This repository contains detection and threat hunting queries created by NVISO’s CSIRT & SOC team. The queries are derived from handled incidents, threat hunts, trending threats, and other noteworthy activities observed in real-world investigations. While the queries currently focus on Microsoft Sentinel and Defender for Endpoint, the underlying platforms may change in the future. The primary goal is to share a core detection logic that you can fine tune or extend to your own unique environment.

The content can be used in any way you like, although a reference to @NVISO_Labs (X) or NVISOsecurity (GitHub) would be much appreciated.

Distributed under the MIT License. See LICENSE for more information.