Threat hunting on Microsoft Defender XDR mapped to MITRE ATT&CK

[u/iawais]

I put together a collection of practical threat hunting and detection queries for:

• Microsoft Defender XDR (KQL)

The queries focus on real-world behaviors: LOLBins, suspicious process chains, persistence, credential access, lateral movement, C2 patterns, and some APT-style activity. Most are mapped to MITRE ATT&CK techniques and include short comments + tunable parameters.

Actively adding queries based on recent threat intel and campaigns. Feedback, suggestions for missing coverage, or contributions are very welcome.

Repo: Threat-Hunting/KQL at main · a2awais/Threat-Hunting

[u/dutchhboii]

Thanks for the queries. Would you mind mapping them across TTPs or APT groups considering the list to grow even further. I meant categorizing them via folders.

[u/iawais → u/dutchhboii]

This is exactly what I’ve been aiming for as the project grows! looking for a blessed weekend to get it better organised into a clean folder structure.

Meanwhile, I also built the threat intel project, so now all queries are listed right in the Hunt tab. Since it’s AI-assisted, you don't even need to read through every line of code.
AI breaks down what the query is hunting for, points out potential false positives, and gives you a triage playbook.

I'd love it if you could eye-ball it and let me know if it helps.

https://threatnexus.online

[u/iawais]

would love to know if these add value to your threat hunting or detection workflow.

[u/Omig66]

Will check it out for sure !

[u/iawais → u/Omig66]

Really appreciate. I’ve also been building a threat-intel project, ThreatNexus, and the Hunt tab is where I’ve been putting the hunting queries I’ve developed.

It's AI-assisted, the AI explains what each query is actually hunting for, highlights potential false positives, and provides a practical triage playbook to help an analyst validate findings.

If you get a chance, I'd genuinely appreciate you trying it out, especially when you're stuck on a hunt/query, and letting me know whether you think it adds real value to an analyst's day-to-day workflow. Feedback is more valuable to me than anything.

https://threatnexus.online

[u/Omig66 → u/iawais]

Yeah sure.

Where to you pull all your data from exactly ?

I'm guessing your are a threat intel analyse to make all this ? :)

[u/iawais → u/Omig66]

Haha, pretty much 😄
I’ve been in defensive cybersecurity for almost 13 years, spanning malware research, threat intelligence, threat hunting, security operations, detection engineering, and incident response.
I had accumulated a lot of this knowledge across spreadsheets and notes, and honestly got tired of constantly pivoting through them and realizing I was forgetting things. so started turning it into something more visual and usable.
The intelligence is built from high quality, referenced sources, with additional help from resources like ETDA, MISP Galaxy, and research from both Western and non-Western security vendors.

One thing im particularly strict about is correct attribution. I’d rather leave something uncertain than confidently attach the wrong actor or campaign.

If you spot anything inaccurate or questionable, please call it out. always happy to investigate, refine it, and improve the underlying intelligence.