Thread by @BertJanCyber

New #KQL queries.

1. Detect Executable Files in C:\Users\Public*
2. ASR Executable Office Content
3. Hunt for AsyncRAT Initial Access
4. C2 IP Intel Feed
5. C2 Domain Intel Feed

For queries see below! Happy hunting! 🏹

#MDE #Sentinel
github.com/Bert-JanP/Hunt…

1. Based on the tweet from @malmoeb and research from @Mandiant, identify rare executables in the C:\Users\Public\* folders.

github.com/Bert-JanP/Hunt…

2. github.com/Bert-JanP/Hunt…

3. github.com/Bert-JanP/Hunt…
Lastly two C2 feeds from @drb_ra:
4. github.com/Bert-JanP/Hunt…
5.