KQL Query Reference

These run in Microsoft Sentinel (Logs) and Defender XDR (Advanced Hunting). Tune the time windows and thresholds to your environment before relying on them for alerting. Each query is tagged with its source table, the ATT&CK technique it detects, and a confidence level reflecting how prone it is to false positives.

Credential Access 6

Credential theft is the pivot point of most intrusions: once an attacker has valid credentials, their activity blends into legitimate authentication. These detections target the act of stealing them rather than their later use. Most of the signal is on the endpoint (DeviceProcessEvents) where the dumping tool runs, with the LSASS-access and SAM-hive queries being high-confidence because legitimate software rarely touches those in these specific ways. The cloud-side query catches MFA registration from an unexpected context, which is how attackers make stolen access durable.

Initial Access 4

Initial access is where the intrusion crosses your perimeter, so the signal is split between the endpoint (a malicious document or mounted image executing) and the identity plane (a sign-in that should not have succeeded). The endpoint queries look for the classic delivery patterns: Office applications spawning script interpreters, and ISO/VHD containers used to bypass Mark-of-the-Web. The SigninLogs queries catch the cloud equivalents, password spraying and impossible-travel sign-ins, where the attacker is brute-forcing or using stolen credentials from an implausible location.

Execution 4

Execution detections catch code running through the mechanisms attackers favour because they blend in: signed LOLBins, script interpreters, and WMI. The common thread across these queries is not the binary itself (powershell.exe, mshta.exe, certutil.exe are all legitimate) but the command line, the parent process, or the network behaviour that betrays malicious intent. Read the ProcessCommandLine field, not just the FileName.

Persistence 6

Persistence is how an attacker survives a reboot or a remediation, so it is one of the highest-value things to hunt: finding it often means finding a foothold you did not know about. The mechanisms span the registry (Run keys, service ImagePaths), the filesystem (startup folders), WMI event subscriptions, and, in the cloud, OAuth consent grants. Watch the InitiatingProcessFileName on the endpoint queries: persistence written by a script interpreter rather than an installer is the tell.

Lateral Movement 4

Lateral movement is the attacker spreading from the first compromised host to others, and it is where containment decisions get made: every new host in the chain widens the incident. These queries catch the common techniques, PsExec service installs, pass-the-hash (NTLM NewCredentials logons), SMB copies to admin shares, and RDP from unexpected sources. The logon-based queries (DeviceLogonEvents) are where the cross-host story assembles: follow the RemoteIP and account across hosts.

Defense Evasion 6

Defense evasion is the attacker actively working against your visibility, which makes these among the most important detections to get right: a successful evasion blinds your other rules. The queries here catch tampering with the security stack itself, AMSI bypasses, ETW provider tampering, Defender exclusion changes, event log clearing, and process masquerading (a system binary name running from the wrong path). Several are high-confidence precisely because there is no legitimate reason to perform them.

Discovery 2

Discovery is the reconnaissance an attacker runs after landing on a host, mapping the domain, the network, and the privileges available to them. Any single discovery command is benign (administrators run them too), so these queries lean on volume and clustering: a burst of recon commands from one process in a short window is the pattern, not the individual command. This is an early-stage signal, useful for catching an intrusion before the attacker acts on what they found.

Collection 2

Collection is the attacker gathering what they came for before taking it, so it sits right before exfiltration in the kill chain and is a strong point to intervene. On the endpoint, the signal is archive creation, data being staged into a zip or rar for transfer. In the cloud, the highest-value collection signal for business email compromise is inbox rule creation: an attacker who has taken a mailbox sets a rule to hide or forward mail.

Exfiltration 1

Exfiltration is data leaving your environment, the outcome most incidents are ultimately about. It is also the hardest to detect cleanly from volume alone, which is why the single query here is marked low-confidence: large outbound transfers happen constantly through legitimate cloud sync, backups, and software updates. The value is in correlation, a large transfer becomes meaningful when it follows collection and credential access on the same host, or goes to a destination nothing else talks to.

Command and Control 1

Command and control is the channel an attacker uses to operate a foothold remotely, and catching it means catching an active, ongoing compromise. Beaconing, the implant calling home at regular intervals, is the canonical signal, and the query here looks for that periodicity in network connections rather than any single connection. Modern C2 hides in normal-looking HTTPS, so the timing pattern is often a better discriminator than the destination.

Monitoring 3

These are not threat detections but health checks: queries that tell you whether your detection coverage is actually working. Stale MDE sensors, out-of-date AV signatures, and ASR audit visibility are the blind spots attackers exploit, and a gap here silently degrades every other query on this page. Run these on a schedule and treat a coverage gap with the same urgency as a detection, because an unmonitored host is where the next intrusion will land.