Skip to content

Library Cheat sheet

/

GitHub

0 queries by ATT&CK tactic and technique. Pick a cell to filter.

Table Runs in Tested in CI only

Queries0123+

All queries

KQL cheat sheet

Tested queries come from identity-threat-detections. CI replays each one against attack and benign log fixtures in the Azure Data Explorer emulator on every push. Hunting queries are written by hand and are not tested in CI.

Built by Tomi Olaiya. MIT licensed. MITRE ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation.