# Query Docs Documentation

> Product Documentation for Query.AI  Federated Search solution.

## Guides
- [Welcome to Query!](https://docs.query.ai/docs/introducing-query.md): Query is the simplest way to search your security data, wherever it is stored.
- [Product Architecture](https://docs.query.ai/docs/product-architecture.md)
- [Security & Privacy](https://docs.query.ai/docs/security-privacy.md): Query is a company that believes that its product should be "secure by design."  As such, the Product, Engineering, and Cybersecurity teams work closely to ensure security is considered at every turn of the development lifecycle.
- [Getting Started](https://docs.query.ai/docs/getting-started-1.md): Query Quick Start
- [Search Progress and Results](https://docs.query.ai/docs/search-progress-and-results.md)
- [Summary Insights (Federated Dashboards)](https://docs.query.ai/docs/summary-insights-federated-dashboards.md): Use Summary Insights' Federated Dashboards to analyze trends within your connected data sources
- [Searching in the Query UI](https://docs.query.ai/docs/searching-in-the-query-ui.md): Learn how to navigate the Query Federated Search results grid
- [Team Management](https://docs.query.ai/docs/team-management.md)
- [Connectors Overview](https://docs.query.ai/docs/connectors-overview.md)
- [Amazon CloudWatch Logs (for AWS WAFv2)](https://docs.query.ai/docs/amazon-cloudwatch-logs-for-aws-wafv2.md): Search AWS WAFv2 access logs stored in CloudWatch Logs Group
- [Lacework (FortiCNAPP)](https://docs.query.ai/docs/lacework-fortinet-forticnapp.md): Integrate Query with Lacework (Fortinent FortiCNAPP) to surface details on hosts, vulnerabilities, alerts, and query audit, file, and user log information.
- [Microsoft Graph API - Security](https://docs.query.ai/docs/microsoft-graph-security.md): Integrate Query with the Microsoft Graph Security API to retrieve all Alerts details from every Defender SKU!
- [Amazon Athena (for Amazon S3)](https://docs.query.ai/docs/federated-search-amazon-athena.md): Integrate Query with any data in Amazon S3 via Amazon Athena
- [Amazon Redshift](https://docs.query.ai/docs/amazon-redshift.md): Integrate Query with the Amazon Redshift date warehouse without writing any SQL!
- [Amazon Redshift Serverless](https://docs.query.ai/docs/amazon-redshift-serverless.md): Integrate Query with the Amazon Redshift Serverless data warehouse without writing any SQL!
- [Amazon Security Lake](https://docs.query.ai/docs/amazon-security-lake.md): Integrate Query with Amazon Security Lake AWS-managed and Custom Sources via Amazon Athena
- [Azure Data Explorer (ADX)](https://docs.query.ai/docs/azure-data-explorer.md): Integrate Query with any tables in Azure Data Explorer
- [ClickHouse Cloud](https://docs.query.ai/docs/clickhouse-cloud.md): Integrate Query with any table or view in ClickHouse Cloud
- [Databricks](https://docs.query.ai/docs/databricks.md): Integrate Query with the Databricks data intelligence / data lake house platform.
- [Google BigQuery](https://docs.query.ai/docs/google-bigquery.md): Integrate Query with Google Cloud Platform's (GCP's) BigQuery - the serverless data warehouse
- [Snowflake](https://docs.query.ai/docs/snowflake.md): Integrate Query with the Snowflake data intelligence platform.
- [Cyera](https://docs.query.ai/docs/cyera.md): Integrate Query with the Cyera Data Security Posture Management (DSPM) platform
- [GitHub Advanced Security (GHAS)](https://docs.query.ai/docs/github-advanced-security.md): Integrate Query with GitHub Advanced Security features such as Code Scanning, Secret Scanning, DependaBot, etc.
- [Ox Security](https://docs.query.ai/docs/ox-security-aspm.md): Integrate Query with the Ox Security Application Security Posture Management (ASPM) platform to retrieve details on applications and issues
- [Gmail Messages API](https://docs.query.ai/docs/google-workspace-gmail.md): Integrate with the Gmail Messages API to receive information on users and their email activity.
- [Microsoft Defender for Office 365](https://docs.query.ai/docs/ms-office-365.md): Use Query Federated Search to search for MDO alerts
- [Carbon Black Cloud](https://docs.query.ai/docs/carbon-black-cloud.md): Integrate Query Federated Security with Carbon Black Cloud to search about details on Alerts, Host Vulnerabilities, Process Events, Observations, and Machine Inventory
- [CrowdStrike Falcon API](https://docs.query.ai/docs/crowdstrike-falcon-connector.md): Integrate core CrowdStrike Falcon APIs into the Query Security Data Mesh to retrieve details about alerts, hosts, and incidents.
- [CrowdStrike Falcon Identity Protection](https://docs.query.ai/docs/crowdstrike-falcon-identity-protection.md): Integrate CrowdStrike Falcon Identity Protection with the Query Security Data Mesh to retrieve details about identity protection sensors and zero trust assessments.
- [CrowdStrike Falcon Spotlight](https://docs.query.ai/docs/crowdstrike-falcon-spotlight.md): Integrate CrowdStrike Falcon Spotlight vulnerability management into the Query Security Data Mesh to retrieve and analyze vulnerability data with AI-powered prioritization
- [Microsoft Defender for Endpoint](https://docs.query.ai/docs/ms-defender-endpoint.md): Integrate Query with Microsoft Defender for Endpoint (MDE) to retrieve machine and alert data.
- [SentinelOne Singularity Platform](https://docs.query.ai/docs/sentinelone.md): Integrate with the SentinelOne Singularity Platform capabilities
- [1Password](https://docs.query.ai/docs/1password-onepassword.md): Integrate Query with 1Password to surface details on Audit and Authentication events
- [Auth0](https://docs.query.ai/docs/auth0.md)
- [Google Workspace - Directory API](https://docs.query.ai/docs/google-workspace-directory-api.md): Integrate with the Google Workspace (formerly known as G-Suite) Directory API to receive information on users and their devices in your Google Workspace directory.
- [Microsoft Entra ID (Azure AD)](https://docs.query.ai/docs/azure-active-directory.md): Use Query Federated Search to surface details on Analyzed Emails, Audit Logs, Authentication (Logins), Devices, and Users.
- [Okta](https://docs.query.ai/docs/okta.md): Integrate Query with your Okta Identity Provider to retrieve User, Group, and Authentication records.
- [Push Security](https://docs.query.ai/docs/push-security.md): Integrate Query with Push Security to surface details on accounts, apps, browsers, detections, employees, and findings.
- [Armis Centrix](https://docs.query.ai/docs/armis-centrix.md): Integrate Query with Armis Centrix to retrieve details of devices, users, and vulnerabilities without needing to manage the Armis API or author any Armis Standard Query (ASQ) language!
- [ServiceNow (Table API)](https://docs.query.ai/docs/servicenow-connector.md): Integrate with and federate search to any ServiceNow Table using the Query Security Data Mesh Connector for ServiceNow
- [JAMF Pro](https://docs.query.ai/docs/jamf-pro.md): Integrate with JAMF Pro to retrieve data on Mobile Devices, Computers, and their patch states and logged in users.
- [Microsoft Intune](https://docs.query.ai/docs/microsoft-intune.md): Integrate Query Federated Security with Microsoft Intune MDM to retrieve Managed Device & Audit Event information.
- [Amazon OpenSearch Service](https://docs.query.ai/docs/amazon-opensearch-service.md): Integrate Query Federated Search with Amazon OpenSearch Service to parallelize searches across security-relevant data in any Index to support
- [Azure Log Analytics](https://docs.query.ai/docs/azure-log-analytics.md): Integrate with Azure Log Analytics Workspace tables to search them on demand without writing KQL.
- [Cribl Search](https://docs.query.ai/docs/cribl-search.md): Integrate with Cribl Search's federated search
- [CrowdStrike Falcon NextGen SIEM](https://docs.query.ai/docs/crowdstrike-falcon-logscale-humio.md): Integrate Query with any CrowdStrike Falcon NextGen SIEM (formerly known as Falcon LogScale and Humio) Repository
- [Datadog](https://docs.query.ai/docs/datadog.md)
- [Google Security Operations SIEM (Google Chronicle)](https://docs.query.ai/docs/google-secops-google-chronicle.md): Integrate your Google Security Operations SIEM (Google Chronicle) tenant with Query Federated Search to dispatch parallelized searches without needing to write any UDM, all results are returned in OCSF format.
- [Google Workspace - Reports API](https://docs.query.ai/docs/google-workspace-reports-api.md): Integrate with the Google Workspace (formerly known as G-Suite) Reports API to receive information on users and their devices in your Google Workspace directory.
- [Microsoft Sentinel (Azure Sentinel)](https://docs.query.ai/docs/microsoft-sentinel-azure-sentinel.md): Integrate with Microsoft Sentinel to retrieve Incidents generated by Analytics Rules and Defender XDR
- [Splunk Enterprise & Cloud](https://docs.query.ai/docs/splunk-enterprise.md)
- [AlienVault OTX](https://docs.query.ai/docs/alienvault.md)
- [CISA Known Exploited Vulnerabilities (KEV) Catalog](https://docs.query.ai/docs/cisa-known-exploited-vulnerabilities-kev-catalog.md): Integrate Query with the CISA KEV Catalog to automatically retrieve enriched vulnerability details of CVEs in the KEV by their CVE ID or CWE ID. The CVE data is further enriched by the Mitre AWG CVE API.
- [ip-api (Geolocation API)](https://docs.query.ai/docs/ip-api.md): Integrate Query with the ip-api Geolocation API to automatically retrieve geolocation, ASN, ISP, and hosting details about IPv4 and IPv6 Addresses.
