AdvancedHuntingQueries

My collection of Microsoft 365 Advanced Hunting Queries written in Kusto Query Language (KQL).

This repo includes '🔎' icons with hotlinks that plug the queries right into your M365 Security tenant.

Click on a category to start exploring my hunting queries!

Query Categories:

Anomalies

• Identify the most significant spikes in various activities

ASR

• Queries that help you build your Attack Surface Reduction policies

Detection Rules

• Kusto queries that can be turned into detection rules to create alerts

Exploits

• Hunt for specific exploits being used in your environment

Incident Response

• Hunt for known IOCs and activity from compromised hosts

Phishing

• Identify potential phishing emails in your environment

Security Posture

• Highlight bad operational security practices

Utilities

• Useful queries that help with identity correlation, metrics, policy building, etc.