detection-via-git-clone-ntlm-hash-disclosure.kql

FilesExpand file tree

KQL

Directory actions

More options

Directory actions

More options

Latest commit

History

KQL

Folders and files

parent directory

ReadMe.txt