Hunting Queries on sentinelchangelog.nethttp://sentinelchangelog.net/tags/hunting-queries/Recent content in Hunting Queries on sentinelchangelog.netHugo -- 0.157.0enMon, 01 Jun 2026 04:39:34 +0000Slack Audit Solution: Enhanced Detection Logic and Alert Enrichmenthttp://sentinelchangelog.net/posts/2026-06-01-pr-14245/Mon, 01 Jun 2026 04:39:34 +0000http://sentinelchangelog.net/posts/2026-06-01-pr-14245/Slack Audit analytic rules, hunting queries, and workbook upgraded with improved KQL logic, custom alert details, and enhanced entity mappings for stronger workspace monitoring.Entra ID Post-Credential Activity Detection: Service Principal Staging and Privileged Role Escalationhttp://sentinelchangelog.net/posts/2026-05-29-pr-14299/Fri, 29 May 2026 10:56:48 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14299/Three new hunting queries target Midnight Blizzard-style persistence patterns — service principal credential staging, privileged role assignments to new accounts, and Temporary Access Pass abuse.Gentlemen Ransomware Campaign: New Hunting Queries for EtherRAT/TukTuk IOCs and Web3 C2 Infrastructurehttp://sentinelchangelog.net/posts/2026-05-29-pr-14338/Fri, 29 May 2026 08:24:12 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14338/Two hunting queries added targeting Gentlemen ransomware campaign artifacts including payload hashes and decentralized Web3/SaaS C2 infrastructure used by EtherRAT and TukTuk malware.LockBit Hunting Query: ActiveMQ Exploit IoC Detection Addedhttp://sentinelchangelog.net/posts/2026-05-29-pr-14350/Fri, 29 May 2026 05:32:22 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14350/New hunting query provides hash-based detection for LockBit ransomware artifacts deployed via Apache ActiveMQ CVE-2023-46604 exploitation.Entra ID Identity Boundary Expansion: Three New Hunting Queries for Stealthy Persistencehttp://sentinelchangelog.net/posts/2026-05-28-pr-14307/Thu, 28 May 2026 11:14:14 +0000http://sentinelchangelog.net/posts/2026-05-28-pr-14307/Added three hunting queries targeting identity boundary expansion techniques in Entra ID that escalate privileges without creating new accounts.Entra ID Authentication Anomalies: Advanced Hunting for Privilege Abuse and Defense Evasionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14339/Wed, 27 May 2026 13:42:33 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14339/Adds three-query pack detecting legacy auth bypass, guest account abuse, and post-reset privileged operations.Entra ID Account Takeover: Three-Query Hunting Pack for Post-Compromise Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14335/Wed, 27 May 2026 13:41:06 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14335/Adds hunting pack targeting device code phishing, service principal persistence, and bulk password resets by privileged actors.BadUSB HID Injection Detection: New Hunt for PowerShell via Windows Run Dialoghttp://sentinelchangelog.net/posts/2026-05-27-pr-14336/Wed, 27 May 2026 13:38:59 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14336/Adds hunting query to detect hardware keystroke injectors spawning PowerShell through explorer.exe with evasion patterns.Microsoft Entra ID OAuth Consent Query: Fixing Zero-Result Bug in High-Risk Permission Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14334/Wed, 27 May 2026 13:38:30 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14334/Corrects broken hunting query that returned no results due to incorrect property name filter.Hunting Query: Ephemeral Code Signing Certificates for Malware-Signing-as-a-Service Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14308/Wed, 27 May 2026 08:59:01 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14308/New hunting query identifies short-lived code signing