Cortex-XQL-Queries

XQL queries based off threat intel, on-going campaigns, & cloud environments that can be used for detection engineering and/or threat hunting

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Cortex-XQL-Queries

About

Uh oh!

Releases

Packages

Uh oh!

Contributors

Uh oh!

Name		Name	Last commit message	Last commit date
Latest commit History 448 Commits
AWS Console Brute Force Activity		AWS Console Brute Force Activity
AWS EC2 GPU \| Large Instance Launch Detection		AWS EC2 GPU \| Large Instance Launch Detection
AWS EC2 GetPasswordData Detection		AWS EC2 GetPasswordData Detection
AWS EC2 Security Group Modification ports 22\|3389 to the Internet		AWS EC2 Security Group Modification ports 22\|3389 to the Internet
AWS GuardDuty \| CloudTrail Defense Evasion		AWS GuardDuty \| CloudTrail Defense Evasion
AWS KMS Key Deletion Scheduled		AWS KMS Key Deletion Scheduled
AWS New SAML\|OIDC Identity Provider Added		AWS New SAML\|OIDC Identity Provider Added
AWS Region Enablement		AWS Region Enablement
AWS S3 Object Encryption with SSE-C or Vulnerable Signature Versions		AWS S3 Object Encryption with SSE-C or Vulnerable Signature Versions
AWS SES Email Enumeration		AWS SES Email Enumeration
AWS SNS Subscription to External HTTP \| HTTPS Endpoint		AWS SNS Subscription to External HTTP \| HTTPS Endpoint
AWS SSM Parameter Bulk Get \| Describe Parameters		AWS SSM Parameter Bulk Get \| Describe Parameters
Agentic Access to Entra ID		Agentic Access to Entra ID
Axios NPM Supply Chain C2 Network Detection		Axios NPM Supply Chain C2 Network Detection
Axios NPM Supply Chain Malicious RAT File Artifact Detection		Axios NPM Supply Chain Malicious RAT File Artifact Detection
Axios NPM Supply Chain Malicious postinstall Script Execution		Axios NPM Supply Chain Malicious postinstall Script Execution
Azure Blob Anonymous Access		Azure Blob Anonymous Access
Azure Blob SAS Access		Azure Blob SAS Access
Azure Blob Storage Account Key Access		Azure Blob Storage Account Key Access
Azure Device Code OAuth Consent		Azure Device Code OAuth Consent
Azure Identity Pivoting Across Multiple Resource Types		Azure Identity Pivoting Across Multiple Resource Types
Azure Impossible Travel		Azure Impossible Travel
Azure Managed Identity Lateral Movement		Azure Managed Identity Lateral Movement
Azure Suspicious Extension Installed on VM		Azure Suspicious Extension Installed on VM
Azure Suspicious Redirect URI Detection		Azure Suspicious Redirect URI Detection
Azure VM RUNCOMMAND execution		Azure VM RUNCOMMAND execution
Azure VM RunCommand Activity		Azure VM RunCommand Activity
Box External File Sharing & Collaboration Detection		Box External File Sharing & Collaboration Detection
Box SaaS Suspicious File Download Detection		Box SaaS Suspicious File Download Detection
Box SaaS Suspicious File Upload Detection		Box SaaS Suspicious File Upload Detection
COLDDRIVER Bitsadmin download		COLDDRIVER Bitsadmin download
COLDDRIVER NOROBOT Malicious DLL Execution		COLDDRIVER NOROBOT Malicious DLL Execution
Chrysalis Backdoor Network IOC Detection		Chrysalis Backdoor Network IOC Detection
Chrysalis Backdoor SHA256 Hash Detection		Chrysalis Backdoor SHA256 Hash Detection
ClearFake SyncAppvPublishingServer ClickFix Campaign		ClearFake SyncAppvPublishingServer ClickFix Campaign
ClickFix		ClickFix
Clickfix Explorer Spawns Headless Conhost Attack Chain		Clickfix Explorer Spawns Headless Conhost Attack Chain
CrashFix Finger LOLBIN abuse with C2 communication		CrashFix Finger LOLBIN abuse with C2 communication
CrashFix Obfuscated PowerShell Payload Download Detection		CrashFix Obfuscated PowerShell Payload Download Detection
DarkSpectre Zoom Stealer Extension		DarkSpectre Zoom Stealer Extension
Entra ID Guest User Invited from External Domain		Entra ID Guest User Invited from External Domain
EvilToken Malicious IP Detection with CMSI Session Replay Signal		EvilToken Malicious IP Detection with CMSI Session Replay Signal
Excessive OneDrive - SharePoint File Sync Detection		Excessive OneDrive - SharePoint File Sync Detection
External MS Teams Phishing		External MS Teams Phishing
FIlefix		FIlefix
Fake ClawdBot Network Communication		Fake ClawdBot Network Communication
Fake ClawdBot ScreenConnect Deployment Correlation		Fake ClawdBot ScreenConnect Deployment Correlation
Fake ClawdBot VS Code Extension Malware		Fake ClawdBot VS Code Extension Malware
