Hunting Queries
Queries shared between ProPera Online and Sentinel. Run them in the Advanced Hunting workspace.
๐ค AI Hunting Assistant
Ask for help building a Sentinel / Defender hunting query in plain English - e.g. "sign-ins from unusual countries to privileged accounts this week".
Encoded PowerShell Execution
hunt
Detect encoded PowerShell command lines.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('powershell.exe','pwsh.exe')
| where ProcessCommandLine contains '-enc' or ProcessCommandLine contains '-e '
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
LSASS Access
hunt
Detect credential dumping via LSASS access.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ('lsass','sekurlsa','mimikatz')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
SMB Lateral Movement
hunt
Detect SMB admin share connections.
DeviceNetworkEvents | where Timestamp > ago(7d) | where RemotePort == 445 | summarize count() by DeviceName, RemoteIP | order by count_ desc
New Scheduled Tasks
detection
Detect recently created scheduled tasks.
DeviceEvents | where Timestamp > ago(7d) | where ActionType == 'ScheduledTaskCreated' | project Timestamp, DeviceName, FileName, AdditionalFields
Top Processes
hunt
Daily process activity summary.
DeviceProcessEvents | where Timestamp > ago(24h) | summarize count() by FileName | order by count_ desc
