Skip to content

ZCyF3r/Cortex-XQL-Queries

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

679 Commits
*AWS Organizations Root Assumption via sts:AssumeRoot
*AWS Organizations Root Assumption via sts:AssumeRoot
 
 
AS-REP Roasting Activity
AS-REP Roasting Activity
 
 
AWS Console Brute Force Activity
AWS Console Brute Force Activity
 
 
AWS EC2 GPU | Large Instance Launch Detection
AWS EC2 GPU | Large Instance Launch Detection
 
 
AWS EC2 GetPasswordData Detection
AWS EC2 GetPasswordData Detection
 
 
AWS EC2 Security Group Modification ports 22|3389 to the Internet
AWS EC2 Security Group Modification ports 22|3389 to the Internet
 
 
AWS GuardDuty | CloudTrail Defense Evasion
AWS GuardDuty | CloudTrail Defense Evasion
 
 
AWS IAM Trust Policy Backdoor via UpdateAssumeRolePolicy
AWS IAM Trust Policy Backdoor via UpdateAssumeRolePolicy
 
 
AWS KMS Key Deletion Scheduled
AWS KMS Key Deletion Scheduled
 
 
AWS New SAML|OIDC Identity Provider Added
AWS New SAML|OIDC Identity Provider Added
 
 
AWS Region Enablement
AWS Region Enablement
 
 
AWS S3 Object Encryption with SSE-C or Vulnerable Signature Versions
AWS S3 Object Encryption with SSE-C or Vulnerable Signature Versions
 
 
AWS SES Email Enumeration
AWS SES Email Enumeration
 
 
AWS SNS Subscription to External HTTP | HTTPS Endpoint
AWS SNS Subscription to External HTTP | HTTPS Endpoint
 
 
AWS SSM Parameter Bulk Get | Describe Parameters
AWS SSM Parameter Bulk Get | Describe Parameters
 
 
Agentic Access to Entra ID
Agentic Access to Entra ID
 
 
Axios NPM Supply Chain C2 Network Detection
Axios NPM Supply Chain C2 Network Detection
 
 
Axios NPM Supply Chain Malicious RAT File Artifact Detection
Axios NPM Supply Chain Malicious RAT File Artifact Detection
 
 
Axios NPM Supply Chain Malicious postinstall Script Execution
Axios NPM Supply Chain Malicious postinstall Script Execution
 
 
Azure App Service Configuration & Secret Access
Azure App Service Configuration & Secret Access
 
 
Azure App Service Deployment & Code Modification
Azure App Service Deployment & Code Modification
 
 
Azure App Service Network Tunneling & Service Disruption
Azure App Service Network Tunneling & Service Disruption
 
 
Azure App Service Publishing Profile Access
Azure App Service Publishing Profile Access
 
 
Azure Blob Anonymous Access
Azure Blob Anonymous Access
 
 
Azure Blob SAS Access
Azure Blob SAS Access
 
 
Azure Blob Storage Account Key Access
Azure Blob Storage Account Key Access
 
 
Azure Device Code OAuth Consent
Azure Device Code OAuth Consent
 
 
Azure Identity Pivoting Across Multiple Resource Types
Azure Identity Pivoting Across Multiple Resource Types
 
 
Azure Impossible Travel
Azure Impossible Travel
 
 
Azure Managed Identity Lateral Movement
Azure Managed Identity Lateral Movement
 
 
Azure Suspicious Extension Installed on VM
Azure Suspicious Extension Installed on VM
 
 
Azure Suspicious Redirect URI Detection
Azure Suspicious Redirect URI Detection
 
 
Azure VM RUNCOMMAND execution
Azure VM RUNCOMMAND execution
 
 
Azure VM RunCommand Activity
Azure VM RunCommand Activity
 
 
BlackFile\Cordial Spider M365 Employee Directory Enumeration via Graph API and SCIM
BlackFile\Cordial Spider M365 Employee Directory Enumeration via Graph API and SCIM
 