Gentlemen Ransomware Registry Modification For Evasion		Gentlemen Ransomware Registry Modification For Evasion
GoBruteforcer Process Name Masquerading		GoBruteforcer Process Name Masquerading
Google Drive Credential Harvesting Detection		Google Drive Credential Harvesting Detection
Google Workspace Domain-Wide Delegation Abuse		Google Workspace Domain-Wide Delegation Abuse
Google Workspace External Email Forwarding		Google Workspace External Email Forwarding
Google Workspace Trusted OAuth App Manipulation		Google Workspace Trusted OAuth App Manipulation
Graphrunner Detection Using Default User Agent Strings		Graphrunner Detection Using Default User Agent Strings
High S3 Object Deletion Count		High S3 Object Deletion Count
Identifying code scanning tools looking for AWS creds		Identifying code scanning tools looking for AWS creds
Kali365 Device Code Phishing Domain Detection		Kali365 Device Code Phishing Domain Detection
Kali365 PHaaS Device Code Phishing		Kali365 PHaaS Device Code Phishing
Kali365 PHaaS Malicious SaaS User Agent Detection		Kali365 PHaaS Malicious SaaS User Agent Detection
Kubectl EXEC shell spawned in container		Kubectl EXEC shell spawned in container
Kubernetes Malicious DaemonSet Creation		Kubernetes Malicious DaemonSet Creation
Kubernetes Secrets Exfiltration		Kubernetes Secrets Exfiltration
Kubernetes Service Account Token Theft		Kubernetes Service Account Token Theft
M365 Malicious Mailbox Rule Abuse		M365 Malicious Mailbox Rule Abuse
MAESTRO VMware VMCI Device Disabling		MAESTRO VMware VMCI Device Disabling
Malicious Skype Federation Contact in Microsoft Teams		Malicious Skype Federation Contact in Microsoft Teams
Mass Azure blob downloads		Mass Azure blob downloads
MicroStealer NSIS Electron Java Chain		MicroStealer NSIS Electron Java Chain
MicroStealer Network IOCs		MicroStealer Network IOCs
Microsoft Graph Security Alerts		Microsoft Graph Security Alerts
Microsoft Teams App Catalog Publication & Update Detection		Microsoft Teams App Catalog Publication & Update Detection
Microsoft Teams Chat & Message Export via Graph API		Microsoft Teams Chat & Message Export via Graph API
Microsoft Teams External Link Phishing Detection		Microsoft Teams External Link Phishing Detection
Microsoft Teams External Vishing & Impersonation Detection		Microsoft Teams External Vishing & Impersonation Detection
Microsoft Teams Suspicious App Installation & Bot Abuse		Microsoft Teams Suspicious App Installation & Bot Abuse
Monsterv2 C2 Detection From The Clickfix Campaign		Monsterv2 C2 Detection From The Clickfix Campaign
Mythic C2 SMB Beaconing		Mythic C2 SMB Beaconing
NPM Malicious package download		NPM Malicious package download
Notepad++ GUP.exe Update Process Hijacking		Notepad++ GUP.exe Update Process Hijacking
Okta Group & Application Membership Changes		Okta Group & Application Membership Changes
Okta Impossible Travel Detection		Okta Impossible Travel Detection
Okta MFA Factor Enrollment & Deactivation		Okta MFA Factor Enrollment & Deactivation
Okta MFA Push Bombing - Fatigue		Okta MFA Push Bombing - Fatigue
Okta Sensitive OAuth Activity Detection		Okta Sensitive OAuth Activity Detection
PHALT BLYX Startup URL Persistence		PHALT BLYX Startup URL Persistence
Phishing		Phishing
Potential S3 Bucket Exfiltration		Potential S3 Bucket Exfiltration
Power Automate External Connector Creation		Power Automate External Connector Creation
Power Automate Suspicious Flow Creation with Malicious Connector		Power Automate Suspicious Flow Creation with Malicious Connector
Power Automate Suspicious Flow Permission Changes		Power Automate Suspicious Flow Permission Changes
Qilin Ransomware: Enabling WDIGEST from custom .bat file		Qilin Ransomware: Enabling WDIGEST from custom .bat file
README.md		README.md
RMM connections to public IPs		RMM connections to public IPs
React2Shell Exploitation Indicators		React2Shell Exploitation Indicators
S3 Bucket Logging Deletion		S3 Bucket Logging Deletion
Scattered Spider - Muddled Libra Tunneling Tool DNS Detection		Scattered Spider - Muddled Libra Tunneling Tool DNS Detection
Service Account RDP Abuse		Service Account RDP Abuse
SleepyDuck Malware Etherhiding Persistence		SleepyDuck Malware Etherhiding Persistence
Storm-2561 - Fake VPN DLL Sideloading and RunOnce Persistence		Storm-2561 - Fake VPN DLL Sideloading and RunOnce Persistence

Folders and files

Latest commit

History

Repository files navigation

Cortex-XQL-Queries

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Packages