kql-threathunting

Here are 31 public repositories matching this topic...

benscha / KQLAdvancedHunting

Production-ready KQL queries for Microsoft Defender XDR and Microsoft Sentinel. Focused on Threat Hunting, Detection Engineering, and MITRE ATT&CK mapping.

sentinel threat-hunting blue-team logicapps security-operations kql detection-engineering microsoft-sentinel advanced-hunting m365-defender defender-xdr kql-threathunting kql-queries

Updated Aug 19, 2026
PowerShell

a2awais / Threat-Hunting

Star

Threat Hunting queries of multiple platforms

threat-hunting cql hunting ttps mitre threat-actors threat-intelligence crowdstrike apts mitre-attack threat-detection kql detection-engineering kql-threathunting kql-queries

Updated Aug 13, 2026
CQL

4R9UN / mcp-kql-server

Star

Kusto and Log Analytics MCP server help you execute a KQL (Kusto Query Language) query within an AI prompt, analyze, and visualize the data.

ai mcp dataexplorer cag loganalytics kusto kql llm mcp-server kql-threathunting kustomcp

Updated Aug 3, 2026
Python

NVISOsecurity / Detection-and-Hunting-Queries

Star

This repository contains detection and threat hunting queries created by NVISO’s CSIRT and SOC teams.

queries sentinel cybersecurity threat-hunting threat-detection kusto kql detection-engineering detections kusto-language defender-for-endpoint microsoft-sentinel kql-threathunting kql-queries

Updated Jun 25, 2026

ItzHerbie / KQL

Star

Detection rules and threat hunting queries in Defender XDR and Azure Sentinel

cybersecurity kql azure-sentinel defender-xdr kql-threathunting

Updated Mar 13, 2026

Letlaka / redsun-bluehammer-undefend-detection-pack

Star

Microsoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.

privilege-escalation windows-security detection-engineering microsoft-defender advanced-hunting redsun microsoft-defender-xdr defender-xdr kql-threathunting threat-detection-windows bluehammer undefend cve-2026-33825

Updated May 5, 2026

WiLL75G / sentinel-soc-lab-setup

Star

End-to-end Microsoft Sentinel SOC lab: KQL detections and threat hunts for SSH brute force (T1110) and malicious PowerShell (T1059.001).

azure siem soc kql detection-engineering microsoft-sentinel kql-threathunting mittre-attack kql-microsoft-sentinel

Updated Jul 29, 2026

Null0x47 / defender-schemas-to-kustainer

Star

Maps Microsoft Defender XDR Schemas to a local Kustainer Data Explorer instance

azure azure-data-explorer azure-kusto microsoft-defender-xdr kql-threathunting

Updated Jun 18, 2025
Python

SyntheticSovereign / Azure-SOC-AI-Enhanced-Homelab

Star

AI-enhanced Azure SOC homelab for phishing detection & response, threat intelligence, and much more using Microsoft Sentinel, Defender XDR, and ANY.RUN.

incident-response dfir cybersecurity openai wireshark sysmon siem malware-analysis risk-assessment kali-linux iso27001 threat-intelligence microsoft-azure sora defender-for-endpoint microsoft-sentinel any-run kql-threathunting

Updated Jan 4, 2026
Python

reatva / Threat-Hunting-Incident-Response-Lab

Star

This lab is inspired by concepts and guidance from Josh Madakor’s Cyber Range course.

incident-response threat-hunting siem microsoft-azure edr kql defender-for-endpoint kql-threathunting

Updated Jul 11, 2025

alex-milla / KQL_for_Defender

Star

kql kql-threathunting kql-queries

Updated Jul 1, 2026

fpeakman / KQL-Detections-Hunting

Star

A collection of Mitre ATT&CK aligned KQL detection, hunting, and audit queries for Defender XDR.

kusto kql detection-engineering defender-for-endpoint defender-for-identity entra-id defender-xdr defender-for-cloud-apps kql-threathunting

Updated Feb 16, 2026

AshiqS1 / azure-mysql-honeypot

Star

Built a honeypot database server with an open firewall and exposed it to the public internet for 4 days. 2 threat actors brute-forced it in 4 hours, exfiltrated data, and left a ransom note demanding 0.0135 BTC. Wrote 2 custom analytics rules in Sentinel (KQL) to detect initial access across 34 alerts and 2 incidents.

azure sentinel siem kql-threathunting

Updated Aug 3, 2026

AndyBallardSecurity / KQL-Queries-Defender-Sentinel

Star

KQL Queries for Microsoft Sentinel and Microsoft Defender XDR

microsoft azure sentinel defender threat-hunting mitre mitre-attack kql threatdetection defenderxdr kql-threathunting kql-queries

Updated Sep 13, 2025

JacobSkoog / OffensiveDefenderXDR

Star

Find potential local privilege escalation on windows with KQL

privilege-escalation kql threathunting microsoft-defender-for-endpoint kql-threathunting

Updated Mar 24, 2026

annKimani-ICS / Sentinel-SOC-Homelab

Star

A Microsoft Sentinel SOC homelab in Azure, where I built and validated a basic cloud SOC workflow: data onboarding, detection, investigation, and visualization. It demonstrates practical blue-team skills in SIEM operations, KQL-based threat hunting, watchlist enrichment, and workbook reporting.

microsoft-azure microsoft-sentinel kql-threathunting incident-triage soc-analysis microsoft-sentinel-workbook incident-logging microsoft-sentinel-kql

Updated Jun 2, 2026

alex-milla / Hunting_for_Malicious_Chrome_Extensions

Star

To hunt for potential malicious extensions

microsoft chrome sentinel hunting chrome-extensions watchlist kql kql-threathunting

Updated Jul 23, 2026

demotedcoder / KQL_Shared_Queries

Star

In this repository, you will find KQL queries that can be executed in Defender EDR.

kql-threathunting kql-queries

Updated Jul 20, 2026

TlholoG / KC7-Security-Analyst_II

Star

Level II cybersecurity investigation portfolio built through KC7 Cyber. Extends KQL-based security analysis into networking, ransomware-as-a-service, supply-chain security, and industrial control system (ICS) investigations, with documented case analysis and investigative queries.

incident-response cybersecurity ransomware soc network-security security-analysis security-operations kql supply-chain-security kusto-query-language kql-threathunting ransomware-as-a-service

Updated Aug 19, 2026
HTML

itsrubenclarke / Threat-Hunting

Star

This repository contains my labs for developing threat hunting skills by simulating real-world attack scenarios on Windows systems, focusing on system configuration tampering, unauthorised access detection, and network activity analysis.

powershell loganalyticsworkspace defender-for-endpoint kql-threathunting

Updated Jul 9, 2025

Improve this page

Add a description, image, and links to the kql-threathunting topic page so that developers can more easily learn about it.

Curate this topic

Add this topic to your repo

To associate your repository with the kql-threathunting topic, visit your repo's landing page and select "manage topics."

Learn more