 
BlackFile\UNC6671\Cordial Spider High Volume M365 Cross Service Operations
BlackFile\UNC6671\Cordial Spider High Volume M365 Cross Service Operations
 
 
BlackFile\UNC6671\Cordial Spider MFA Enrollment & Device Registration via Proxy
BlackFile\UNC6671\Cordial Spider MFA Enrollment & Device Registration via Proxy
 
 
BlackFile\UNC6671\Cordial Spider OAuth App Consent & Service Principal Persistence
BlackFile\UNC6671\Cordial Spider OAuth App Consent & Service Principal Persistence
 
 
BlackFile\UNC6671\Cordial Spider SharePoint & OneDrive Automation Data Exfil
BlackFile\UNC6671\Cordial Spider SharePoint & OneDrive Automation Data Exfil
 
 
Box External File Sharing & Collaboration Detection
Box External File Sharing & Collaboration Detection
 
 
Box SaaS Suspicious File Download Detection
Box SaaS Suspicious File Download Detection
 
 
Box SaaS Suspicious File Upload Detection
Box SaaS Suspicious File Upload Detection
 
 
COLDDRIVER Bitsadmin download
COLDDRIVER Bitsadmin download
 
 
COLDDRIVER NOROBOT Malicious DLL Execution
COLDDRIVER NOROBOT Malicious DLL Execution
 
 
Chrysalis Backdoor Network IOC Detection
Chrysalis Backdoor Network IOC Detection
 
 
Chrysalis Backdoor SHA256 Hash Detection
Chrysalis Backdoor SHA256 Hash Detection
 
 
ClearFake SyncAppvPublishingServer ClickFix Campaign
ClearFake SyncAppvPublishingServer ClickFix Campaign
 
 
ClickFix
ClickFix
 
 
Clickfix Explorer Spawns Headless Conhost Attack Chain
Clickfix Explorer Spawns Headless Conhost Attack Chain
 
 
CrashFix Finger LOLBIN abuse with C2 communication
CrashFix Finger LOLBIN abuse with C2 communication
 
 
CrashFix Obfuscated PowerShell Payload Download Detection
CrashFix Obfuscated PowerShell Payload Download Detection
 
 
DCSync Activity
DCSync Activity
 
 
DarkSpectre Zoom Stealer Extension
DarkSpectre Zoom Stealer Extension
 
 
Entra ID Guest User Invited from External Domain
Entra ID Guest User Invited from External Domain
 
 
EvilToken Malicious IP Detection with CMSI Session Replay Signal
EvilToken Malicious IP Detection with CMSI Session Replay Signal
 
 
Excessive OneDrive - SharePoint File Sync Detection
Excessive OneDrive - SharePoint File Sync Detection
 
 
FIlefix
FIlefix
 
 
Fake ClawdBot Network Communication
Fake ClawdBot Network Communication
 
 
Fake ClawdBot ScreenConnect Deployment Correlation
Fake ClawdBot ScreenConnect Deployment Correlation
 
 
Fake ClawdBot VS Code Extension Malware
Fake ClawdBot VS Code Extension Malware
 
 
GCP BigQuery Data Exfiltration
GCP BigQuery Data Exfiltration
 
 
GCP Dataflow Job Abuse
GCP Dataflow Job Abuse
 
 
GCP GCS Bucket Enumeration & Mass Download
GCP GCS Bucket Enumeration & Mass Download
 
 
GCP Service Account Creation & Key Generation
GCP Service Account Creation & Key Generation
 
 
GCP Service Account IAM Binding Manipulation
GCP Service Account IAM Binding Manipulation
 
 
GCP Service Account Impersonation via Token Generation
GCP Service Account Impersonation via Token Generation
 
 
General Suspicious Device Code Activity
General Suspicious Device Code Activity
 
 
Gentlemen Ransomware Registry Modification For Evasion
Gentlemen Ransomware Registry Modification For Evasion
 
