{"id":25406014,"url":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules","last_synced_at":"2025-10-31T01:31:59.947Z","repository":{"id":251322920,"uuid":"837067630","full_name":"SlimKQL/Hunting-Queries-Detection-Rules","owner":"SlimKQL","description":"KQL Queries. Microsoft Defender, Microsoft Sentinel","archived":false,"fork":false,"pushed_at":"2025-02-11T08:05:21.000Z","size":855,"stargazers_count":445,"open_issues_count":1,"forks_count":73,"subscribers_count":29,"default_branch":"main","last_synced_at":"2025-02-11T09:32:43.763Z","etag":null,"topics":["azure","defender","defenderxdr","kql","microsoft","mitre-attack","sentinel","threatdetection","threathunting"],"latest_commit_sha":null,"homepage":"https://steven.lim.name","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SlimKQL.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-02T06:30:38.000Z","updated_at":"2025-02-11T08:05:25.000Z","dependencies_parsed_at":"2024-12-17T06:19:50.394Z","dependency_job_id":"f134c5bf-7cc4-46f4-b212-7f1ae168679f","html_url":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules","commit_stats":null,"previous_names":["slimkql/hunting-queries-detection-rules"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SlimKQL%2FHunting-Queries-Detection-Rules","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SlimKQL%2FHunting-Queries-Detection-Rules/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SlimKQL%2FHunting-Queries-Detection-Rules/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SlimKQL%2FHunting-Queries-Detection-Rules/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SlimKQL","download_url":"https://codeload.github.com/SlimKQL/Hunting-Queries-Detection-Rules/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239088382,"owners_count":19579434,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","defender","defenderxdr","kql","microsoft","mitre-attack","sentinel","threatdetection","threathunting"],"created_at":"2025-02-16T05:05:00.367Z","updated_at":"2025-10-31T01:31:54.252Z","avatar_url":"https://github.com/SlimKQL.png","language":"HTML","funding_links":[],"categories":["Uncategorized","HTML"],"sub_categories":["Uncategorized"],"readme":"KQL Sentinel \u0026 Defender queries\n\nKQL for Defender XDR, Microsoft Sentinel \u0026 other Microsoft Solutions\n\nThe purpose of this repository is to share KQL queries that can be used by anyone and are understandable. These queries are intended to increase detection coverage through the logs of Microsoft Security products. Not all suspicious activities generate an alert by default, but many of those activities can be made detectable through the logs. These queries include Detection Rules, Hunting Queries and Visualisations. Anyone is free to use the queries. If you have any questions feel free to reach out to me on [Linkedin Steven Lim](https://www.linkedin.com/in/0x534c/)\n\nPresenting this material as your own is illegal and forbidden. A reference to Linkedin @0x534c or Github @SLimKQL is much appreciated when sharing or using the content.\n\n[SlimKQL Hunting-Queries-Detection-Rules](https://github.com/SlimKQL/Hunting-Queries-Detection-Rules)\n    - [Azure KQLs](https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/tree/main/Azure)\n    - [DefenderXDR KQLs](https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/tree/main/DefenderXDR)\n    - [Sentinel KQLs](https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/tree/main/Sentinel)\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSlimKQL%2FHunting-Queries-Detection-Rules","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FSlimKQL%2FHunting-Queries-Detection-Rules","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSlimKQL%2FHunting-Queries-Detection-Rules/lists"}