Steven Lim
@0x534c
Followers
2K
Following
189
Media
156
Statuses
247
#Cybersecurity #Sentinel #DefenderXDR #KQL #KQLWizard
Singapore
Joined May 2009
๐ก 300 KQLs on !!! ๐๐๐. ๐ A major milestone reaching the 300 series and a double-digit % contributor of this repository.๐งโโ๏ธ. #Cybersecurity #SlimKQL #KQLWizard
1
6
49
๐ต๏ธโโ๏ธ New Detection Drop "You enumerate. I correlate. You exfil. I alert." ๐ฅ. Just shipped a Sentinel KQL detection for NauthNRPC โ a stealthy RPC-based AD recon tool. ๐ Built to catch the quiet ones before they get loud.
0
8
46
๐ launched ~1.5 weeks ago and already hit: ๐ฅ 3K+ members ๐ก๏ธ 182+ detections (KQL, Sigma, YARA, Splunk, Elastic. ). Thatโs ~18 detections/day! ๐ฅ.Join the global defender community & contribute! . ๐ Use invite code: Slim2025. #DefenderUnite
2
11
91
Storm 1811 SE Attack Detection. 1: Email Bombing.2: Microsoft Teams Impersonation.3: Remote Access via Quick Assist.4: Deploy Black Basta ransomware .
0
14
88
๐จ #DEVMAN is a customized #ransomware variant of the #DragonForce RaaS. It's run by a threat actor that's already leaked data of 40 victims across Asia, Europe, LATAM, and Africa. Explore technical analysis from @MauroEldritch ๐.
0
6
21
Mail Bomb Mayhem? KQL to the Rescue. Spotted a mail bomb attack originating from 30+ sender IPs. Leveraged KQL to trace the source and identify the ISPs involved. Visibility matters.๐ก๏ธ.
0
8
47
SlimKQL Community Group. Hi all, I have migrated all my 338 KQLs from the GitHub Repo to SlimKQL Community Group. If you would like to get updates on my latest KQL detections, please do "FOLLOW" this community group. Thank you!. Steven ๐
1
6
48
Blind Eagle infrastructure exclusively leverages VBS files as its initial attack vector, relies heavily on free Dynamic DNS (DDNS) services, and deploys read RATs as a second-stage malware. KQL:.
0
3
23
๐ชฑLateral Movement Analysis KQL. Automatic Attack Disruption: A KQL query designed to provide statistics on the number of hosts and ports that the rogue quarantine device has connected to, supporting lateral movement investigation.
1
21
113
Unit42 - 500+ Phishing Domains Impersonating MS Login Pages. Adversary are leveraging over 500+ newly registered .shop domains, likely created via DGA to conduct phishing campaigns impersonating MS login pages. All-in-one scan:.
3
23
114
๐ฌ Detecting EXO Graph Enumeration Spot abnormal M365 reconnaissance via Exchange Online using ActorInfoString + ML-powered CloudAppEvents. Ideal for catching attackers probing with compromised accounts.
0
14
59
๐โ๏ธ - Successfully renewed!. PS: I do observed there are more questions on Security Copilot with Microsoft Sentinel . #Cybersecurity #MicrosoftCertification #SecurityOperations
0
0
14
When combined with machine learning analytics from CloudAppEvents, this enriched context helps surface uncommon or anomalous user activity, significantly boosting the accuracy of threat detection in Exchange Online.
1
0
0
Starting June, the introduction of ActorInfoString brings added transparency by capturing the True UserAgentโproviding deeper insight into the origin of actions within your Exchange Online environment.
1
0
1
Detect anomalous external OAuthApp activity using ๐ActorInfoString ๐ฅ. KQL Code:.
2
31
152
๐ฆ๐ฐ๐ฎ๐๐๐ฒ๐ฟ๐ฒ๐ฑ ๐ฆ๐ฝ๐ถ๐ฑ๐ฒ๐ฟ ๐ท๏ธ. According to Unit 42, the threat actor is now targeting aviation industry. Using the Unit 42 IOCs, I have crafted a DefenderXDR KQL to scan the MDE telemetry for the past 30 days. KQL code:.
3
15
117
Researchers at Securonix identified a sophisticated malware campaign named ๐ฆ๐๐ฅ๐ฃ๐๐ก๐ง๐๐ก๐#๐๐๐ข๐จ๐, which exploits ๐๐น๐ผ๐๐ฑ๐ณ๐น๐ฎ๐ฟ๐ฒ ๐ง๐๐ป๐ป๐ฒ๐น infrastructure to deliver Python-based malware to Windows systems.
1
8
25
๐ย is a growing hub for community-driven detection rulesโKQL, Sigma, YARA, Splunk & more. I've migrated across my 300+ KQL rules @SlimKQL and will continue sharing new ones. Catch them all here ๐ @KQLWizard ๐๐ฅย ย . Invitation Code: Slim2025
3
38
197