- [MISP (Malware Information Sharing Project)](https://docs.query.ai/docs/misp-malware-information-sharing-project.md): Integrate Query with MISP to retrieve nearly any IOC and its associated metadata using the restSearch API with results normalized into OCSF
- [Shodan](https://docs.query.ai/docs/shodan.md)
- [Tégo](https://docs.query.ai/docs/tégo.md): Integrate with the Tégo Security Threat Feed API
- [VirusTotal](https://docs.query.ai/docs/virus-total.md)
- [WhoisXML API](https://docs.query.ai/docs/whoisxmlapi.md)
- [Query App for Splunk](https://docs.query.ai/docs/about-query-splunk-app.md): Query Security Mesh empowers Splunk users with more data from outside of Splunk
- [Splunk App Setup and Administration](https://docs.query.ai/docs/setup-and-administration.md): Installing and Configuring the Query App for Splunk
- [Running Federated Search from Splunk](https://docs.query.ai/docs/federated-search-from-splunk.md): How to Use the `| queryai` Command From Splunk
- [Running FSQL from Splunk](https://docs.query.ai/docs/running-fsql-from-splunk.md): How to Use the `| fsql` Command From Splunk
- [Running CoPilot from Splunk](https://docs.query.ai/docs/running-copilot-from-splunk.md)
- [Splunk App Quick Reference Guide](https://docs.query.ai/docs/splunk-app-quick-reference-guide.md): A Summary of Query Commands to Use From Splunk
- [Query Chrome Extension](https://docs.query.ai/docs/chrome-extension.md): Run federated search from any external web-console or web page
- [Configure Schema (classic)](https://docs.query.ai/docs/configure-schema.md): Learn how to use Query's no-code introspection and data mapping utility
- [Asset Information Agent](https://docs.query.ai/docs/asset-information-agent.md)
- [Detection Finding Triage Agent](https://docs.query.ai/docs/detection-finding-triage-agent.md)
- [File Hash Agent](https://docs.query.ai/docs/file-hash-agent.md)
- [Network Activity Agent](https://docs.query.ai/docs/network-activity-agent.md)
- [Threat Research Agent](https://docs.query.ai/docs/threat-research-agent.md)
- [Vulnerability Intelligence Agent](https://docs.query.ai/docs/vulnerability-management-agent.md)
- [Security Data Pipelines](https://docs.query.ai/docs/security-data-pipelines.md): Write data the right way, powered by Query Federated Search.
- [Destinations](https://docs.query.ai/docs/data-pipeline-destinations.md): Query Security Data Pipeline Destinations
- [Amazon S3 Destination](https://docs.query.ai/docs/amazon-s3-destination.md): Write data the right way into Amazon S3 buckets, powered by Query Security Data Pipelines.
- [Azure Blob Destination](https://docs.query.ai/docs/azure-blob-destination.md): Write data the right way into Azure Blob Containers/ADLSv2, powered by Query Security Data Pipelines.
- [Cribl Stream - HTTP Destination](https://docs.query.ai/docs/cribl-stream-http-destination.md): Write data the right way into Cribl Stream HTTP Sources, powered by Query Security Data Pipelines.
- [Google Cloud Storage (GCS) Destination](https://docs.query.ai/docs/google-cloud-storage-gcs-destination.md): Write data the right way into Google Cloud Storage buckets, powered by Query Security Data Pipelines.
- [Splunk HEC Destination](https://docs.query.ai/docs/splunk-hec-destination.md): Write data the right way into Splunk HTTP Event Collectors (HECs), powered by Query Security Data Pipelines.
- [Federated Detections](https://docs.query.ai/docs/federated-detections.md): Detect security threats across all your data sources in real-time without moving or duplicating data. Federated Detections provide automated monitoring, intelligent alerting, and rapid response capabilities.
- [Creating Detections](https://docs.query.ai/docs/creating-detections.md): This guide walks through creating and configuring detections with Query Federated Detections
- [Managing Detections](https://docs.query.ai/docs/managing-detections.md): This guide covers monitoring, maintaining, and troubleshooting detections in production.
- [Alert Destinations](https://docs.query.ai/docs/alert-destinations.md): Alert destinations define where detection alerts are sent when a detection triggers
- [Amazon SNS Destination Setup](https://docs.query.ai/docs/amazon-sns-destination-setup.md): Send detection alerts to Amazon SNS topics for flexible message routing using cross-account IAM role assumption.
- [Azure Sentinel Destination Setup](https://docs.query.ai/docs/azure-sentinel-destination-setup.md): Create incidents in Microsoft Sentinel for detection alerts using App Registration authentication.
- [Google Pub/Sub Destination Setup](https://docs.query.ai/docs/google-pubsub-destination-setup.md): Publish detection alerts to Google Cloud Pub/Sub topics for event-driven processing.
- [Google SecOps Destination Setup](https://docs.query.ai/docs/google-secops-destination-setup.md): Create cases with alerts in Google SecOps (formerly Chronicle SOAR/Siemplify) for detection alerts.
- [Jira Destination Setup](https://docs.query.ai/docs/jira-destination-setup.md): Create Jira issues for detection alerts using the Jira REST API.
- [Microsoft Teams Destination Setup](https://docs.query.ai/docs/microsoft-teams-destination-setup.md): Send detection alerts to Microsoft Teams channels with rich formatted messages using Adaptive Cards.
- [PagerDuty Destination Setup](https://docs.query.ai/docs/pagerduty-destination-setup.md): Send detection alerts to PagerDuty services for on-call notification and incident management using Events API v2.
- [ServiceNow Incidents Destination Setup](https://docs.query.ai/docs/servicenow-incidents-destination-setup.md): Create incidents in ServiceNow for detection alerts using the Table API.
- [Slack Destination Setup](https://docs.query.ai/docs/slack-destination-setup.md): Send detection alerts to Slack channels with rich formatted messages using Block Kit.
- [Tines Cases Destination Setup](https://docs.query.ai/docs/tines-cases-destination-setup.md): Create cases in Tines for detection alerts with automated case management.
- [Tines Webhook Destination Setup](https://docs.query.ai/docs/tines-webhook-destination-setup.md): Send detection alerts to Tines Story webhooks for automation workflows.
- [Webhook Destination Setup](https://docs.query.ai/docs/webhook-destination-setup.md): Send detection alerts to any HTTP endpoint via POST request with JSON payload.
- [About the Query Data Model](https://docs.query.ai/docs/about-the-query-data-model.md)
- [Events](https://docs.query.ai/docs/events.md)
- [Account Change](https://docs.query.ai/docs/event-account_change.md)
- [Admin Group Query](https://docs.query.ai/docs/event-admin_group_query.md)
- [API Activity](https://docs.query.ai/docs/event-api_activity.md)
- [Application Lifecycle](https://docs.query.ai/docs/event-application_lifecycle.md)
- [Authentication](https://docs.query.ai/docs/event-authentication.md)
- [Authorize Session](https://docs.query.ai/docs/event-authorize_session.md)
- [Base Event](https://docs.query.ai/docs/event-base_event.md)
- [Compliance Finding](https://docs.query.ai/docs/event-compliance_finding.md)
- [Device Config State](https://docs.query.ai/docs/event-config_state.md)
- [Data Security Finding](https://docs.query.ai/docs/event-data_security_finding.md)
- [Datastore Activity](https://docs.query.ai/docs/event-datastore_activity.md)
- [Detection Finding](https://docs.query.ai/docs/event-detection_finding.md)
- [Device Config State Change](https://docs.query.ai/docs/event-device_config_state_change.md)
- [DHCP Activity](https://docs.query.ai/docs/event-dhcp_activity.md)
- [DNS Activity](https://docs.query.ai/docs/event-dns_activity.md)
- [Email Activity](https://docs.query.ai/docs/event-email_activity.md)
- [Email File Activity](https://docs.query.ai/docs/event-email_file_activity.md)
- [Email URL Activity](https://docs.query.ai/docs/event-email_url_activity.md)
- [Entity Management](https://docs.query.ai/docs/event-entity_management.md)
- [File System Activity](https://docs.query.ai/docs/event-file_activity.md)
- [File Hosting Activity](https://docs.query.ai/docs/event-file_hosting.md)
- [File Query](https://docs.query.ai/docs/event-file_query.md)
- [File Remediation Activity](https://docs.query.ai/docs/event-file_remediation_activity.md)
- [Folder Query](https://docs.query.ai/docs/event-folder_query.md)
- [FTP Activity](https://docs.query.ai/docs/event-ftp_activity.md)
- [Group Management](https://docs.query.ai/docs/event-group_management.md)
- [HTTP Activity](https://docs.query.ai/docs/event-http_activity.md)
- [Incident Finding](https://docs.query.ai/docs/event-incident_finding.md)
- [Device Inventory Info](https://docs.query.ai/docs/event-inventory_info.md)
- [Job Query](https://docs.query.ai/docs/event-job_query.md)
- [Kernel Activity](https://docs.query.ai/docs/event-kernel_activity.md)
- [Kernel Object Query](https://docs.query.ai/docs/event-kernel_object_query.md)
- [Memory Activity](https://docs.query.ai/docs/event-memory_activity.md)
- [Module Activity](https://docs.query.ai/docs/event-module_activity.md)
- [Module Query](https://docs.query.ai/docs/event-module_query.md)
- [Network Activity](https://docs.query.ai/docs/event-network_activity.md)
- [Network Connection Query](https://docs.query.ai/docs/event-network_connection_query.md)
- [Network File Activity](https://docs.query.ai/docs/event-network_file_activity.md)
- [Network Remediation Activity](https://docs.query.ai/docs/event-network_remediation_activity.md)
- [Networks Query](https://docs.query.ai/docs/event-networks_query.md)
- [NTP Activity](https://docs.query.ai/docs/event-ntp_activity.md)
- [OSINT Inventory Info](https://docs.query.ai/docs/event-osint_inventory_info.md)
- [Operating System Patch State](https://docs.query.ai/docs/event-patch_state.md)
- [Peripheral Device Query](https://docs.query.ai/docs/event-peripheral_device_query.md)
- [Prefetch Query](https://docs.query.ai/docs/event-prefetch_query.md)
- [Process Activity](https://docs.query.ai/docs/event-process_activity.md)
- [Process Query](https://docs.query.ai/docs/event-process_query.md)
- [Process Remediation Activity](https://docs.query.ai/docs/event-process_remediation_activity.md)
- [RDP Activity](https://docs.query.ai/docs/event-rdp_activity.md)
- [Registry Key Activity](https://docs.query.ai/docs/event-registry_key_activity.md)
- [Registry Key Query](https://docs.query.ai/docs/event-registry_key_query.md)
- [Registry Value Activity](https://docs.query.ai/docs/event-registry_value_activity.md)
- [Registry Value Query](https://docs.query.ai/docs/event-registry_value_query.md)
- [Remediation Activity](https://docs.query.ai/docs/event-remediation_activity.md)
- [Scan Activity](https://docs.query.ai/docs/event-scan_activity.md)
- [Scheduled Job Activity](https://docs.query.ai/docs/event-scheduled_job_activity.md)
- [Security Finding](https://docs.query.ai/docs/event-security_finding.md)
- [Service Query](https://docs.query.ai/docs/event-service_query.md)
- [User Session Query](https://docs.query.ai/docs/event-session_query.md)
- [SMB Activity](https://docs.query.ai/docs/event-smb_activity.md)
- [Software Inventory Info](https://docs.query.ai/docs/event-software_info.md)
- [SSH Activity](https://docs.query.ai/docs/event-ssh_activity.md)
- [Tunnel Activity](https://docs.query.ai/docs/event-tunnel_activity.md)
- [User Access Management](https://docs.query.ai/docs/event-user_access.md)
- [User Inventory Info](https://docs.query.ai/docs/event-user_inventory.md)
- [User Query](https://docs.query.ai/docs/event-user_query.md)
- [Vulnerability Finding](https://docs.query.ai/docs/event-vulnerability_finding.md)
- [Web Resource Access Activity](https://docs.query.ai/docs/event-web_resource_access_activity.md)
- [Web Resources Activity](https://docs.query.ai/docs/event-web_resources_activity.md)
- [Cloud Resources Inventory Info](https://docs.query.ai/docs/event-cloud_resources_inventory_info.md)
- [Startup Item Query](https://docs.query.ai/docs/event-startup_item_query.md)
- [Kernel Extension Activity](https://docs.query.ai/docs/event-kernel_extension_activity.md)
- [Event Log Activity](https://docs.query.ai/docs/event-event_log_actvity.md)
- [Script Activity](https://docs.query.ai/docs/event-script_activity.md)
- [Airborne Broadcast Activity](https://docs.query.ai/docs/event-airborne_broadcast_activity.md)
- [Drone Flights Activity](https://docs.query.ai/docs/event-drone_flights_activity.md)
- [Application Error](https://docs.query.ai/docs/event-application_error.md)
- [Windows Service Activity](https://docs.query.ai/docs/event-windows_service_activity.md)
- [Windows Resource Activity](https://docs.query.ai/docs/event-windows_resource_activity.md)
- [Live Evidence Info](https://docs.query.ai/docs/event-evidence_info.md)
- [Application Security Posture Finding](https://docs.query.ai/docs/event-application_security_posture_finding.md)
- [IAM Analysis Finding](https://docs.query.ai/docs/event-iam_analysis_finding.md)
- [Objects](https://docs.query.ai/docs/objects.md)
- [Account](https://docs.query.ai/docs/obj-account.md)
- [Actor](https://docs.query.ai/docs/obj-actor.md)
- [Affected Code](https://docs.query.ai/docs/obj-affected_code.md)
- [Affected Software Package](https://docs.query.ai/docs/obj-affected_package.md)
- [Agent](https://docs.query.ai/docs/obj-agent.md)
- [Analytic](https://docs.query.ai/docs/obj-analytic.md)
- [API](https://docs.query.ai/docs/obj-api.md)
- [MITRE ATT&CK® & ATLAS™](https://docs.query.ai/docs/obj-attack.md)
- [Authentication Factor](https://docs.query.ai/docs/obj-auth_factor.md)
- [Authorization Result](https://docs.query.ai/docs/obj-authorization.md)
- [Autonomous System](https://docs.query.ai/docs/obj-autonomous_system.md)
- [Digital Certificate](https://docs.query.ai/docs/obj-certificate.md)
- [CIS Benchmark](https://docs.query.ai/docs/obj-cis_benchmark.md)
- [CIS Benchmark Result](https://docs.query.ai/docs/obj-cis_benchmark_result.md)
- [CIS Control](https://docs.query.ai/docs/obj-cis_control.md)
- [CIS CSC](https://docs.query.ai/docs/obj-cis_csc.md)
- [Cloud](https://docs.query.ai/docs/obj-cloud.md)
- [Compliance](https://docs.query.ai/docs/obj-compliance.md)
- [Container](https://docs.query.ai/docs/obj-container.md)
- [CVE](https://docs.query.ai/docs/obj-cve.md)
- [CVSS Score](https://docs.query.ai/docs/obj-cvss.md)
- [CWE](https://docs.query.ai/docs/obj-cwe.md)
- [MITRE D3FEND™ Tactic](https://docs.query.ai/docs/obj-d3f_tactic.md)
- [MITRE D3FEND™ Technique](https://docs.query.ai/docs/obj-d3f_technique.md)
- [MITRE D3FEND™](https://docs.query.ai/docs/obj-d3fend.md)
- [Data Classification](https://docs.query.ai/docs/obj-data_classification.md)
- [Data Security](https://docs.query.ai/docs/obj-data_security.md)
- [Database](https://docs.query.ai/docs/obj-database.md)
- [Databucket](https://docs.query.ai/docs/obj-databucket.md)
- [DCE/RPC](https://docs.query.ai/docs/obj-dce_rpc.md)
- [Device](https://docs.query.ai/docs/obj-device.md)
- [Device Hardware Info](https://docs.query.ai/docs/obj-device_hw_info.md)
- [Digital Signature](https://docs.query.ai/docs/obj-digital_signature.md)
- [Display](https://docs.query.ai/docs/obj-display.md)
- [DNS Answer](https://docs.query.ai/docs/obj-dns_answer.md)
- [DNS Query](https://docs.query.ai/docs/obj-dns_query.md)
- [Domain Contact](https://docs.query.ai/docs/obj-domain_contact.md)
- [Domain Threat Intelligence](https://docs.query.ai/docs/obj-domain_intelligence.md)
- [Email](https://docs.query.ai/docs/obj-email.md)
- [Email Authentication](https://docs.query.ai/docs/obj-email_auth.md)
- [Endpoint](https://docs.query.ai/docs/obj-endpoint.md)
- [Endpoint Connection](https://docs.query.ai/docs/obj-endpoint_connection.md)
- [Enrichment](https://docs.query.ai/docs/obj-enrichment.md)
- [EPSS](https://docs.query.ai/docs/obj-epss.md)
- [Windows Evidence Artifacts](https://docs.query.ai/docs/obj-evidences.md)
- [Schema Extension](https://docs.query.ai/docs/obj-extension.md)
- [Feature](https://docs.query.ai/docs/obj-feature.md)
- [File](https://docs.query.ai/docs/obj-file.md)
- [File Threat Intelligence](https://docs.query.ai/docs/obj-file_intelligence.md)
- [Finding](https://docs.query.ai/docs/obj-finding.md)
- [Finding Information](https://docs.query.ai/docs/obj-finding_info.md)
- [Fingerprint](https://docs.query.ai/docs/obj-fingerprint.md)
- [Firewall Rule](https://docs.query.ai/docs/obj-firewall_rule.md)
- [Group](https://docs.query.ai/docs/obj-group.md)
- [HASSH](https://docs.query.ai/docs/obj-hassh.md)
- [HTTP Cookie](https://docs.query.ai/docs/obj-http_cookie.md)
- [HTTP Header](https://docs.query.ai/docs/obj-http_header.md)
- [HTTP Request](https://docs.query.ai/docs/obj-http_request.md)
- [HTTP Response](https://docs.query.ai/docs/obj-http_response.md)
- [Identity Provider](https://docs.query.ai/docs/obj-idp.md)
- [Image](https://docs.query.ai/docs/obj-image.md)
- [IP Threat Intelligence](https://docs.query.ai/docs/obj-ip_intelligence.md)
- [JA4+ Fingerprint](https://docs.query.ai/docs/obj-ja4_fingerprint.md)
- [Job](https://docs.query.ai/docs/obj-job.md)
- [KB Article](https://docs.query.ai/docs/obj-kb_article.md)
- [Kernel Resource](https://docs.query.ai/docs/obj-kernel.md)
- [Kernel Extension](https://docs.query.ai/docs/obj-kernel_driver.md)
- [Keyboard Information](https://docs.query.ai/docs/obj-keyboard_info.md)
- [Kill Chain Phase](https://docs.query.ai/docs/obj-kill_chain_phase.md)
- [LDAP Person](https://docs.query.ai/docs/obj-ldap_person.md)
- [Load Balancer](https://docs.query.ai/docs/obj-load_balancer.md)
- [Geo Location](https://docs.query.ai/docs/obj-location.md)
- [Logger](https://docs.query.ai/docs/obj-logger.md)
- [Malware](https://docs.query.ai/docs/obj-malware.md)
- [Managed Entity](https://docs.query.ai/docs/obj-managed_entity.md)
- [Metadata](https://docs.query.ai/docs/obj-metadata.md)
- [Metric](https://docs.query.ai/docs/obj-metric.md)
- [Module](https://docs.query.ai/docs/obj-module.md)
- [Network Connection Information](https://docs.query.ai/docs/obj-network_connection_info.md)
- [Network Endpoint](https://docs.query.ai/docs/obj-network_endpoint.md)
- [Network Interface](https://docs.query.ai/docs/obj-network_interface.md)
- [Network Proxy Endpoint](https://docs.query.ai/docs/obj-network_proxy.md)
- [Network Traffic](https://docs.query.ai/docs/obj-network_traffic.md)
- [Object](https://docs.query.ai/docs/obj-object.md)
- [Observable](https://docs.query.ai/docs/obj-observable.md)
- [Organization](https://docs.query.ai/docs/obj-organization.md)
- [Operating System (OS)](https://docs.query.ai/docs/obj-os.md)
- [OSINT](https://docs.query.ai/docs/obj-osint.md)
- [Software Package](https://docs.query.ai/docs/obj-package.md)
- [Peripheral Device](https://docs.query.ai/docs/obj-peripheral_device.md)
- [Policy](https://docs.query.ai/docs/obj-policy.md)
- [Linux Process](https://docs.query.ai/docs/obj-process.md)
- [Product](https://docs.query.ai/docs/obj-product.md)
- [Query Information](https://docs.query.ai/docs/obj-query_info.md)
- [Registry Key](https://docs.query.ai/docs/obj-reg_key.md)
- [Registry Value](https://docs.query.ai/docs/obj-reg_value.md)
- [Related Event/Finding](https://docs.query.ai/docs/obj-related_event.md)
- [Remediation](https://docs.query.ai/docs/obj-remediation.md)
- [Reputation](https://docs.query.ai/docs/obj-reputation.md)
- [Request Elements](https://docs.query.ai/docs/obj-request.md)
- [Resource](https://docs.query.ai/docs/obj-resource.md)
- [Resource Details](https://docs.query.ai/docs/obj-resource_details.md)
- [Response Elements](https://docs.query.ai/docs/obj-response.md)
