search

Bert-JanP / Hunting-Queries-Detection-Rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
https://kqlquery.com
BSD 3-Clause "New" or "Revised" License
1.14k stars 213 forks source link

Create ttp_t1562-001_disabledefender.md #28

Closed m4nbat closed 7 months ago

m4nbat commented 7 months ago

Part of several analytics submitted to detect TTPs associated with fin7, ZLoader, and FakeBat, from a recent a Red Canary report.