{"id":22924369,"url":"https://github.com/lawndoc/advancedhuntingqueries","last_synced_at":"2026-02-20T17:01:53.831Z","repository":{"id":41315921,"uuid":"395756791","full_name":"lawndoc/AdvancedHuntingQueries","owner":"lawndoc","description":"Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant.","archived":false,"fork":false,"pushed_at":"2025-06-20T19:14:34.000Z","size":335,"stargazers_count":128,"open_issues_count":0,"forks_count":18,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-10-25T01:24:48.382Z","etag":null,"topics":["cyber-security","cybersecurity","defender","defender-atp","defender-for-endpoint","detection","detection-engineering","hunting","kql","kusto","microsoft","microsoft365","security","threat-hunting","xdr"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lawndoc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"lawndoc","patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"lfx_crowdfunding":null,"custom":null}},"created_at":"2021-08-13T18:35:30.000Z","updated_at":"2025-09-15T11:12:10.000Z","dependencies_parsed_at":"2025-10-15T17:22:14.044Z","dependency_job_id":"fd772fe0-6649-4130-80bf-669f3fc2d4c8","html_url":"https://github.com/lawndoc/AdvancedHuntingQueries","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/lawndoc/AdvancedHuntingQueries","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lawndoc%2FAdvancedHuntingQueries","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lawndoc%2FAdvancedHuntingQueries/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lawndoc%2FAdvancedHuntingQueries/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lawndoc%2FAdvancedHuntingQueries/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lawndoc","download_url":"https://codeload.github.com/lawndoc/AdvancedHuntingQueries/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lawndoc%2FAdvancedHuntingQueries/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29658167,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-20T16:33:43.953Z","status":"ssl_error","status_checked_at":"2026-02-20T16:33:43.598Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyber-security","cybersecurity","defender","defender-atp","defender-for-endpoint","detection","detection-engineering","hunting","kql","kusto","microsoft","microsoft365","security","threat-hunting","xdr"],"created_at":"2024-12-14T08:28:49.380Z","updated_at":"2026-02-20T17:01:53.814Z","avatar_url":"https://github.com/lawndoc.png","language":null,"funding_links":["https://github.com/sponsors/lawndoc"],"categories":[],"sub_categories":[],"readme":"# AdvancedHuntingQueries\nMy collection of Microsoft 365 Advanced Hunting Queries written in Kusto Query Language (KQL). My queries are public domain ([Unlicense](LICENSE)), but I'd appreciate a credit/tag if you republish them somewhere.\n\nThis repo includes '🔎' icons with hotlinks that plug the queries right into your M365 Security tenant.\n\nClick on a category to start exploring my hunting queries!\n\n## Query Categories:\n\n### [📈 Anomalies](Anomalies)\n\n- Identify the most significant spikes in various activities\n\n### [🛡️ ASR Rules](ASR)\n\n- Queries that help you build your [Attack Surface Reduction](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction) policies\n\n### [⚠️ Detection Rules](Detection-Rules)\n\n- Kusto queries that can be turned into detection rules to create alerts\n\n### [💣 Exploits](Exploits)\n\n- Hunt for specific exploits being used in your environment\n\n### [🕵️ Incident Response](Incident-Response)\n\n- Hunt for known IOCs and activity from compromised hosts\n\n### [🎣 Phishing](Phishing)\n\n- Identify potential phishing emails in your environment\n\n### [📝 Rough Drafts](Rough-Drafts)\n\n- Detection rules I've written that are useful for hunting but not ready to generate alerts\n\n### [🏰 Security Posture](Posture)\n\n- Highlight bad operational security practices\n\n### [🧑 User Behavior](User-Behavior)\n\n- Queries related to user activity -- not all of them are relevant to security\n\n### [🛠️ Utilities](Utilities)\n\n- Useful queries that help with identity correlation, metrics, policy building, etc.\n\n---\n\n## Crafting your own queries\n\n### Getting started\n\nTo get better at KQL, the best starting place is to just __explore the data__. By exploring the data, your curiosity can lead you down rabbit holes of \"how can I find this?\" It also helps you understand the data. __You can't make your own hunting queries if you don't know what information you have available to you__.\n\nChoose a table like `DeviceEvents` and take a sample of just 10 random events with `take 10`. This will give you an idea of what data is in that table.\n\n```\nDeviceEvents\n| take 10\n```\n\nI find the `distinct` operator useful for identifying the values I can expect to find in a specific column. That will give me an idea of the ways that I can filter out data or only show specific things.\n\n```\nDeviceEvents\n| distinct ActionType\n```\n\nWhen troubleshooting a query that isn't giving you want you want, the first thing you need to do is identify *which line* is wrong. Injecting `take 10` or a `where` filter and then a __blank line__ will allow you to check for values you would expect to see or not see.\n\n```\nDeviceProcessEvents\n| where ProcessCommandLine contains \"iex\"\n| take 10  // the blank line below will end this 3-line query\n\n| summarize Count = count() by InitiatingProcessFileName  // this line won't execute because of the blank line above\n```\n\nTo clean up the output, you can hide columns you don't care about with `project`, `project-away`, and `project-reorder`. It's also helpful to `sort` by a column like `Timestamp` or `Count`. Having an easily digestible output is as important as the query itself.\n\nTry the below queries with and without `project` and `sort`\n\n```\nDeviceProcessEvents\n| where FileName contains \"whoami\"\n| project Timestamp, DeviceName, AccountName, FileName, InitiatingProcessCommandLine\n```\n\n```\nDeviceProcessEvents\n| where FileName == \"cmd.exe\"\n| summarize Count = count() by AccountName\n| sort by Count desc\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flawndoc%2Fadvancedhuntingqueries","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flawndoc%2Fadvancedhuntingqueries","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flawndoc%2Fadvancedhuntingqueries/lists"}