Hunting-Queries-Detection-Rules
FalconFriday
Our great sponsors
Hunting-Queries-Detection-Rules | FalconFriday | |
---|---|---|
7 | 3 | |
997 | 652 | |
- | 9.2% | |
9.3 | 2.5 | |
1 day ago | 22 days ago | |
Python | ||
BSD 3-clause "New" or "Revised" License | BSD 3-clause "New" or "Revised" License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Hunting-Queries-Detection-Rules
- Advanced Hunting queries every admin should use
- Hunting Querie into a Detection rule
- MS Sentinel Analytics & KQL
- Analytical rules
- MDE Repointing Frequency
-
Least occurrence in MDE
This will be the query that you are looking for. I do have a lot more queries if you are interested: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules
- Must have analytic rules
FalconFriday
-
Collection of Queries
Falcon Force Team - Falcon Friday Queries: https://github.com/FalconForceTeam/FalconFriday
- MS Sentinel Analytics & KQL
- Analytical rules
What are some alternatives?
Microsoft-365-Defender-Hunting-Queries - Sample queries for Advanced hunting in Microsoft 365 Defender
chatgpt-raycast - ChatGPT raycast extension
csfalcon - crowdstrike tips & tricks π¦ πΆβπ«οΈ
kusto-queries - example queries for learning the kusto language
Sentinel-Queries - Collection of KQL queries
crowdstrike-falcon-queries - A collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
AzureHunter - A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
falcon-query-assets - Welcome to the Falcon Query Assets GitHub page.
Linux Security - Ways to attack and protect Linux π§’
CrowdStrike-Queries - CrowdStrike Falcon Queries For Advanced Threat Detection