 
GoBruteforcer Process Name Masquerading
GoBruteforcer Process Name Masquerading
 
 
Google Drive Credential Harvesting Detection
Google Drive Credential Harvesting Detection
 
 
Google Workspace Domain-Wide Delegation Abuse
Google Workspace Domain-Wide Delegation Abuse
 
 
Google Workspace External Email Forwarding
Google Workspace External Email Forwarding
 
 
Google Workspace Identity using a Security Investigation Tool
Google Workspace Identity using a Security Investigation Tool
 
 
Google Workspace Trusted OAuth App Manipulation
Google Workspace Trusted OAuth App Manipulation
 
 
Graphrunner Detection Using Default User Agent Strings
Graphrunner Detection Using Default User Agent Strings
 
 
High S3 Object Deletion Count
High S3 Object Deletion Count
 
 
Identifying code scanning tools looking for AWS creds
Identifying code scanning tools looking for AWS creds
 
 
Inbox Rule Notification Suppression
Inbox Rule Notification Suppression
 
 
Kali365 Device Code Phishing Domain Detection
Kali365 Device Code Phishing Domain Detection
 
 
Kali365 PHaaS Device Code Phishing
Kali365 PHaaS Device Code Phishing
 
 
Kali365 PHaaS Malicious SaaS User Agent Detection
Kali365 PHaaS Malicious SaaS User Agent Detection
 
 
Kerberoasting Activity (RC4 Service Ticket)
Kerberoasting Activity (RC4 Service Ticket)
 
 
Kerberos Delegation Abuse
Kerberos Delegation Abuse
 
 
Kubectl EXEC shell spawned in container
Kubectl EXEC shell spawned in container
 
 
Kubernetes Malicious DaemonSet Creation
Kubernetes Malicious DaemonSet Creation
 
 
Kubernetes Pod Exec & Port Forward
Kubernetes Pod Exec & Port Forward
 
 
Kubernetes Privileged Pod & Container Escape
Kubernetes Privileged Pod & Container Escape
 
 
Kubernetes RBAC & ClusterRole Privilege Escalation
Kubernetes RBAC & ClusterRole Privilege Escalation
 
 
Kubernetes Secrets Enumeration via API Server
Kubernetes Secrets Enumeration via API Server
 
 
Kubernetes Secrets Exfiltration
Kubernetes Secrets Exfiltration
 
 
Kubernetes Service Account Token Theft
Kubernetes Service Account Token Theft
 
 
Kubernetes Suspicious Namespace & Node Operations
Kubernetes Suspicious Namespace & Node Operations
 
 
M365 Malicious Mailbox Rule Abuse
M365 Malicious Mailbox Rule Abuse
 
 
MAESTRO VMware VMCI Device Disabling
MAESTRO VMware VMCI Device Disabling
 
 
Malicious Skype Federation Contact in Microsoft Teams
Malicious Skype Federation Contact in Microsoft Teams
 
 
Mass Azure blob downloads
Mass Azure blob downloads
 
 
MicroStealer NSIS Electron Java Chain
MicroStealer NSIS Electron Java Chain
 
 
MicroStealer Network IOCs
MicroStealer Network IOCs
 
 
Microsoft Graph Security Alerts for Cross Product Detection
Microsoft Graph Security Alerts for Cross Product Detection
 
 
Microsoft Teams App Catalog Publication & Update Detection
Microsoft Teams App Catalog Publication & Update Detection
 
 

Repository files navigation

Cortex-XQL-Queries

XQL queries based off threat intel, on-going campaigns, & cloud environments that can be used for detection engineering, threat hunting, or incident investigations

About

XQL Queries for Cortex XDR

Resources

Readme
Activity

Stars

8 stars

Watchers

1 watching

Forks

1 fork
Report repository

Releases

No releases published

Packages

 
 
 

Contributors