- [RPC Interface](https://docs.query.ai/docs/obj-rpc_interface.md)
- [Rule](https://docs.query.ai/docs/obj-rule.md)
- [Subject Alternative Name](https://docs.query.ai/docs/obj-san.md)
- [Scan](https://docs.query.ai/docs/obj-scan.md)
- [Security State](https://docs.query.ai/docs/obj-security_state.md)
- [Service](https://docs.query.ai/docs/obj-service.md)
- [Session](https://docs.query.ai/docs/obj-session.md)
- [MITRE Sub-technique](https://docs.query.ai/docs/obj-sub_technique.md)
- [Table](https://docs.query.ai/docs/obj-table.md)
- [MITRE Tactic](https://docs.query.ai/docs/obj-tactic.md)
- [MITRE Technique](https://docs.query.ai/docs/obj-technique.md)
- [Threat Intelligence](https://docs.query.ai/docs/obj-threat_intelligence.md)
- [Ticket](https://docs.query.ai/docs/obj-ticket.md)
- [Time Span](https://docs.query.ai/docs/obj-timespan.md)
- [Transport Layer Security (TLS)](https://docs.query.ai/docs/obj-tls.md)
- [TLS Extension](https://docs.query.ai/docs/obj-tls_extension.md)
- [Unmapped](https://docs.query.ai/docs/obj-unmapped.md)
- [Uniform Resource Locator](https://docs.query.ai/docs/obj-url.md)
- [URL Threat Intelligence](https://docs.query.ai/docs/obj-url_intelligence.md)
- [User](https://docs.query.ai/docs/obj-user.md)
- [Vulnerability Details](https://docs.query.ai/docs/obj-vulnerability.md)
- [Web Resource](https://docs.query.ai/docs/obj-web_resource.md)
- [WHOIS](https://docs.query.ai/docs/obj-whois.md)
- [Windows Resource](https://docs.query.ai/docs/obj-win_resource.md)
- [Windows Service](https://docs.query.ai/docs/obj-win_service.md)
- [Encryption Details](https://docs.query.ai/docs/obj-encryption_details.md)
- [Trace](https://docs.query.ai/docs/obj-trace.md)
- [Span](https://docs.query.ai/docs/obj-span.md)
- [Software Component](https://docs.query.ai/docs/obj-software_component.md)
- [Assessment](https://docs.query.ai/docs/obj-assessment.md)
- [Script](https://docs.query.ai/docs/obj-script.md)
- [Occurrence Details](https://docs.query.ai/docs/obj-occurrence_details.md)
- [Software Bill of Materials](https://docs.query.ai/docs/obj-sbom.md)
- [SSO](https://docs.query.ai/docs/obj-sso.md)
- [Process Entity](https://docs.query.ai/docs/obj-process_entity.md)
- [Key:Value object](https://docs.query.ai/docs/obj-key_value_object.md)
- [Advisory](https://docs.query.ai/docs/obj-advisory.md)
- [Classifier Details](https://docs.query.ai/docs/obj-classifier_details.md)
- [Aircraft](https://docs.query.ai/docs/obj-aircraft.md)
- [Unmanned Aerial System](https://docs.query.ai/docs/obj-unmanned_aerial_system.md)
- [Vendor Attributes](https://docs.query.ai/docs/obj-vendor_attributes.md)
- [Discovery Details](https://docs.query.ai/docs/obj-discovery_details.md)
- [Unmanned System Operating Area](https://docs.query.ai/docs/obj-unmanned_system_operating_area.md)
- [Startup Item](https://docs.query.ai/docs/obj-startup_item.md)
- [Environment Variable](https://docs.query.ai/docs/obj-environment_variable.md)
- [Long String](https://docs.query.ai/docs/obj-long_string.md)
- [SCIM](https://docs.query.ai/docs/obj-scim.md)
- [Analysis Target](https://docs.query.ai/docs/obj-analysis_target.md)
- [Anomaly](https://docs.query.ai/docs/obj-anomaly.md)
- [Anomaly Analysis](https://docs.query.ai/docs/obj-anomaly_analysis.md)
- [Application](https://docs.query.ai/docs/obj-application.md)
- [Authentication Token](https://docs.query.ai/docs/obj-authentication_token.md)
- [Baseline](https://docs.query.ai/docs/obj-baseline.md)
- [Campaign](https://docs.query.ai/docs/obj-campaign.md)
- [Check](https://docs.query.ai/docs/obj-check.md)
- [Edge](https://docs.query.ai/docs/obj-edge.md)
- [Graph](https://docs.query.ai/docs/obj-graph.md)
- [Malware Scan Info](https://docs.query.ai/docs/obj-malware_scan_info.md)
- [MITRE Mitigation](https://docs.query.ai/docs/obj-mitigation.md)
- [Node](https://docs.query.ai/docs/obj-node.md)
- [Observation](https://docs.query.ai/docs/obj-observation.md)
- [Query Evidence](https://docs.query.ai/docs/obj-query_evidence.md)
- [Threat Actor](https://docs.query.ai/docs/obj-threat_actor.md)
- [Trait](https://docs.query.ai/docs/obj-trait.md)
- [Transformation Info](https://docs.query.ai/docs/obj-transformation_info.md)
- [Access Analysis Result](https://docs.query.ai/docs/obj-access_analysis_result.md)
- [Additional Restriction](https://docs.query.ai/docs/obj-additional_restriction.md)
- [Identity Activity Metrics](https://docs.query.ai/docs/obj-identity_activity_metrics.md)
- [Permission Analysis Result](https://docs.query.ai/docs/obj-permission_analysis_result.md)
- [Port Information](https://docs.query.ai/docs/obj-port_info.md)
- [Programmatic Credential](https://docs.query.ai/docs/obj-programmatic_credential.md)
- [Data Types](https://docs.query.ai/docs/types.md)
- [Event Categories](https://docs.query.ai/docs/categories.md)
- [Introduction](https://docs.query.ai/docs/fsql.md)
- [Quick Start](https://docs.query.ai/docs/quick-start.md): Your first FSQL query
- [Query Syntax Reference](https://docs.query.ai/docs/query-syntax.md)
- [Attribute Selectors](https://docs.query.ai/docs/attribute-selectors.md)
- [Search Filter Operators](https://docs.query.ai/docs/search-filter-operators.md)
- [Entities](https://docs.query.ai/docs/entities.md)
- [Dates and Times](https://docs.query.ai/docs/dates-and-times.md)
- [Analytics Functions](https://docs.query.ai/docs/analytics-functions.md)
- [Subqueries](https://docs.query.ai/docs/subqueries.md)
- [Other Commands](https://docs.query.ai/docs/other-commands.md)
- [Data Model Primer](https://docs.query.ai/docs/data-model-primer.md): Understanding OCSF and how FSQL uses it
- [Investigation Patterns](https://docs.query.ai/docs/investigation-patterns.md)
- [Best Practices](https://docs.query.ai/docs/best-practices.md): Query performance and optimization tips
- [FSQL for SPL Users](https://docs.query.ai/docs/fsql-for-spl-users.md)
- [FSQL for KQL Users](https://docs.query.ai/docs/fsql-for-kql-users.md)
- [Cheat Sheet](https://docs.query.ai/docs/cheat-sheet.md): Single-page FSQL quick reference
- [The FSQL API](https://docs.query.ai/docs/the-fsql-api.md)
- [FAQL](https://docs.query.ai/docs/faql.md): The FSQL FAQ
- [APT28 Operation Phantom Net Voxel](https://docs.query.ai/docs/apt28-operation-phantom-net-voxel.md): Known by no fewer than 28 aliases – among them Sofacy, Fancy Bear, BlueDelta, Forest Blizzard and TAG-110 – APT28 is identified by intelligence services as operated by Russia’s General Staff Main Intelligence Directorate (GRU), specifically the 85th Main Special Service Centre (GTsSS) of Military Unit 26165.
- [Proactive Defense: A Guide to Hunting the BRICKSTORM Espionage Campaign](https://docs.query.ai/docs/proactive-defense-a-guide-to-hunting-the-brickstorm-espionage-campaign.md): Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is being used to maintain persistent access to victim organizations in the United States.  This hunt is based on research released September 2025.

## Recipes
- [7Zip Compressing Dump Files](https://docs.query.ai/recipes/7zip-compressing-dump-files.md)
- [Account Lockout Detection with FSQL](https://docs.query.ai/recipes/account-lockout-detection-with-fsql.md)
- [Active Directory Database Snapshot Detection via ADExplorer](https://docs.query.ai/recipes/active-directory-database-snapshot-detection-via-adexplorer.md)
- [Activity From Anonymous IP Address Detection](https://docs.query.ai/recipes/activity-from-anonymous-ip-address-detection.md)
- [ADExplorer Writing Complete AD Snapshot Into .dat File](https://docs.query.ai/recipes/adexplorer-writing-complete-ad-snapshot-into-dat-file.md)
- [ADFS Database Named Pipe Connection By Uncommon Tool](https://docs.query.ai/recipes/adfs-database-named-pipe-connection-by-uncommon-tool.md)
- [Adplus.EXE Abuse Detection](https://docs.query.ai/recipes/adplusexe-abuse-detection.md)
- [Advanced Hunting Malcious Process Activity](https://docs.query.ai/recipes/advanced-hunting-malcious-process-activity.md)
- [Aggregate Priority Vulnerabilities by Host](https://docs.query.ai/recipes/aggregate-priority-vulnerabilities-by-host.md)
- [Always Install Elevated Windows Installer Detection](https://docs.query.ai/recipes/always-install-elevated-windows-installer-detection.md)
- [App Assigned To Azure RBAC/Microsoft Entra Role](https://docs.query.ai/recipes/app-assigned-to-azure-rbacmicrosoft-entra-role.md)
- [APT28 Phantom Net Voxel - Malicious C2 Domains](https://docs.query.ai/recipes/apt28-phantom.md)
- [APT31 (Judgment Panda/Zirconium) - Detect Exfil Activity via Common Tools](https://docs.query.ai/recipes/apt31-judgment-pandazirconium-detect-exfil-activity-via-common-tools.md)
- [Arbitrary Shell Command Execution Via Settingcontent-Ms](https://docs.query.ai/recipes/arbitrary-shell-command-execution-via-settingcontent-ms.md)
- [Atbroker Registry Change Detection](https://docs.query.ai/recipes/atbroker-registry-change-detection.md)
- [Atypical Travel Detection with FSQL](https://docs.query.ai/recipes/atypical-travel-detection-with-fsql.md)
- [Audit Policy Tampering and Suspicious DumpMinitool Execution](https://docs.query.ai/recipes/audit-policy-tampering-and-suspicious-dumpminitool-execution.md)
- [AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File](https://docs.query.ai/recipes/awl-bypass-with-winrmvbs-and-malicious-wsmptyxslwsmtxtxsl-file.md)
- [Hunting for AWS CloudTrail Log Tampering](https://docs.query.ai/recipes/aws-cloudtrail-log-tampering.md)
- [AWS Console GetSigninToken Potential Abuse Detection](https://docs.query.ai/recipes/aws-console-getsignintoken-potential-abuse-detection.md)
- [AWS EC2 Disable EBS Encryption](https://docs.query.ai/recipes/aws-ec2-disable-ebs-encryption.md)
- [AWS EC2 Instance Export Detection](https://docs.query.ai/recipes/aws-ec2-instance-export-detection.md)