certificates (≤14 days) on non-developer endpoints to detect Fox Tempest MSaaS operations.Hunting Query: Rootkit Network Evasion Detection via Firewall-EDR Telemetry Deltahttp://sentinelchangelog.net/posts/2026-05-27-pr-14337/Wed, 27 May 2026 08:36:31 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14337/New hunting query detects kernel-level rootkits bypassing EDR network telemetry by comparing perimeter firewall logs against Microsoft Defender for Endpoint data streams.Defender for Endpoint: Cryptographic Identity Baselining Hunting Query for Process Network Anomalieshttp://sentinelchangelog.net/posts/2026-05-26-pr-14333/Tue, 26 May 2026 09:05:22 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14333/New hunting query detects first-time network connections by processes using cryptographic signer baselining to defeat DLL sideloading and BYOTA attacks.Entra ID Attack Chain Correlation: Three New Hunting Queries for Sequential Compromise Patternshttp://sentinelchangelog.net/posts/2026-05-26-pr-14311/Tue, 26 May 2026 08:14:04 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14311/Three hunting queries detect multi-event attack chains in Entra ID—privileged role grants followed by SP credential additions and MFA disabling followed by sign-ins from unknown IPs.Phishing Detection: Raw IP URLs in Delivered Emailhttp://sentinelchangelog.net/posts/2026-05-26-pr-14340/Tue, 26 May 2026 06:30:21 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14340/New hunting query identifies delivered emails using raw IPv4 addresses as URL domains to detect phishing campaigns bypassing domain reputation systems.Entra ID Hunting Pack: Defense Weakening and Privilege Abuse Detectionhttp://sentinelchangelog.net/posts/2026-05-26-pr-14240/Tue, 26 May 2026 06:12:52 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14240/Three hunting queries targeting silent defense weakening techniques and off-hours privilege escalation in Entra ID environments.LSASS Credential Dumping: Resilient Behavioral Detection Pack Addedhttp://sentinelchangelog.net/posts/2026-05-26-pr-14341/Tue, 26 May 2026 05:29:06 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14341/Three new hunting queries detect LSASS memory dumping using behavioral physics rather than brittle timing or tool names.Entra ID Workload Identity and Privileged Role Hunting Pack: Three New Detection Querieshttp://sentinelchangelog.net/posts/2026-05-21-pr-14281/Thu, 21 May 2026 12:50:47 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14281/New hunting pack targeting workload identity abuse and privileged role assignment anomalies with coverage gaps for service principal credential theft and PIM bypass techniques.ETW-Resistant .NET Fileless Injection Detection via Kernel-Level CLR Loadinghttp://sentinelchangelog.net/posts/2026-05-21-pr-14314/Thu, 21 May 2026 12:14:25 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14314/New hunting query detects fileless .NET execution even when attackers patch ETW by monitoring kernel-level .NET runtime DLL loading in native processes and untrusted paths.Microsoft Defender XDR: New Hunting Query for Delegate Mailbox Phish Reporting Analysishttp://sentinelchangelog.net/posts/2026-05-21-pr-14257/Thu, 21 May 2026 04:14:42 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14257/New hunting query helps identify the actual user who reported a phishing message when recipients and actors differ in delegate or shared mailbox scenarios.Entra ID Cross-Source Hunting Pack: Post-Compromise Pattern Detectionhttp://sentinelchangelog.net/posts/2026-05-19-pr-14262/Tue, 19 May 2026 10:09:11 +0000http://sentinelchangelog.net/posts/2026-05-19-pr-14262/Three new hunting queries correlate AuditLogs and SigninLogs to surface post-compromise identity patterns using