# benscha/KQLAdvancedHunting

<https://repo.masters-masters.com/en/repos/benscha/KQLAdvancedHunting>

[Home](https://repo.masters-masters.com/en) › [benscha](https://repo.masters-masters.com/en/owners/benscha) › [KQLAdvancedHunting](https://repo.masters-masters.com/en/repos/benscha/KQLAdvancedHunting)

benscha/KQLAdvancedHunting has 185 stars on GitHub. Its RepoMasters card: Prototype tier. Production-ready KQL queries for Microsoft Defender XDR and…

| Field | Value |
| --- | --- |
| Owner | [benscha](https://repo.masters-masters.com/en/owners/benscha) |
| Stars | 185 |
| Forks | 26 |
| Language | [PowerShell](https://repo.masters-masters.com/en/languages/powershell) |
| License | None |
| Created | 2024 |
| Topics | advanced-hunting, kql, kql-queries, kql-threathunting, logicapps, sentinel, blue-team, defender-xdr, detection-engineering, m365-defender |
| Tier | [Prototype (100 to 249 ★)](https://repo.masters-masters.com/en/ranks/rush) |
| View on GitHub | [benscha/KQLAdvancedHunting](https://github.com/benscha/KQLAdvancedHunting) |

## Repository

Production-ready KQL queries for Microsoft Defender XDR and Microsoft Sentinel. Focused on Threat Hunting, Detection Engineering, and MITRE ATT&CK mapping.

The tier for repos with 100 to 249 ★. Published odds per card pulled: 70%. Rarity: Common.

## Nearby in PowerShell

- [googleprojectzero/Hyntrospect · ★ 185 · PowerShell · Prototype](https://repo.masters-masters.com/en/repos/googleprojectzero/Hyntrospect)
- [kelexine/tiny11-automated · ★ 185 · PowerShell · Prototype](https://repo.masters-masters.com/en/repos/kelexine/tiny11-automated)
- [TigerBruce/lceda-operation-notes · ★ 185 · PowerShell · Prototype](https://repo.masters-masters.com/en/repos/TigerBruce/lceda-operation-notes)
- [mlocati/gettext-iconv-windows · ★ 185 · PowerShell · Prototype](https://repo.masters-masters.com/en/repos/mlocati/gettext-iconv-windows)
- [fbsamples/workplace-platform-samples · ★ 185 · PowerShell · Prototype](https://repo.masters-masters.com/en/repos/fbsamples/workplace-platform-samples)
- [pnp/sp-power-platform-solutions · ★ 185 · PowerShell · Prototype](https://repo.masters-masters.com/en/repos/pnp/sp-power-platform-solutions)

---
Data: GitHub · Illustration drawn by RepoMasters from the repo’s ID and its language color.