- [AWS EC2 Startup Shell Script Change Detection](https://docs.query.ai/recipes/aws-ec2-startup-shell-script-change-detection.md)
- [AWS EFS Fileshare Deletion Detection](https://docs.query.ai/recipes/aws-efs-fileshare-deletion-detection.md)
- [AWS EFS Fileshare Mount Modified or Deleted](https://docs.query.ai/recipes/aws-efs-fileshare-mount-modified-or-deleted.md)
- [AWS EnableRegion Command Monitoring](https://docs.query.ai/recipes/aws-enableregion-command-monitoring.md)
- [AWS Glue Development Endpoint Activity Detection](https://docs.query.ai/recipes/aws-glue-development-endpoint-activity-detection.md)
- [AWS GuardDuty Detector Deleted Or Updated](https://docs.query.ai/recipes/aws-guardduty-detector-deleted-or-updated.md)
- [AWS GuardDuty Important Change Detection](https://docs.query.ai/recipes/aws-guardduty-important-change-detection.md)
- [AWS IAM Access Key Creation Detection](https://docs.query.ai/recipes/aws-iam-access-key-creation-detection.md)
- [AWS Identity Center Identity Provider Change Detection](https://docs.query.ai/recipes/aws-identity-center-identity-provider-change-detection.md)
- [AWS Key Pair Import Detection](https://docs.query.ai/recipes/aws-key-pair-import-detection.md)
- [AWS RDS Master Password Change Detection](https://docs.query.ai/recipes/aws-rds-master-password-change-detection.md)
- [AWS Route 53 Domain Transferred to Another Account](https://docs.query.ai/recipes/aws-route-53-domain-transferred-to-another-account.md)
- [AWS Snapshot Backup Exfiltration](https://docs.query.ai/recipes/aws-snapshot-backup-exfiltration.md)
- [AWS STS AssumeRole Misuse Detection](https://docs.query.ai/recipes/aws-sts-assumerole-misuse-detection.md)
- [AWS STS GetSessionToken Misuse Detection](https://docs.query.ai/recipes/aws-sts-getsessiontoken-misuse-detection.md)
- [AWS User Login Profile Modification Detection](https://docs.query.ai/recipes/aws-user-login-profile-modification-detection.md)
- [Azure AD Account Credential Leaked](https://docs.query.ai/recipes/azure-ad-account-credential-leaked.md)
- [Azure Application Security Group Modified or Deleted](https://docs.query.ai/recipes/azure-application-security-group-modified-or-deleted.md)
- [Azure DNS Zone Modified or Deleted](https://docs.query.ai/recipes/azure-dns-zone-modified-or-deleted.md)
- [Azure Firewall Modified or Deleted](https://docs.query.ai/recipes/azure-firewall-modified-or-deleted.md)
- [Azure Kubernetes Admission Controller Detection](https://docs.query.ai/recipes/azure-kubernetes-admission-controller-detection.md)
- [Azure Kubernetes Network Policy Change Detection](https://docs.query.ai/recipes/azure-kubernetes-network-policy-change-detection.md)
- [Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted](https://docs.query.ai/recipes/azure-kubernetes-rolebindingclusterrolebinding-modified-and-deleted.md)
- [Azure Kubernetes Secret or Config Object Access](https://docs.query.ai/recipes/azure-kubernetes-secret-or-config-object-access.md)
- [Azure Login Bypassing Conditional Access Policies](https://docs.query.ai/recipes/azure-login-bypassing-conditional-access-policies.md)
- [Azure Network Firewall Policy Modified or Deleted](https://docs.query.ai/recipes/azure-network-firewall-policy-modified-or-deleted.md)
- [Azure Point-to-site VPN Modified or Deleted](https://docs.query.ai/recipes/azure-point-to-site-vpn-modified-or-deleted.md)
- [Azure Subscription Permission Elevation Detection](https://docs.query.ai/recipes/azure-subscription-permission-elevation-detection.md)
- [Azure Subscription Permission Elevation Via ActivityLogs](https://docs.query.ai/recipes/azure-subscription-permission-elevation-via-activitylogs.md)
- [Azure VPN Connection Modified or Deleted](https://docs.query.ai/recipes/azure-vpn-connection-modified-or-deleted.md)
- [Backup Files Deleted](https://docs.query.ai/recipes/backup-files-deleted.md)
- [Base64 MZ Header Detection in Command Line](https://docs.query.ai/recipes/base64-mz-header-detection-in-command-line.md)
- [Bulk Deletion Changes To Privileged Account Permissions Detection](https://docs.query.ai/recipes/bulk-deletion-changes-to-privileged-account-permissions-detection.md)
- [CA Policy Removed by Non Approved Actor](https://docs.query.ai/recipes/ca-policy-removed-by-non-approved-actor.md)
- [CA Policy Updated by Non Approved Actor](https://docs.query.ai/recipes/ca-policy-updated-by-non-approved-actor.md)
- [Capture Credentials with Rpcping.exe](https://docs.query.ai/recipes/capture-credentials-with-rpcpingexe.md)
- [Chopper Webshell Process Pattern Detection](https://docs.query.ai/recipes/chopper-webshell-process-pattern-detection.md)
- [Chromium Browser Executed With Custom Extension](https://docs.query.ai/recipes/chromium-browser-executed-with-custom-extension.md)
- [Classes Autorun Keys Modification Detection](https://docs.query.ai/recipes/classes-autorun-keys-modification-detection.md)
- [ClickOnce Trust Prompt Tampering Detection](https://docs.query.ai/recipes/clickonce-trust-prompt-tampering-detection.md)
- [Cloudflared Tunnel Connections Cleanup Detection](https://docs.query.ai/recipes/cloudflared-tunnel-connections-cleanup-detection.md)
- [Cmd.EXE Missing Space Characters Execution Anomaly](https://docs.query.ai/recipes/cmdexe-missing-space-characters-execution-anomaly.md)
- [CMSTP Execution Detection via cmlua.dll](https://docs.query.ai/recipes/cmstp-execution-detection-via-cmluadll.md)
- [CMSTP Execution Detection](https://docs.query.ai/recipes/cmstp-execution-detection.md)
- [CobaltStrike Named Pipe Pattern Detection](https://docs.query.ai/recipes/cobaltstrike-named-pipe-pattern-detection-1.md)
- [CobaltStrike Named Pipe Pattern Detection](https://docs.query.ai/recipes/cobaltstrike-named-pipe-pattern-detection.md)
- [Common Autorun Keys Modification Detection](https://docs.query.ai/recipes/common-autorun-keys-modification-detection.md)
- [Computer System Reconnaissance Via Wmic.EXE](https://docs.query.ai/recipes/computer-system-reconnaissance-via-wmicexe.md)
- [Convert Sigma PowerShell Credential Prompt Rule to FSQL](https://docs.query.ai/recipes/convert-sigma-powershell-credential-prompt-rule-to-fsql.md)
- [Convert Sigma Rule to Detect Nmap/Zenmap Execution to FSQL](https://docs.query.ai/recipes/convert-sigma-rule-to-detect-nmapzenmap-execution-to-fsql.md)
- [Convert Sigma Rule to FSQL: AnyDesk Silent Installation](https://docs.query.ai/recipes/convert-sigma-rule-to-fsql-anydesk-silent-installation.md)
- [Copy From Or To Admin Share Or Sysvol Folder](https://docs.query.ai/recipes/copy-from-or-to-admin-share-or-sysvol-folder.md)
- [CrackMapExec File Creation Detection](https://docs.query.ai/recipes/crackmapexec-file-creation-detection.md)
- [CrashControl CrashDump Disabled](https://docs.query.ai/recipes/crashcontrol-crashdump-disabled.md)
- [Creation Exe for Service with Unquoted Path](https://docs.query.ai/recipes/creation-exe-for-service-with-unquoted-path.md)
- [Credential Dumping Attempt Via Svchost](https://docs.query.ai/recipes/credential-dumping-attempt-via-svchost.md)
- [Credential Manager Access By Uncommon Applications](https://docs.query.ai/recipes/credential-manager-access-by-uncommon-applications.md)
- [CSExec Service File Creation Detection](https://docs.query.ai/recipes/csexec-service-file-creation-detection.md)
- [Curl Web Request With Potential Custom User-Agent](https://docs.query.ai/recipes/curl-web-request-with-potential-custom-user-agent.md)
- [Custom File Open Handler Executes PowerShell](https://docs.query.ai/recipes/custom-file-open-handler-executes-powershell.md)
- [CVE-2024-1708 ScreenConnect Path Traversal Exploitation Detection](https://docs.query.ai/recipes/cve-2024-1708-screenconnect-path-traversal-exploitation-detection-1.md)
- [CVE-2024-1708 ScreenConnect Path Traversal Exploitation Detection](https://docs.query.ai/recipes/cve-2024-1708-screenconnect-path-traversal-exploitation-detection.md)
- [DarkGate - Drop DarkGate Loader In C:\Temp Directory](https://docs.query.ai/recipes/darkgate-drop-darkgate-loader-in-ctemp-directory.md)
- [Data Exfiltration to Unsanctioned Apps Detection](https://docs.query.ai/recipes/data-exfiltration-to-unsanctioned-apps-detection.md)
- [Default RDP Port Changed to Non Standard Port](https://docs.query.ai/recipes/default-rdp-port-changed-to-non-standard-port.md)
- [Detect AADInternals PowerShell Cmdlet Execution](https://docs.query.ai/recipes/detect-aadinternals-powershell-cmdlet-execution.md)
- [Detect Access to Windows Credential History File by Uncommon Applications](https://docs.query.ai/recipes/detect-access-to-windows-credential-history-file-by-uncommon-applications.md)
- [Detect Access To Windows DPAPI Master Keys By Uncommon Applications](https://docs.query.ai/recipes/detect-access-to-windows-dpapi-master-keys-by-uncommon-applications.md)
- [Detect Account Creation and Deletion within 24 Hours](https://docs.query.ai/recipes/detect-account-creation-and-deletion-within-24-hours.md)
- [Detect Account Disabled or Blocked for Sign-in Attempts](https://docs.query.ai/recipes/detect-account-disabled-or-blocked-for-sign-in-attempts.md)
- [Detect Active Directory Computer Enumeration with Get-AdComputer](https://docs.query.ai/recipes/detect-active-directory-computer-enumeration-with-get-adcomputer.md)
- [Detect Active Directory Enumeration via PowerShell AD Module](https://docs.query.ai/recipes/detect-active-directory-enumeration-via-powershell-ad-module.md)
- [Detect Activity from Anonymous IP Addresses using FSQL](https://docs.query.ai/recipes/detect-activity-from-anonymous-ip-addresses-using-fsql.md)
- [Detect Activity from Infrequent Country](https://docs.query.ai/recipes/detect-activity-from-infrequent-country.md)
- [Detect Activity from Suspicious IP Addresses](https://docs.query.ai/recipes/detect-activity-from-suspicious-ip-addresses.md)
- [Detect Activity Performed by Terminated Users](https://docs.query.ai/recipes/detect-activity-performed-by-terminated-users.md)
- [Detect AD Group and User Enumeration via PowerShell Modules](https://docs.query.ai/recipes/detect-ad-group-and-user-enumeration-via-powershell-modules.md)
- [Detect AD Groups or Users Enumeration Using PowerShell](https://docs.query.ai/recipes/detect-ad-groups-or-users-enumeration-using-powershell.md)
- [Detect ADCSPwn Execution via Command Line Parameters](https://docs.query.ai/recipes/detect-adcspwn-execution-via-command-line-parameters.md)
- [Detect Added Credentials to Existing Application](https://docs.query.ai/recipes/detect-added-credentials-to-existing-application.md)
- [Detect Added Owner to Application](https://docs.query.ai/recipes/detect-added-owner-to-application.md)
- [Detect ADS Zone.Identifier Deletion by Uncommon Application](https://docs.query.ai/recipes/detect-ads-zoneidentifier-deletion-by-uncommon-application.md)
- [Detect ADSI-Cache File Creation by Uncommon Tool](https://docs.query.ai/recipes/detect-adsi-cache-file-creation-by-uncommon-tool.md)
- [Detect Advanced IP Scanner File Creation](https://docs.query.ai/recipes/detect-advanced-ip-scanner-file-creation.md)
- [Detect Advanced Port Scanner Execution with FSQL](https://docs.query.ai/recipes/detect-advanced-port-scanner-execution-with-fsql.md)
- [Detect Adwind RAT/JRAT File Artifacts](https://docs.query.ai/recipes/detect-adwind-ratjrat-file-artifacts.md)
- [Detect AMSI Bypass Pattern Assembly GetType in PowerShell Scripts](https://docs.query.ai/recipes/detect-amsi-bypass-pattern-assembly-gettype-in-powershell-scripts.md)
- [Detect AMSI Provider Registry Key Deletion](https://docs.query.ai/recipes/detect-amsi-provider-registry-key-deletion.md)
- [Detect Amsi.DLL Loaded Via LOLBIN Process](https://docs.query.ai/recipes/detect-amsidll-loaded-via-lolbin-process.md)
- [Detect Anomalous Tokens in Azure AD](https://docs.query.ai/recipes/detect-anomalous-tokens-in-azure-ad.md)
- [Detect Anomalous User Activity with FSQL](https://docs.query.ai/recipes/detect-anomalous-user-activity-with-fsql.md)
- [Detect Anydesk Artefact and WinRAR Startup Persistence](https://docs.query.ai/recipes/detect-anydesk-artefact-and-winrar-startup-persistence.md)
- [Detect AnyDesk Execution with Revoked Certificate](https://docs.query.ai/recipes/detect-anydesk-execution-with-revoked-certificate.md)
- [Detect App Role Assignment to Service Principal](https://docs.query.ai/recipes/detect-app-role-assignment-to-service-principal.md)
- [Detect Application AppID URI Configuration Changes](https://docs.query.ai/recipes/detect-application-appid-uri-configuration-changes.md)
- [Detect Application Uninstallation via WMIC](https://docs.query.ai/recipes/detect-application-uninstallation-via-wmic.md)
- [Detect Application URI Configuration Changes](https://docs.query.ai/recipes/detect-application-uri-configuration-changes.md)
- [Detect Applications Using Resource Owner Password Credentials (ROPC) Authentication Flow](https://docs.query.ai/recipes/detect-applications-using-resource-owner-password-credentials-ropc-authentication-flow.md)
- [Detect Arbitrary File Download via PresentationHost.EXE](https://docs.query.ai/recipes/detect-arbitrary-file-download-via-presentationhostexe.md)
- [Detect Assembly DLL Creation Via AspNetCompiler](https://docs.query.ai/recipes/detect-assembly-dll-creation-via-aspnetcompiler.md)
- [Detect Assembly Loading Via CL_LoadAssembly.ps1](https://docs.query.ai/recipes/detect-assembly-loading-via-cl_loadassemblyps1.md)
- [Detect Attachment Manager Settings Tampering](https://docs.query.ai/recipes/detect-attachment-manager-settings-tampering.md)
- [Detect Audio Capture via PowerShell Cmdlets](https://docs.query.ai/recipes/detect-audio-capture-via-powershell-cmdlets.md)
- [Detect Authentication Method Changes](https://docs.query.ai/recipes/detect-authentication-method-changes.md)
- [Detect Authentications To Important Apps Using Single Factor Authentication](https://docs.query.ai/recipes/detect-authentications-to-important-apps-using-single-factor-authentication.md)
- [Detect AWS CloudTrail Important Changes](https://docs.query.ai/recipes/detect-aws-cloudtrail-important-changes.md)
- [Detect AWS Config Disabling Channel/Recorder](https://docs.query.ai/recipes/detect-aws-config-disabling-channelrecorder.md)
- [Detect AWS ECS Task Definitions Querying the Credential Endpoint](https://docs.query.ai/recipes/detect-aws-ecs-task-definitions-querying-the-credential-endpoint.md)
- [Detect AWS EKS Cluster Creation or Deletion](https://docs.query.ai/recipes/detect-aws-eks-cluster-creation-or-deletion.md)
- [Detect AWS IAM S3Browser LoginProfile Creation](https://docs.query.ai/recipes/detect-aws-iam-s3browser-loginprofile-creation.md)
- [Detect AWS KMS Imported Key Material Usage](https://docs.query.ai/recipes/detect-aws-kms-imported-key-material-usage.md)
- [Detect AWS Lambda Layer Attachment](https://docs.query.ai/recipes/detect-aws-lambda-layer-attachment.md)
- [Detect AWS Root Account Usage with FSQL](https://docs.query.ai/recipes/detect-aws-root-account-usage-with-fsql.md)
- [Detect AWS S3 Bucket Deletion](https://docs.query.ai/recipes/detect-aws-s3-bucket-deletion.md)
- [Detect AWS S3 Bucket Versioning Disable](https://docs.query.ai/recipes/detect-aws-s3-bucket-versioning-disable.md)
- [Detect AWS S3 Data Management Tampering](https://docs.query.ai/recipes/detect-aws-s3-data-management-tampering.md)
- [Detect AWS SAML Provider Deletion](https://docs.query.ai/recipes/detect-aws-saml-provider-deletion.md)
- [Detect AWS STS GetCallerIdentity Enumeration via TruffleHog](https://docs.query.ai/recipes/detect-aws-sts-getcalleridentity-enumeration-via-trufflehog.md)
- [Detect Azure AD Health AD FS Service Deletion](https://docs.query.ai/recipes/detect-azure-ad-health-ad-fs-service-deletion.md)
- [Detect Azure AD Single Factor Authentication](https://docs.query.ai/recipes/detect-azure-ad-single-factor-authentication.md)
- [Detect Azure AD Threat Intelligence](https://docs.query.ai/recipes/detect-azure-ad-threat-intelligence.md)
- [Detect Azure Application Deletion](https://docs.query.ai/recipes/detect-azure-application-deletion.md)
- [Detect Azure Application Gateway Modifications or Deletions](https://docs.query.ai/recipes/detect-azure-application-gateway-modifications-or-deletions.md)
- [Detect Azure Authentication Interruptions](https://docs.query.ai/recipes/detect-azure-authentication-interruptions.md)
- [Detect Azure Container Registry Creation or Deletion](https://docs.query.ai/recipes/detect-azure-container-registry-creation-or-deletion.md)
- [Detect Azure Device Compliance or Management Status Changes](https://docs.query.ai/recipes/detect-azure-device-compliance-or-management-status-changes.md)
- [Detect Azure Device or Configuration Modifications/Deletions](https://docs.query.ai/recipes/detect-azure-device-or-configuration-modificationsdeletions.md)
- [Detect Azure Domain Federation Settings Modification](https://docs.query.ai/recipes/detect-azure-domain-federation-settings-modification.md)
- [Detect Azure Firewall Rule Collection Modifications or Deletions](https://docs.query.ai/recipes/detect-azure-firewall-rule-collection-modifications-or-deletions.md)
- [Detect Azure Firewall Rule Configuration Modifications or Deletions](https://docs.query.ai/recipes/detect-azure-firewall-rule-configuration-modifications-or-deletions.md)
- [Detect Azure Key Vault Modifications or Deletions](https://docs.query.ai/recipes/detect-azure-key-vault-modifications-or-deletions.md)
- [Detect Azure Key Vault Secret Modifications and Deletions](https://docs.query.ai/recipes/detect-azure-key-vault-secret-modifications-and-deletions.md)
- [Detect Azure Keyvault Key Modifications or Deletions](https://docs.query.ai/recipes/detect-azure-keyvault-key-modifications-or-deletions.md)
- [Detect Azure Kubernetes Cluster Creation or Deletion](https://docs.query.ai/recipes/detect-azure-kubernetes-cluster-creation-or-deletion.md)
- [Detect Azure Kubernetes CronJob Activity](https://docs.query.ai/recipes/detect-azure-kubernetes-cronjob-activity.md)
- [Detect Azure Kubernetes Events Deletion](https://docs.query.ai/recipes/detect-azure-kubernetes-events-deletion.md)
- [Detect Azure Kubernetes Pod Deletion](https://docs.query.ai/recipes/detect-azure-kubernetes-pod-deletion.md)
- [Detect Azure Kubernetes Service Account Modification or Deletion](https://docs.query.ai/recipes/detect-azure-kubernetes-service-account-modification-or-deletion.md)
- [Detect Azure Network Security Configuration Changes](https://docs.query.ai/recipes/detect-azure-network-security-configuration-changes.md)
- [Detect Azure Owner Removal from Application/Service Principal](https://docs.query.ai/recipes/detect-azure-owner-removal-from-applicationservice-principal.md)
- [Detect Azure Resource Creation or Deployment Activities](https://docs.query.ai/recipes/detect-azure-resource-creation-or-deployment-activities.md)
- [Detect Azure Service Principal Creation](https://docs.query.ai/recipes/detect-azure-service-principal-creation.md)
- [Detect Azure Service Principal Removal](https://docs.query.ai/recipes/detect-azure-service-principal-removal.md)
- [Detect Azure Suppression Rule Creation](https://docs.query.ai/recipes/detect-azure-suppression-rule-creation.md)
- [Detect Azure Virtual Network Device Modifications or Deletions](https://docs.query.ai/recipes/detect-azure-virtual-network-device-modifications-or-deletions.md)
- [Detect Azure Virtual Network Modifications or Deletions](https://docs.query.ai/recipes/detect-azure-virtual-network-modifications-or-deletions.md)
- [Detect Bitlocker Key Retrieval from Azure](https://docs.query.ai/recipes/detect-bitlocker-key-retrieval-from-azure.md)