baseline-driven anomaly detection.AWS Content Quality Overhaul: Standardized Detection Rules and Improved Entity Mappingshttp://sentinelchangelog.net/posts/2026-05-18-pr-14101/Mon, 18 May 2026 07:30:57 +0000http://sentinelchangelog.net/posts/2026-05-18-pr-14101/Comprehensive quality improvements to 61 AWS Analytic Rules and 35 Hunting Queries with standardized naming conventions, normalized MITRE technique mappings, and updated entity field references from legacy AccountCustomEntity to UserIdentityUserName.Microsoft Entra ID Table Rename: Hunting Queries Updated for Current Schemahttp://sentinelchangelog.net/posts/2026-05-18-pr-14186/Mon, 18 May 2026 05:36:36 +0000http://sentinelchangelog.net/posts/2026-05-18-pr-14186/12 hunting queries updated to use EntraIdSignInEvents and EntraIdSpnSignInEvents tables, replacing deprecated AADSignInEventsBeta and AADSpnSignInEventsBeta references.Entra ID Attack Chain Detection: 5 New Hunting Queries Target Application Layer Persistencehttp://sentinelchangelog.net/posts/2026-05-13-pr-14239/Wed, 13 May 2026 10:29:56 +0000http://sentinelchangelog.net/posts/2026-05-13-pr-14239/Five hunting queries expose OAuth consent abuse, privileged escalation, and Conditional Access evasion used in Midnight Blizzard and Storm-0558 campaigns.Microsoft Entra ID: Service Principal Credential Manipulation by Rare Actorshttp://sentinelchangelog.net/posts/2026-05-07-pr-14213/Thu, 07 May 2026 10:51:04 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14213/Identifies service principal credential additions by actors not observed performing these operations in the previous 90 days, targeting persistence techniques.Microsoft Entra ID: Hunting Query for Password Spraying Detection via IP Failure Burstshttp://sentinelchangelog.net/posts/2026-05-07-pr-14208/Thu, 07 May 2026 10:50:43 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14208/Correlates failed sign-ins across multiple identities followed by successful authentication from the same IP within 15 minutes, targeting password spraying patterns.Microsoft Entra ID: New Hunting Query Detects Post-Compromise Token Abuse via ASN Mismatcheshttp://sentinelchangelog.net/posts/2026-05-07-pr-14207/Thu, 07 May 2026 10:50:16 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14207/Surfaces rapid ASN changes between interactive and non-interactive sign-ins within 10 minutes, indicating potential post-compromise token misuse.Azure Firewall Detection Quality Overhaul: Enhanced Alert Context and Reduced Query Costshttp://sentinelchangelog.net/posts/2026-05-06-pr-13820/Wed, 06 May 2026 09:37:20 +0000http://sentinelchangelog.net/posts/2026-05-06-pr-13820/Comprehensive quality improvements to 11 Azure Firewall detections and 5 hunting queries add entity mappings, custom details, and query optimizations to reduce false positives and improve incident context.Claroty: Enhanced IoT/OT Detection with Improved Alert Fidelityhttp://sentinelchangelog.net/posts/2026-05-05-pr-14107/Tue, 05 May 2026 09:58:40 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14107/Updated 9 analytic rules and 10 hunting queries with strengthened entity mapping, alert details, and MITRE coverage for OT/IoT network monitoring.Teams Social Engineering Detection: New Hunting Queries for RMM-Based Attackshttp://sentinelchangelog.net/posts/2026-05-04-pr-14117/Mon, 04 May 2026 12:53:39 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14117/Two new hunting queries detect Teams phishing campaigns that lure victims into launching remote access tools, addressing the Storm-1811 / Black Basta cross-tenant attack pattern.Valimail Enforce Solution: New Email Authentication Monitoring for DMARC/SPF/DKIM Configuration Changeshttp://sentinelchangelog.net/posts/2026-04-24-pr-14045/Fri, 24 Apr 2026 05:26:39 +0000http://sentinelchangelog.net/posts/2026-04-24-pr-14045/Complete Valimail Enforce monitoring solution delivers real-time detection of email authentication policy weakening and suspicious admin activity affecting domain security posture.SOCRadar XTI Platform: New Extended Threat Intelligence Solution Launches with Bidirectional Synchttp://sentinelchangelog.net/posts/2026-04-23-pr-13858/Thu, 23 Apr 2026 05:24:37 +0000http://sentinelchangelog.net/posts/2026-04-23-pr-13858/SOCRadar XTI Platform solution now available in Content Hub with automated alarm import, incident sync, and comprehensive threat intelligence monitoring capabilities.Microsoft Security Copilot: Six New Detections for AI Assistant Abusehttp://sentinelchangelog.net/posts/2026-03-27-pr-13735/Fri, 27 Mar 2026 05:01:42 +0000http://sentinelchangelog.net/posts/2026-03-27-pr-13735/New analytic rules target jailbreak attempts, external access, plugin tampering, and file upload disabling - covering major AI security attack vectors.AI Agents Hunting Query: Schema Field Case Correction Enables Query Executionhttp://sentinelchangelog.net/posts/2026-03-06-pr-13740/Fri, 06 Mar 2026 05:08:34 +0000http://sentinelchangelog.net/posts/2026-03-06-pr-13740/Fixed IdentityInfo field reference from AccountUPN to AccountUpn to resolve KQL validation failure and restore query functionality.Azure Activity: Hunting Query Documentation Enhancement for Custom Script Extensionshttp://sentinelchangelog.net/posts/2026-02-26-pr-13705/Thu, 26 Feb 2026 04:54:57 +0000http://sentinelchangelog.net/posts/2026-02-26-pr-13705/Minor documentation improvement clarifying protected settings visibility in Custom Script Extension hunting query.Microsoft Defender XDR Solution: Punycode Hunting Query Added for Lookalike Domain Detectionhttp://sentinelchangelog.net/posts/2026-02-17-pr-13596/Tue, 17 Feb 2026 06:43:02 +0000http://sentinelchangelog.net/posts/2026-02-17-pr-13596/Microsoft Defender XDR solution v3.0.14 adds hunting query targeting Punycode character abuse in lookalike domain attacks.Microsoft Defender XDR: New Hunting Query for Punycode Lookalike Domain Phishinghttp://sentinelchangelog.net/posts/2026-02-03-pr-13535/Tue, 03 Feb 2026 09:48:09 +0000http://sentinelchangelog.net/posts/2026-02-03-pr-13535/Advanced hunting query detects punycode domains using Cyrillic, Greek, and fullwidth ASCII characters to visually impersonate legitimate domains in email and Teams.Microsoft Defender XDR: SUNSPOT Detection Rule Documentation Updatehttp://sentinelchangelog.net/posts/2026-01-22-pr-13485/Thu, 22 Jan 2026 11:09:59 +0000http://sentinelchangelog.net/posts/2026-01-22-pr-13485/Updated SUNSPOT malware detection rule with corrected reference link formatting and MITRE technique mapping fixes across multiple solutions.New Solution: JoeSandbox Threat Intelligence and Malware Analysis Platform Integrationhttp://sentinelchangelog.net/posts/2026-01-22-pr-12801/Thu, 22 Jan 2026 09:02:45 +0000http://sentinelchangelog.net/posts/2026-01-22-pr-12801/Complete JoeSandbox solution deployment enabling automated malware analysis, threat intelligence feed ingestion, and incident enrichment playbooks for Microsoft Sentinel.Microsoft Defender XDR: Teams Hunting Queries Version Number Fixhttp://sentinelchangelog.net/posts/2026-01-22-pr-13205/Thu, 22 Jan 2026 06:09:17 +0000http://sentinelchangelog.net/posts/2026-01-22-pr-13205/Corrected malformed version numbers in Microsoft Teams threat hunting queries from invalid “l.0.0” to proper “1.0.0” format.Multi-Solution Link Updates: MITRE Technique Corrections and Reference Refresheshttp://sentinelchangelog.net/posts/2026-01-21-pr-13480/Wed, 21 Jan 2026 13:39:25 +0000http://sentinelchangelog.net/posts/2026-01-21-pr-13480/Updated outdated links and corrected MITRE ATT&CK technique