u/iawais

I put together a collection of practical threat hunting and detection queries for:

• Microsoft Defender XDR (KQL)

The queries focus on real-world behaviors: LOLBins, suspicious process chains, persistence, credential access, lateral movement, C2 patterns, and some APT-style activity. Most are mapped to MITRE ATT&CK techniques and include short comments + tunable parameters.

Actively adding queries based on recent threat intel and campaigns. Feedback, suggestions for missing coverage, or contributions are very welcome.

Repo: Threat-Hunting/KQL at main · a2awais/Threat-Hunting

A few months ago I shared ThreatNexus here and got genuinely useful pushback; things that looked nice but weren't useful for daily hunting work. A lot of that feedback is still in the backlog, but I put real effort into closing the highest-value gaps for this round.

What's different in v2:

Data quality: Tightened accuracy across campaigns, TTPs, malware, and actor relationships.

Threat Landscape view: New high-level overview built for managers and decision-makers, not just analysts. See who's actively targeting your industry so you can prioritize detections, hunts, and patching by actual exposure instead of guesswork.

Live feed + digest: Pulls from a wide set of vendor research, news, and government/CERT sources, then summarizes it into a digest so you're not wading through raw RSS to find what matters.

The "so what" layer: Intel without a "so what" is just news. Every group/TTP links toward something actionable: detection engineering and hunting. TTPs to SIGMA rule lead, and the Hunt view is where I'm building out my own hunting queries alongside curated links to trusted community repos.

The goal this round was making the platform useful across all three levels analysts actually work in; strategic context, the operational picture (active campaigns, infra), and tactical detail (TTPs, IOCs) rather than just looking good in a screen.

It's still rough in places; coverage is thinner than the commercial platforms, I'd rather be upfront about that than oversell it.

url: https://threatnexus.online

If you've got few minutes, I'd really value a second look; especially anything that feels like noise vs. signal, and whether the strategic/operational/tactical split actually holds up in practice.

If you track a group I'm missing, or have campaign/TTP data you're willing to share, send it over, I'll get it ingested and you'll get a clear shout-out for the contribution. Most of what's good about this came from people in this sub the first time around, so consider this a thank-you and an open invite for round two.