- [Detect BitLockerToGo.EXE Execution with FSQL](https://docs.query.ai/recipes/detect-bitlockertogoexe-execution-with-fsql.md)
- [Detect BloodHound Collection Files with FSQL](https://docs.query.ai/recipes/detect-bloodhound-collection-files-with-fsql.md)
- [Detect CACTUSTORCH Remote Thread Creation](https://docs.query.ai/recipes/detect-cactustorch-remote-thread-creation.md)
- [Detect Certificate-Based Authentication Enabled in Azure AD](https://docs.query.ai/recipes/detect-certificate-based-authentication-enabled-in-azure-ad.md)
- [Detect Certificate Export via PowerShell ScriptBlock](https://docs.query.ai/recipes/detect-certificate-export-via-powershell-scriptblock.md)
- [Detect Changes to Device Registration Policy](https://docs.query.ai/recipes/detect-changes-to-device-registration-policy.md)
- [Detect CobaltStrike Named Pipes](https://docs.query.ai/recipes/detect-cobaltstrike-named-pipes.md)
- [Detect Covenant PowerShell Launcher](https://docs.query.ai/recipes/detect-covenant-powershell-launcher.md)
- [Detect Creation of Diagcab Files](https://docs.query.ai/recipes/detect-creation-of-diagcab-files.md)
- [Detect Creation of Non-Existent System DLLs](https://docs.query.ai/recipes/detect-creation-of-non-existent-system-dlls.md)
- [Detect Credential Dumping Tools Dropped Files](https://docs.query.ai/recipes/detect-credential-dumping-tools-dropped-files.md)
- [Detect Credential Dumping Tools via Named Pipe Creation](https://docs.query.ai/recipes/detect-credential-dumping-tools-via-named-pipe-creation.md)
- [Detect CSExec Default Named Pipe Creation](https://docs.query.ai/recipes/detect-csexec-default-named-pipe-creation.md)
- [Detect CurrentVersion Autorun Keys Modification](https://docs.query.ai/recipes/detect-currentversion-autorun-keys-modification.md)
- [Detect DarkGate Loader Execution in C:\Temp Directory](https://docs.query.ai/recipes/detect-darkgate-loader-execution-in-ctemp-directory.md)
- [Detect Delegated Permissions Granted For All Users](https://docs.query.ai/recipes/detect-delegated-permissions-granted-for-all-users.md)
- [Detect Deleted Data Overwritten Via Cipher.EXE](https://docs.query.ai/recipes/detect-deleted-data-overwritten-via-cipherexe.md)
- [Detect DiagTrackEoP Default Named Pipe Creation](https://docs.query.ai/recipes/detect-diagtrackeop-default-named-pipe-creation.md)
- [Detect Disable-WindowsOptionalFeature PowerShell Cmdlet for Defense Evasion](https://docs.query.ai/recipes/detect-disable-windowsoptionalfeature-powershell-cmdlet-for-defense-evasion.md)
- [Detect DIT Snapshot Viewer Execution](https://docs.query.ai/recipes/detect-dit-snapshot-viewer-execution.md)
- [Detect DLL Load via LSASS using Registry Modification](https://docs.query.ai/recipes/detect-dll-load-via-lsass-using-registry-modification.md)
- [Detect DNS-over-HTTPS Enabled via Registry Modification](https://docs.query.ai/recipes/detect-dns-over-https-enabled-via-registry-modification.md)
- [Detect DPAPI Backup Key and Certificate Export Activity](https://docs.query.ai/recipes/detect-dpapi-backup-key-and-certificate-export-activity.md)
- [Detect DSInternals PowerShell Cmdlets in ScriptBlock](https://docs.query.ai/recipes/detect-dsinternals-powershell-cmdlets-in-scriptblock.md)
- [Detect DSInternals PowerShell Cmdlets Usage](https://docs.query.ai/recipes/detect-dsinternals-powershell-cmdlets-usage.md)
- [Detect Enable LM Hash Storage via Registry Modification](https://docs.query.ai/recipes/detect-enable-lm-hash-storage-via-registry-modification.md)
- [Detect ETW Logging Disabled for SCM via Registry Modification](https://docs.query.ai/recipes/detect-etw-logging-disabled-for-scm-via-registry-modification.md)
- [Detect Event Log EVTX File Deletion](https://docs.query.ai/recipes/detect-event-log-evtx-file-deletion.md)
- [Detect Evil-WinRM Execution via PowerShell Module Logs](https://docs.query.ai/recipes/detect-evil-winrm-execution-via-powershell-module-logs.md)
- [Detect EVTX File Creation in Uncommon Locations](https://docs.query.ai/recipes/detect-evtx-file-creation-in-uncommon-locations.md)
- [Detect Execution DLL of Choice Using WAB.EXE](https://docs.query.ai/recipes/detect-execution-dll-of-choice-using-wabexe.md)
- [Detect Failed Authentications From Unapproved Countries](https://docs.query.ai/recipes/detect-failed-authentications-from-unapproved-countries.md)
- [Detect Fax DLL Hijacking via Registry Modification](https://docs.query.ai/recipes/detect-fax-dll-hijacking-via-registry-modification.md)
- [Detect File Creation in Suspicious Directory by msdt.exe](https://docs.query.ai/recipes/detect-file-creation-in-suspicious-directory-by-msdtexe.md)
- [Detect File Creation of Malicious PowerShell Scripts](https://docs.query.ai/recipes/detect-file-creation-of-malicious-powershell-scripts.md)
- [Detect File Deletion via Sysinternals SDelete](https://docs.query.ai/recipes/detect-file-deletion-via-sysinternals-sdelete.md)
- [Detect File Download From IP URL Via Curl.EXE](https://docs.query.ai/recipes/detect-file-download-from-ip-url-via-curlexe.md)
- [Detect File Download via Windows Defender MpCmdRun.EXE](https://docs.query.ai/recipes/detect-file-download-via-windows-defender-mpcmdrunexe.md)
- [Detect FileFix Command Evidence in TypedPaths](https://docs.query.ai/recipes/detect-filefix-command-evidence-in-typedpaths.md)
- [Detect Filter Driver Unloading via Fltmc.EXE](https://docs.query.ai/recipes/detect-filter-driver-unloading-via-fltmcexe.md)
- [Detect Findstr Launching .lnk File](https://docs.query.ai/recipes/detect-findstr-launching-lnk-file.md)
- [Detect Finger.EXE Execution](https://docs.query.ai/recipes/detect-fingerexe-execution.md)
- [Detect GatherNetworkInfo.VBS Reconnaissance Script Output](https://docs.query.ai/recipes/detect-gathernetworkinfovbs-reconnaissance-script-output.md)
- [Detect GCP Access Policy Deletion](https://docs.query.ai/recipes/detect-gcp-access-policy-deletion.md)
- [Detect GCP Break-glass Container Workload Deployment](https://docs.query.ai/recipes/detect-gcp-break-glass-container-workload-deployment.md)
- [Detect Google Cloud Firewall Modifications or Deletions](https://docs.query.ai/recipes/detect-google-cloud-firewall-modifications-or-deletions.md)
- [Detect Google Cloud Kubernetes RoleBinding Manipulation](https://docs.query.ai/recipes/detect-google-cloud-kubernetes-rolebinding-manipulation.md)
- [Detect Google Cloud Kubernetes Secrets Modified or Deleted](https://docs.query.ai/recipes/detect-google-cloud-kubernetes-secrets-modified-or-deleted.md)
- [Detect Google Cloud Packet Mirroring Activities](https://docs.query.ai/recipes/detect-google-cloud-packet-mirroring-activities.md)
- [Detect Google Cloud Sensitive Information Re-identification](https://docs.query.ai/recipes/detect-google-cloud-sensitive-information-re-identification.md)
- [Detect Google Cloud Storage Bucket Modifications or Deletions](https://docs.query.ai/recipes/detect-google-cloud-storage-bucket-modifications-or-deletions.md)
- [Detect Google Cloud VPN Tunnel Modifications or Deletions](https://docs.query.ai/recipes/detect-google-cloud-vpn-tunnel-modifications-or-deletions.md)
- [Detect Google Workspace Application Access Level Modification](https://docs.query.ai/recipes/detect-google-workspace-application-access-level-modification.md)
- [Detect Google Workspace Application Removal](https://docs.query.ai/recipes/detect-google-workspace-application-removal.md)
- [Detect GoToAssist Temporary Installation Artefact](https://docs.query.ai/recipes/detect-gotoassist-temporary-installation-artefact.md)
- [Detect Gpg4win Encryption/Decryption From Suspicious Locations](https://docs.query.ai/recipes/detect-gpg4win-encryptiondecryption-from-suspicious-locations.md)
- [Detect Guest User Invitations by Non-Approved Inviters in Azure](https://docs.query.ai/recipes/detect-guest-user-invitations-by-non-approved-inviters-in-azure.md)
- [Detect Guest User Invitations by Non-Approved Inviters](https://docs.query.ai/recipes/detect-guest-user-invitations-by-non-approved-inviters.md)
- [Detect Gzip Archive Decoding via PowerShell](https://docs.query.ai/recipes/detect-gzip-archive-decoding-via-powershell.md)
- [Detect Hacktool Execution via Imphash](https://docs.query.ai/recipes/detect-hacktool-execution-via-imphash.md)
- [Detect Hidden Directory Creation via NTFS INDEX_ALLOCATION Stream](https://docs.query.ai/recipes/detect-hidden-directory-creation-via-ntfs-index_allocation-stream.md)
- [Detect HybridConnectionManager Service Installation via Registry Monitoring](https://docs.query.ai/recipes/detect-hybridconnectionmanager-service-installation-via-registry-monitoring.md)
- [Detect Hypervisor Enforced Paging Translation Disabled via Registry Modification](https://docs.query.ai/recipes/detect-hypervisor-enforced-paging-translation-disabled-via-registry-modification.md)
- [Detect IIS WebServer Access Logs Deletion](https://docs.query.ai/recipes/detect-iis-webserver-access-logs-deletion.md)
- [Detect Impacket File Indicators](https://docs.query.ai/recipes/detect-impacket-file-indicators.md)
- [Detect Impacket Tools Execution](https://docs.query.ai/recipes/detect-impacket-tools-execution.md)
- [Detect Impossible Travel and Token Issuer Anomalies in Azure AD](https://docs.query.ai/recipes/detect-impossible-travel-and-token-issuer-anomalies-in-azure-ad.md)
- [Detect Increased Failed Authentications](https://docs.query.ai/recipes/detect-increased-failed-authentications.md)
- [Detect Ingress/Egress Security Group Modification](https://docs.query.ai/recipes/detect-ingressegress-security-group-modification.md)
- [Detect Insecure PowerShell Policy Changes](https://docs.query.ai/recipes/detect-insecure-powershell-policy-changes.md)
- [Detect Insecure Winget Source Addition](https://docs.query.ai/recipes/detect-insecure-winget-source-addition.md)
