Utilities

Utility Hunting Queries

Clicking on the name of the query will bring you to the file for it in this git repo.

Or try them out right away in your M365 Security tenant:

Click on the '🔎' hotlink to plug the query right into your Advanced Hunting Query page

🔎 AppLocker Policy Assistant

• Identify top folder sub-paths that currently execute programs
• Useful for building your AppLocker policy

🔎 Device IP History

• Enter the hostname of a device and get a list of all IP addresses that device has used in the last 30 days
• Summarizes the following data for each IP the device held:
  • First seen timestamp
  • Last seen timestamp
  • Total connections
  • Outgoing connections
  • Incoming connections
  • List of peers

🔎 Identity Correlation

• Enter any number or combination of the following fields:
  • Hostname
  • Username
  • EmailAddress
  • SID
  • AzureAccountID
• Query will fill in the fields you don't know for each unique identity and fetch each person's Job Title
• Only needs minimum of 1 value for any 1 field

🔎 Top Apps Crashing

• Finds alls apps that have crashed in the last 7 days and sorts them by total number of crashes
• Includes total number of devices with crashes
• Includes list of devices for each app along with:
  • number of crashes on that device
  • last crash timestamp

🔎 Uncommon TLDs

• First query identifies the number of network connections to every TLD published by the IANA
• Second query is used to investigate individual connections to individual TLDs
• You can use this data to block entire TLDs with Windows Firewall in endpoint.microsoft.com
• Uncommon TLDs are often used in phishing attacks, malvertizing, and malicious redirects