cyb3rmik3/KQL-threat-hunting-queries

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

KQL Queries. Microsoft Defender, Microsoft Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

MCP to help Defenders Detection Engineer Harder and Smarter

Main Sigma Rule Repository

Splunk Security Content

Production-ready detection & response queries for osquery

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity