Source: CQURE Academy
Author: Daniel
URL: https://cqureacademy.com/blog/cqure-hacks-81-the-ultimate-kql-query-toolkit-for-threat-hunters-and-security-analysts/
ONE SENTENCE SUMMARY:
Eight reusable KQL queries enable baselining, incident response, and threat hunting through traffic, auth, scanning, C2, anomalies, fingerprints, and egress monitoring.
MAIN POINTS:
- Daily baseline query tracks volume, success rate, failures, intrusion attempts, and unique IPs.
- Trend binning with 1-day intervals helps detect deviations like sudden intrusion spikes.
- Incident-response query identifies top malicious IPs, timing, attack types, ports, and protocols.
- make_set() highlights multi-technique attackers and supports rapid blocklisting and triage.
- Failed authentication analysis uses hourly grouping and thresholds to spot brute force patterns.
- Distinct source/target counts differentiate password spraying from targeted account attacks.
- Port-scan detection monitors 15-minute windows, flagging hosts probing multiple ports quickly.
- Botnet C2 hunting profiles payload percentiles and user agents to find beaconing behavior.
- Protocol anomaly detection flags rare protocol-port combinations and scores suspicious patterns via joins.
- User-agent and egress queries distinguish scanners from attackers and expose risky outbound communications.
TAKEAWAYS:
- Establish normal behavior first, then investigate meaningful deviations.
- Pivot quickly from baseline anomalies to attacker attribution and response actions.
- Use time windows, thresholds, and uniqueness metrics to reduce noise and reveal patterns.
- Combine behavioral profiling (payloads, user agents, protocol-port mismatches) with scoring for stealthy threats.
- Treat these queries as a coordinated, customizable toolkit run on reliable schedules.