List of custom developed KQL queries to help proactive security teams hunt for opportunistic and sophisticated threat activity by developing custom TTP'S from red-teaming engagements & simulations with the strategic goal to prevent threats before they have the opportunity to execute
☆26Jun 30, 2021Updated 4 years ago
Alternatives and similar repositories for DefenderATP-Proactive-Threat-Hunting-Queries-KQL
Users that are interested in DefenderATP-Proactive-Threat-Hunting-Queries-KQL are comparing it to the libraries listed below
Sorting:
- Hunting Queries for Microsoft Defender Security Center https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defe…☆40Apr 8, 2021Updated 4 years ago
- Cheat sheets for threat hunting, detection and other stuff.☆34Oct 7, 2022Updated 3 years ago
- Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant.☆133Feb 10, 2026Updated 3 weeks ago
- Collection of Jupyter Notebook for Threat Hunting and Blue Team Purposes☆22Jun 15, 2022Updated 3 years ago
- Sample queries for Advanced hunting in Microsoft Defender ATP☆38Dec 19, 2021Updated 4 years ago
- Threat Hunter's Knowledge Base☆22Dec 27, 2021Updated 4 years ago
- This repo is where I store my Threat Hunting ideas/content☆88May 9, 2023Updated 2 years ago
- ☆31Feb 27, 2026Updated last week
- Domain Response is a tool that is designed to help you automate the investigation for a domain. This tool is specificly designed to autom…☆49Jan 1, 2026Updated 2 months ago
- Michael Melone's Kusto Query library☆20Nov 17, 2023Updated 2 years ago
- Repository with Sample KQL Query examples for Threat Hunting☆217Sep 1, 2022Updated 3 years ago
- An opensource sigma conversion tool built using pysigma☆161Feb 9, 2026Updated 3 weeks ago
- A simple many-rules to many-files YARA scanner for incident response or malware zoos.☆27Jun 3, 2018Updated 7 years ago
- A public repository of MITRE ATT&ACK TTP mappings by BushidoUK for OSINT reports that lack a section breaking down the TTPs.☆27Mar 20, 2025Updated 11 months ago
- A curated list of blogs, videos, tutorials, queries and anything else valuable to help you learn and master KQL and Microsoft Sentinel☆239Feb 8, 2023Updated 3 years ago
- A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 D…☆758Aug 28, 2025Updated 6 months ago
- A CALDERA plugin☆27Feb 24, 2026Updated last week
- ☆36Aug 23, 2022Updated 3 years ago
- Powershell collection designed to assist in Threat Hunting Windows systems.☆27Apr 13, 2018Updated 7 years ago
- Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).☆804Jan 14, 2026Updated last month
- ☆72Oct 21, 2024Updated last year
- Community content for LogRhythm Axon. Includes Dashboards, searches, analytics rules, processing policies and more.☆10Jul 26, 2024Updated last year
- ☆30Jan 13, 2026Updated last month
- Simulates a compromise in a cloud and container environment☆34Dec 18, 2024Updated last year
- Azure Deployment Templates for Mandiant Managed Huning☆12Jun 1, 2023Updated 2 years ago
- Repository with supporting materials for Invictus Academy/Training☆44Jan 3, 2025Updated last year
- Collection of scripts provided for public use☆39Feb 4, 2026Updated last month
- A Docker-based development stack for Bedrock WordPress multisite, optimized for local development, source control, and CI/CD integration.☆14Jun 26, 2025Updated 8 months ago
- Convert Confluence MIME exports (.doc) to clean Markdown☆34Jan 13, 2026Updated last month
- A very basic app written in Javascript and packaged as a Docker image to be used as a demo when testing clustered deployments in ECS/EKS.☆11Jun 30, 2023Updated 2 years ago
- Threat Network Detection in Online Social Networks☆10Jan 20, 2017Updated 9 years ago
- Project that creates a Kubernetes environment in Azure (AKS) and protects it with CloudGuard CSPM / Workload and Appsec technologies☆10Jun 12, 2023Updated 2 years ago
- This is a fork from Ryan Carson's AI Dev Tasks repository, with some code cleanup and refactoring to enable support for PostgreSQL databa…☆15Sep 8, 2025Updated 5 months ago
- Kernels for Untangle products☆10Jan 29, 2026Updated last month
- Some YARA rules i will add from time to time☆12May 31, 2019Updated 6 years ago
- KQL queries for Advanced Hunting☆176Jan 16, 2020Updated 6 years ago
- 🍚 Rice Frontend AMM Swap☆26Sep 21, 2021Updated 4 years ago
- Scan git repos for secrets using regex and entropy 🔑☆10Jun 18, 2020Updated 5 years ago
- This Repository is specially created for the NL InfoSec Discord Channel☆11Dec 19, 2021Updated 4 years ago