KQL catalog

Query examples with source attribution.

Practical KQL examples adapted from the public KQLMSPress repository and placed into Sentinel, Defender XDR, Intune, threat intelligence, and operational workflows. These are not a mirror of the source repository; each query is classified, attributed, and tied to site tables and capabilities.

8 adapted queries5 indexed source areas

Imported Query Records

Detect file modification bursts by process

Summarize high-volume file create/modify activity by device, account, and initiating process as a ransomware-style triage signal.

detection candidate

advancedendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceFileEvents
License context: Microsoft Defender for Endpoint P2

Placeholders

Name	Default	Use
`lookback`	2h	Short time window for burst detection.
`minimum_events`	200	Minimum file operations by the same initiating process.

kql

let lookback = {lookback};
let minimumEvents = {minimum_events};
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| summarize FileEvents=count(), Extensions=make_set(tolower(extract(@"\.([^.\\]+)$", 1, FolderPath)), 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileEvents >= minimumEvents
| order by FileEvents desc

Tuning notes

Baseline backup, indexing, and software update tools before alerting.
Pair with DeviceProcessEvents and DeviceNetworkEvents for lineage and external connection context.

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from ransomware TTP themes into a generic file-burst query for modeled MDE tables.

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template

advancedthreat-intelligenceendpoint

Run surface: Sentinel Logs
Required tables: ThreatIntelIndicators DeviceNetworkEvents
License context: Microsoft Defender for Endpoint P2

Placeholders

Name	Default	Use
`lookback`	7d	Endpoint network event window.

kql

let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Tuning notes

Prefer current, active, higher-confidence indicators; expire stale indicators before relying on matches.
Add allowlist logic for internal scanners, proxy infrastructure, and known security services.

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.

Pivot from suspicious email to URL clicks

Find delivered inbound messages from a suspicious sender domain, join URL metadata, then pivot into user click activity.

template

intermediatephishinguser-compromise

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents EmailUrlInfo UrlClickEvents
License context: Microsoft Defender for Office 365 Plan 2

Placeholders

Name	Default	Use
`lookback`	7d	Time window for message and click activity.
`sender_domain`	Tenant-specific	Suspicious sender domain to investigate.

kql

let lookback = {lookback};
let senderDomain = "{sender_domain}";
let suspiciousMessages = EmailEvents
| where Timestamp > ago(lookback)
| where EmailDirection == "Inbound"
| where SenderFromDomain =~ senderDomain
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes;
suspiciousMessages
| join kind=leftouter (
    EmailUrlInfo
    | project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| join kind=leftouter (
    UrlClickEvents
    | where Timestamp > ago(lookback)
    | project ClickTimestamp=Timestamp, NetworkMessageId, AccountUpn, Url, ActionType, IsClickedThrough, ThreatTypes
) on NetworkMessageId, Url
| order by Timestamp desc, ClickTimestamp desc

Tuning notes

Replace sender_domain with the tenant-specific domain under investigation.
Use DeliveryAction and IsClickedThrough to separate blocked mail from messages that reached users.

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing investigation themes with tenant-specific placeholders and current MDO table names.

Review Intune policy changes by operator

Summarize Intune audit activity by operation, identity, and result to spot policy edits, assignment changes, and deletions.

template

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneAuditLogs
License context: Microsoft Defender for Endpoint P2

Placeholders

Name	Default	Use
`lookback`	7d	Time window for Intune administrative changes.

kql

IntuneAuditLogs
| where TimeGenerated > ago({lookback})
| where OperationName has_any ("Create", "Update", "Delete", "Assign")
| summarize Events=count(), Failures=countif(ResultType !in ("Success", "Succeeded")), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by OperationName, Identity, ResultType
| order by LastSeen desc

Tuning notes

Add known change windows and deployment accounts before using as an alert.
Use Properties parsing for deeper object-specific reviews when needed.

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from Intune operational diagnostics themes for existing IntuneAuditLogs coverage.

Review suspicious PowerShell process launches

Find PowerShell process executions with common download, encoded-command, hidden-window, or bypass indicators.

detection candidate

intermediateendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceProcessEvents
License context: Microsoft Defender for Endpoint P2

Placeholders

Name	Default	Use
`lookback`	24h	Time window for process activity.

kql

let lookback = {lookback};
let suspiciousTerms = dynamic(["-enc", "encodedcommand", "downloadstring", "invoke-webrequest", "iex", "-w hidden", "bypass"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousTerms)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountUpn, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Tuning notes

Tune for software deployment tools, device-management scripts, and known administrative automation.
For analytics rules, add entity mappings for DeviceName, AccountUpn, SHA256, and ProcessCommandLine.

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from endpoint and ransomware hunting themes with common PowerShell indicators.

Summarize inbound email authentication failures

Parse EmailEvents authentication details to summarize SPF, DKIM, DMARC, and composite authentication outcomes by sender domain.

template

intermediatephishing

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents
License context: Microsoft Defender for Office 365 Plan 2

Placeholders

Name	Default	Use
`lookback`	7d	Time window for inbound mail review.

kql

EmailEvents
| where Timestamp > ago({lookback})
| where EmailDirection == "Inbound"
| extend Auth = parse_json(AuthenticationDetails)
| extend SPF=tostring(Auth.SPF), DKIM=tostring(Auth.DKIM), DMARC=tostring(Auth.DMARC), CompAuth=tostring(Auth.CompAuth)
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 5) by SenderFromDomain, SPF, DKIM, DMARC, CompAuth, DeliveryAction
| order by Messages desc

Tuning notes

AuthenticationDetails is dynamic JSON; validate exact field casing in your tenant before using this in a rule.
Treat this as triage and reporting until sender allowlists, known vendors, and bulk senders are tuned.

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing and Microsoft 365 compromise themes; converted to a generalized authentication summary.

Track Sentinel incident volume and ownership

Summarize Sentinel incidents by severity, status, owner, and day for SOC handoff and workbook reporting.

workbook dashboard

beginnersentinel-operationsoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: SecurityIncident

Placeholders

Name	Default	Use
`lookback`	30d	Incident reporting window.

kql

SecurityIncident
| where TimeGenerated > ago({lookback})
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by bin(TimeGenerated, 1d), Severity, Status, Owner
| order by TimeGenerated desc, Incidents desc

Tuning notes

Use dcount(IncidentNumber) because incident updates can create multiple rows.
Pair with SecurityAlert for alert-to-incident conversion and alert-noise analysis.

Source: KQLMSPress/definitive-guide-kql Chapter 2: Data Aggregation/Query Samples. Adapted from aggregation and operational dashboard patterns for Sentinel incident operations.

Trend Intune operational failures

Chart Intune operational failures by operation and category to troubleshoot device-management service issues.

workbook dashboard

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneOperationalLogs
License context: Microsoft Defender for Endpoint P2

Placeholders

Name	Default	Use
`lookback`	24h	Time window for troubleshooting.

kql

IntuneOperationalLogs
| where TimeGenerated > ago({lookback})
| summarize Events=count(), Failures=countif(Result !in ("Success", "Succeeded")) by bin(TimeGenerated, 1h), OperationName, Category
| where Failures > 0
| order by TimeGenerated desc

Tuning notes

Use this as a workbook panel or daily health query rather than a standalone detection.
Scope to critical OperationName values once normal operational noise is known.

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from operational excellence and Intune diagnostic query themes.