threat-hunting

Threat Hunting

KQL queries for proactive threat hunting mapped to the MITRE ATT&CK framework.

Contents

• Persistence
• Defense Evasion
• Execution
• Discovery
• Lateral Movement
• Command and Control

Persistence

// Detect new local user accounts created - T1136.001
DeviceEvents
| where ActionType == "UserAccountCreated"
| project TimeGenerated, DeviceName, AccountName
| order by TimeGenerated desc

// Detect modifications to startup registry keys - T1547.001
DeviceRegistryEvents
| where RegistryKey has_any ("Run", "RunOnce")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueData
| order by TimeGenerated desc

Defense Evasion

// Detect event log deletion - T1070.001
DeviceEvents
| where FileName == "wevtutil.exe"
| where ProcessCommandLine contains "cl"
| project TimeGenerated, DeviceName, ProcessCommandLine
| order by TimeGenerated desc

// Detect disabling of Windows Defender - T1562.001
DeviceRegistryEvents
| where RegistryKey has "Windows Defender"
| where RegistryValueName == "DisableAntiSpyware"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueData
| order by TimeGenerated desc

Execution

// Detect PowerShell downloading files - T1059.001
DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine has_any ("Net.WebClient", "Invoke-WebRequest", "DownloadFile")
| project TimeGenerated, DeviceName, ProcessCommandLine
| order by TimeGenerated desc

// Detect encoded PowerShell commands - T1059.001
DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand")
| project TimeGenerated, DeviceName, ProcessCommandLine
| order by TimeGenerated desc

Discovery

// Detect network scanning activity - T1046
DeviceNetworkEvents
| summarize ConnCount = count() by DeviceName, RemoteIP
| where ConnCount > 100
| order by ConnCount desc

// Detect enumeration of local users and groups - T1087.001
DeviceProcessEvents
| where FileName in ("net.exe", "net1.exe")
| where ProcessCommandLine has_any ("user", "localgroup", "group")
| project TimeGenerated, DeviceName, ProcessCommandLine
| order by TimeGenerated desc

Lateral Movement

// Detect pass-the-hash attempts - T1550.002
DeviceLogonEvents
| where LogonType == "Network"
| where IsLocalAdmin == true
| summarize count() by DeviceName, AccountName, RemoteIP
| order by count_ desc

// Detect remote service creation - T1021
DeviceEvents
| where ActionType == "ServiceInstalled"
| where InitiatingProcessFileName == "services.exe"
| project TimeGenerated, DeviceName, FileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Command and Control

// Detect connections to rare external IPs - T1071
DeviceNetworkEvents
| summarize ConnCount = count() by RemoteIP
| where ConnCount < 3
| order by ConnCount asc

// Detect DNS queries to suspicious domains - T1071.004
DeviceNetworkEvents
| where RemoteUrl has_any (".xyz", ".top", ".tk", ".pw")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP
| order by TimeGenerated desc