Hunt Repo
Threat hunt repository
Hypothesis-driven hunts from my research, each with ready-to-run queries, data sources and MITRE ATT&CK mapping.
12
hunts
11
KQL
1
Splunk
| ID | Hunt | Tactic | Technique | Query | Created |
|---|---|---|---|---|---|
| hunt-2025-044 | FOCI Cross-Resource Token Pivot — Non-Interactive Sign-In Burst Entra ID, Azure · AADNonInteractiveUserSignInLogs | Credential AccessCollectionLateral Movement | T1528, T1550.001 | KQL | |
| hunt-2025-045 | Device Code Auth Followed by FOCI Multi-Resource Burst Entra ID, Azure · SigninLogs, AADNonInteractiveUserSignInLogs, MicrosoftGraphActivityLogs | Credential AccessCollectionLateral Movement | T1528, T1550.001 | KQL | |
| hunt-2025-041 | Workers.dev Phishing URL in Email — Device Code Campaign Detection Microsoft Defender XDR, Microsoft 365 · EmailUrlInfo, EmailEvents | Initial Access | T1566.002 | KQL | |
| hunt-2025-042 | General Device Code Authentication Visibility Entra ID, Azure · SigninLogs | Credential AccessInitial Access | T1528, T1078.004 | KQL | |
| hunt-2025-043 | First-Time Device Code Authentication — No Prior Protocol History Entra ID, Azure · SigninLogs | Credential AccessInitial Access | T1528, T1566.002 | KQL | |
| hunt-2025-038 | Token Protection Switch with Different IP Entra · AADNonInteractiveUserSignInLogs, SigninLogs | Initial Access | T1566 | KQL | |
| hunt-2025-039 | User Authenticating to Azure CLI for First Time Entra · SigninLogs | Initial Access | T1566 | KQL | |
| hunt-2025-040 | Potential ConsentFix URL Match in Proxy Entra · ProxyLogs | Initial Access | T1566 | Splunk | |
| hunt-2025-034 | Potential Token Replay from Different ASNs Entra · AADNonInteractiveUserSignInLogs, MicrosoftGraphActivityLogs | Defense Evasion | T1134.001 | KQL | |
| hunt-2025-035 | Sensitive Keyword Search via Graph Entra · AADNonInteractiveUserSignInLogs, MicrosoftGraphActivityLogs | Defense Evasion | T1134.001 | KQL | |
| hunt-2025-036 | Unbound Token Usage from High-Risk Apps Entra · AADNonInteractiveUserSignInLogs, MicrosoftGraphActivityLogs | Defense Evasion | T1134.001 | KQL | |
| hunt-2025-037 | Spike in invalid token usage (50173) Entra · AADNonInteractiveUserSignInLogs, MicrosoftGraphActivityLogs | Defense Evasion | T1134.001 | KQL |
Showing 12 of 12 hunts