mapping in detection rules across Microsoft Business Applications, Microsoft Defender XDR, and Windows Security Events solutions.Schema Correction: MITRE ATT&CK Field Name Fix Across Multiple Solutionshttp://sentinelchangelog.net/posts/2025-12-24-pr-13346/Wed, 24 Dec 2025 11:51:45 +0000http://sentinelchangelog.net/posts/2025-12-24-pr-13346/Critical schema update replaces deprecated requiredTechniques field with correct relevantTechniques field in analytic rules.Fortigate ASIM Parser: Field Name Consistency Fix for Network Session Schemahttp://sentinelchangelog.net/posts/2025-12-12-pr-12927/Fri, 12 Dec 2025 09:49:09 +0000http://sentinelchangelog.net/posts/2025-12-12-pr-12927/Field name inconsistencies in Fortigate ASIM parsers corrected to ensure proper schema compliance and data normalization.Critical Cloudflare Analytics Rules: Enhanced URL Entity Mapping and Repository Maintenancehttp://sentinelchangelog.net/posts/2025-12-08-pr-13138/Mon, 08 Dec 2025 06:57:34 +0000http://sentinelchangelog.net/posts/2025-12-08-pr-13138/P0-labeled update improves URL entity mapping in Cloudflare detection rules alongside extensive repository maintenance and validation improvements.Google Threat Intelligence: Enhanced Threat Hunting with MITRE ATT&CK Integrationhttp://sentinelchangelog.net/posts/2025-12-04-pr-13198/Thu, 04 Dec 2025 05:49:38 +0000http://sentinelchangelog.net/posts/2025-12-04-pr-13198/Updated threat hunting rules add MITRE ATT&CK mappings and fix parser function calls for improved threat detection coverage.UEBA Essentials: Five New Hunting Queries for Advanced Anomaly Analysis and Threat Triagehttp://sentinelchangelog.net/posts/2025-11-24-pr-13182/Mon, 24 Nov 2025 11:31:39 +0000http://sentinelchangelog.net/posts/2025-11-24-pr-13182/UEBA Essentials v4.1.0 adds five targeted hunting queries for high-score anomaly triage, trend analysis, template distribution, user-centric investigation, and malicious source IP identification.Microsoft Teams Security: 9 Additional Hunting Queries for Advanced Threat Detectionhttp://sentinelchangelog.net/posts/2025-11-21-pr-13167/Fri, 21 Nov 2025 05:16:08 +0000http://sentinelchangelog.net/posts/2025-11-21-pr-13167/Extended Teams protection hunting coverage with queries for partner impersonation, admin submissions, and external sender analysis.Open Systems Connector: aiohttp Security Update 3.10.11→3.12.14 Plus Multi-Solution Changeshttp://sentinelchangelog.net/posts/2025-11-20-pr-13158/Thu, 20 Nov 2025 08:54:08 +0000http://sentinelchangelog.net/posts/2025-11-20-pr-13158/Open Systems connector updated aiohttp dependency addressing potential security vulnerabilities, bundled with extensive solution packaging updates.Microsoft Teams Security: 7 New Hunting Queries for URL Threat Detectionhttp://sentinelchangelog.net/posts/2025-11-19-pr-13156/Wed, 19 Nov 2025 08:50:58 +0000http://sentinelchangelog.net/posts/2025-11-19-pr-13156/New hunting queries added to detect malicious URL clicks, ZAP events, and user submissions in Microsoft Teams.GCP Security Command Center: New Detection Suite for Cloud Misconfigurationshttp://sentinelchangelog.net/posts/2025-11-14-pr-13116/Fri, 14 Nov 2025 08:22:41 +0000http://sentinelchangelog.net/posts/2025-11-14-pr-13116/New Solution delivers 5 Analytic Rules and 5 Hunting Queries to detect GCP security misconfigurations including unrestricted API keys, disabled security features, and risky IAM configurations.UEBA Essentials: Enhanced Multi-Cloud Detection with 6 New AWS, GCP & Okta Hunting Querieshttp://sentinelchangelog.net/posts/2025-11-12-pr-13065/Wed, 12 Nov 2025 11:17:58 +0000http://sentinelchangelog.net/posts/2025-11-12-pr-13065/Major update adds comprehensive multi-cloud anomaly detection capabilities across AWS, GCP, and Okta platforms with 6 new hunting queries.