KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#typescript #ai-agents #developer-tools #cli #codex #claude-code #react #dsh-plugin #mcp #open-source #dsh #deepseek-harness

Defender-KQL-Playbook

★ 9 Open GitHub ↗

KQL playbook for Microsoft Defender focused on real-world threat hunting, behavioral analysis, and investigation workflows.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# 🔍 KQL Playbook Deep Dive

This project is actively being refined and updated based on testing and real-world use.

## 🛡️ KQL Security Playbook

This repository contains a structured KQL playbook for Microsoft Defender and Entra environments.

## 🎯 Purpose

This repository is intended to provide a **practical, repeatable, and structured KQL playbook** for Microsoft Defender hunting and investigation workflows.

It is designed to help defenders:

- Hunt for suspicious activity
- Validate security controls
- Investigate known behaviors
- Accelerate triage and response
- Build repeatable Defender hunting workflows
  
---

## 📦 Versions

### 🥇 v2.0 — Zero Trust KQL Playbook (Latest)
- Identity + Device + Network
- Zero Trust aligned detection
👉 [View Playbook](./v2.0/zero-trust-playbook.md)

---

### v1.0 — Defender KQL Playbook
- Endpoint-focused hunting and investigation
👉 [View Playbook](./v1.0/defender-playbook.md)

---

## 🛡️ Zero Trust Alignment

This playbook is structured around Zero Trust principles:

- 🔐 Identity — authentication, access, and session security  
- 💻 Device — endpoint behavior and telemetry  
- 🌐 Network — communication and external connections

Each section provides KQL queries and investigation workflows aligned to these pillars.

## 🛡️ Zero Trust Model

This represents the pillars of Microsoft Zero Trust.  
As identity threats evolve, A.I. should also be considered an emerging pillar for detection and response.

![Zero Trust Diagram](https://raw.githubusercontent.com/dferrell30/Defender-KQL-Playbook/main/images/ZeroTrustSecurityFrameworkInfographic.png)

---

## 🎯 Detection Strategy

Zero Trust detection is built by correlating signals across:

- 🔐 Identity → who is accessing  
- 💻 Device → where activity is happening  
- 🌐 Network → how communication occurs

High-confidence detections occur when signals align across multiple pillars.
  
---

## 🚨 Problem Statement

Many Defender KQL repositories are simply large lists of raw queries.

While useful, that approach often leaves out critical context:

- What the query is looking for
- Why the behavior matters
- When to run it
- What “normal” vs “suspicious” looks like
- What to do next if results are returned

👉 The gap:

Security teams often have queries, but not a **usable hunting playbook**

This repository is meant to close that gap by providing **organized, documented, investigation-ready KQL content**

---

## 🧠 What This Playbook Solves

This playbook helps answer questions like:

- **What query should I run for this scenario?**
- **How should I interpret the results?**
- **Which tables are relevant in Defender?**
- **What suspicious activity should I prioritize?**
- **How do I use KQL more like an investigation workflow instead of a query list?**

---

## 🧱 Scope

This playbook is focused on **Microsoft Defender XDR / Microsoft Defender for Endpoint hunting scenarios**, including:

- Endpoint execution activity
- PowerShell behavior
- Suspicious process chains
- Persistence indicators
- Defense evasion patterns
- Authentication and identity-related signals
- Post-exploitation investigation workflows

---
  
## 📘 Full Playbook

👉 [View Full KQL Playbook](./docs/KQL_Playbook_DeepDive.md)

## Related Project
For validation and testing scenarios, see my [MDE Test Framework](https://github.com/yourname/MDE-Test-Framework)

## 🔄 Investigation Flow

Process → Network → Logon → Alerts → Identity

---

## ⚠️ Disclaimer

This tool is provided for **educational, testing, and security validation purposes only**.

Use of this tool should be limited to:
- Authorized environments  
- Lab or approved enterprise systems

The author assumes **no liability or responsibility** for:
- Misuse of this tool  
- Damage to systems  
- Unauthorized or improper use

By using this tool, you agree to use it in a lawful and responsible manner.
---

This project is not affiliated with or endorsed by Microsoft.
---

## ⚖️ Professional Disclaimer

This project is an independent work developed in a personal capacity.

The views, opinions, code, and content expressed in this repository are solely my own and do not reflect the views, policies, or positions of any current or future employer, client, or affiliated organization.

No employer, past, present, or future, has reviewed, approved, endorsed, or is in any way associated with these works.

This project was developed outside the scope of any employment and without the use of proprietary, confidential, or restricted resources.

All code/language in this repository is provided under the terms of the included MIT License.

Defender-KQL-Playbook

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README