- [Detect Installation of TeamViewer Desktop](https://docs.query.ai/recipes/detect-installation-of-teamviewer-desktop.md)
- [Detect Internet Explorer DisableFirstRunCustomize Registry Modification](https://docs.query.ai/recipes/detect-internet-explorer-disablefirstruncustomize-registry-modification.md)
- [Detect Invalid PIM License](https://docs.query.ai/recipes/detect-invalid-pim-license.md)
- [Detect Inveigh Execution Artefacts](https://docs.query.ai/recipes/detect-inveigh-execution-artefacts.md)
- [Detect Invoke-Command Execution on Remote Host via FSQL](https://docs.query.ai/recipes/detect-invoke-command-execution-on-remote-host-via-fsql.md)
- [Detect Invoke-Obfuscation CLIP+ Launcher PowerShell](https://docs.query.ai/recipes/detect-invoke-obfuscation-clip-launcher-powershell.md)
- [Detect Invoke-Obfuscation COMPRESS Obfuscation in PowerShell Scripts](https://docs.query.ai/recipes/detect-invoke-obfuscation-compress-obfuscation-in-powershell-scripts.md)
- [Detect Invoke-Obfuscation COMPRESS OBFUSCATION PowerShell Module](https://docs.query.ai/recipes/detect-invoke-obfuscation-compress-obfuscation-powershell-module.md)
- [Detect Invoke-Obfuscation PowerShell Using Rundll32](https://docs.query.ai/recipes/detect-invoke-obfuscation-powershell-using-rundll32.md)
- [Detect Invoke-Obfuscation PowerShell via RUNDLL LAUNCHER](https://docs.query.ai/recipes/detect-invoke-obfuscation-powershell-via-rundll-launcher.md)
- [Detect Invoke-Obfuscation PowerShell via STDIN](https://docs.query.ai/recipes/detect-invoke-obfuscation-powershell-via-stdin.md)
- [Detect Invoke-Obfuscation VAR+ Launcher in PowerShell](https://docs.query.ai/recipes/detect-invoke-obfuscation-var-launcher-in-powershell.md)
- [Detect Invoke-Obfuscation VAR+ Launcher via PowerShell Module](https://docs.query.ai/recipes/detect-invoke-obfuscation-var-launcher-via-powershell-module.md)
- [Detect Invoke-Obfuscation via Clip.exe in PowerShell Scripts](https://docs.query.ai/recipes/detect-invoke-obfuscation-via-clipexe-in-powershell-scripts-1.md)
- [Detect Invoke-Obfuscation via Clip.exe in PowerShell Scripts](https://docs.query.ai/recipes/detect-invoke-obfuscation-via-clipexe-in-powershell-scripts.md)
- [Detect Invoke-Obfuscation via MSHTA in PowerShell Scripts](https://docs.query.ai/recipes/detect-invoke-obfuscation-via-mshta-in-powershell-scripts.md)
- [Detect Invoke-Obfuscation via MSHTA in PowerShell using FSQL](https://docs.query.ai/recipes/detect-invoke-obfuscation-via-mshta-in-powershell-using-fsql.md)
- [Detect Invoke-Obfuscation via Stdin in PowerShell Modules](https://docs.query.ai/recipes/detect-invoke-obfuscation-via-stdin-in-powershell-modules.md)
- [Detect KamiKakaBot Lure Document Execution via WinWord Start Menu Shortcut](https://docs.query.ai/recipes/detect-kamikakabot-lure-document-execution-via-winword-start-menu-shortcut.md)
- [Detect Kapeka Backdoor Configuration Persistence via Registry](https://docs.query.ai/recipes/detect-kapeka-backdoor-configuration-persistence-via-registry.md)
- [Detect Kapeka Backdoor Persistence via FSQL](https://docs.query.ai/recipes/detect-kapeka-backdoor-persistence-via-fsql.md)
- [Detect Koh Tool Default Named Pipe Creation](https://docs.query.ai/recipes/detect-koh-tool-default-named-pipe-creation.md)
- [Detect Legitimate Applications Dropping Archives](https://docs.query.ai/recipes/detect-legitimate-applications-dropping-archives.md)
- [Detect Legitimate Applications Dropping Executables](https://docs.query.ai/recipes/detect-legitimate-applications-dropping-executables.md)
- [Detect Legitimate Applications Dropping Scripts](https://docs.query.ai/recipes/detect-legitimate-applications-dropping-scripts.md)
- [Detect LittleCorporal Maldoc Injection via FSQL](https://docs.query.ai/recipes/detect-littlecorporal-maldoc-injection-via-fsql.md)
- [Detect LiveKD Driver Creation By Uncommon Process](https://docs.query.ai/recipes/detect-livekd-driver-creation-by-uncommon-process.md)
- [Detect LiveKD Kernel Memory Dump File Creation](https://docs.query.ai/recipes/detect-livekd-kernel-memory-dump-file-creation.md)
- [Detect Login Attempts to Disabled Accounts](https://docs.query.ai/recipes/detect-login-attempts-to-disabled-accounts.md)
- [Detect Logon from Risky IP Address using FSQL](https://docs.query.ai/recipes/detect-logon-from-risky-ip-address-using-fsql.md)
- [Detect LSASS Process Memory Dump File Creation](https://docs.query.ai/recipes/detect-lsass-process-memory-dump-file-creation.md)
- [Detect Malicious DLL File Dropped in Teams or OneDrive Folder](https://docs.query.ai/recipes/detect-malicious-dll-file-dropped-in-teams-or-onedrive-folder.md)
- [Detect Malicious IP Address Sign-In Failure Rate](https://docs.query.ai/recipes/detect-malicious-ip-address-sign-in-failure-rate.md)
- [Detect Malicious Named Pipe Creation](https://docs.query.ai/recipes/detect-malicious-named-pipe-creation.md)
- [Detect Malicious Nishang PowerShell Commandlets](https://docs.query.ai/recipes/detect-malicious-nishang-powershell-commandlets.md)
- [Detect Malicious PowerShell Commandlets via Process Creation](https://docs.query.ai/recipes/detect-malicious-powershell-commandlets-via-process-creation.md)
- [Detect Malicious PowerShell Commandlets via PS Module Logging](https://docs.query.ai/recipes/detect-malicious-powershell-commandlets-via-ps-module-logging.md)
- [Detect Malicious PowerShell Commandlets via ScriptBlock](https://docs.query.ai/recipes/detect-malicious-powershell-commandlets-via-scriptblock.md)
- [Detect Malicious PowerShell Keywords](https://docs.query.ai/recipes/detect-malicious-powershell-keywords.md)
- [Detect Malicious PowerShell Scripts via PoshModule](https://docs.query.ai/recipes/detect-malicious-powershell-scripts-via-poshmodule.md)
- [Detect Malicious ShellIntel PowerShell Commandlets](https://docs.query.ai/recipes/detect-malicious-shellintel-powershell-commandlets.md)
- [Detect Malicious use of Msiexec Mimikatz](https://docs.query.ai/recipes/detect-malicious-use-of-msiexec-mimikatz.md)
- [Detect MFA Disabled for User Account](https://docs.query.ai/recipes/detect-mfa-disabled-for-user-account.md)
- [Detect Microsoft Defender Firewall Disabled via Registry](https://docs.query.ai/recipes/detect-microsoft-defender-firewall-disabled-via-registry.md)
- [Detect Microsoft Dynamic Data Exchange Enabled](https://docs.query.ai/recipes/detect-microsoft-dynamic-data-exchange-enabled.md)
- [Detect Microsoft Office Protected View Disabled via Registry Changes](https://docs.query.ai/recipes/detect-microsoft-office-protected-view-disabled-via-registry-changes.md)
- [Detect Mimikatz Kirbi File Creation with FSQL](https://docs.query.ai/recipes/detect-mimikatz-kirbi-file-creation-with-fsql.md)
- [Detect MiniNt Registry Key Creation for Defense Evasion](https://docs.query.ai/recipes/detect-minint-registry-key-creation-for-defense-evasion.md)
- [Detect Modification of User Shell Folders Startup Value](https://docs.query.ai/recipes/detect-modification-of-user-shell-folders-startup-value.md)
- [Detect Msiexec Web Install](https://docs.query.ai/recipes/detect-msiexec-web-install.md)
- [Detect MSTSC Shadowing Activity](https://docs.query.ai/recipes/detect-mstsc-shadowing-activity.md)
- [Detect Mstsc.EXE Execution With Local RDP File](https://docs.query.ai/recipes/detect-mstscexe-execution-with-local-rdp-file.md)
- [Detect .NET NGenAssemblyUsageLog Registry Tampering](https://docs.query.ai/recipes/detect-net-ngenassemblyusagelog-registry-tampering.md)
- [Detect NetNTLM Downgrade Attack via Registry Modification](https://docs.query.ai/recipes/detect-netntlm-downgrade-attack-via-registry-modification.md)
- [Detect NetSupport Execution via FSQL](https://docs.query.ai/recipes/detect-netsupport-execution-via-fsql.md)
- [Detect New Application Execution via AppCompat Registry Key](https://docs.query.ai/recipes/detect-new-application-execution-via-appcompat-registry-key.md)
- [Detect New Azure AD Hybrid Health AD FS Server Creation](https://docs.query.ai/recipes/detect-new-azure-ad-hybrid-health-ad-fs-server-creation.md)
- [Detect New CA Policy Creation](https://docs.query.ai/recipes/detect-new-ca-policy-creation.md)
- [Detect New Country Sign-ins in Azure AD](https://docs.query.ai/recipes/detect-new-country-sign-ins-in-azure-ad.md)
- [Detect New DLL Added to AppInit_DLLs Registry Key](https://docs.query.ai/recipes/detect-new-dll-added-to-appinit_dlls-registry-key.md)
- [Detect New DLL Registered Via Odbcconf.EXE](https://docs.query.ai/recipes/detect-new-dll-registered-via-odbcconfexe.md)
- [Detect New DNS ServerLevelPluginDll Installation](https://docs.query.ai/recipes/detect-new-dns-serverlevelplugindll-installation.md)
- [Detect New Federated Domain Added in Exchange](https://docs.query.ai/recipes/detect-new-federated-domain-added-in-exchange.md)
- [Detect New Federated Domain Addition in M365](https://docs.query.ai/recipes/detect-new-federated-domain-addition-in-m365.md)
- [Detect New File Association Using Exefile Handler](https://docs.query.ai/recipes/detect-new-file-association-using-exefile-handler.md)
- [Detect New Network ACL Entry in AWS](https://docs.query.ai/recipes/detect-new-network-acl-entry-in-aws.md)
- [Detect New Network Route Added in AWS](https://docs.query.ai/recipes/detect-new-network-route-added-in-aws.md)
- [Detect New ODBC Driver Registration](https://docs.query.ai/recipes/detect-new-odbc-driver-registration.md)
- [Detect New PortProxy Registry Entry Addition](https://docs.query.ai/recipes/detect-new-portproxy-registry-entry-addition.md)
- [Detect New Root, CA, or AuthRoot Certificate Installation via Registry Modification](https://docs.query.ai/recipes/detect-new-root-ca-or-authroot-certificate-installation-via-registry-modification.md)
- [Detect New RUN Key Pointing to Suspicious Folder](https://docs.query.ai/recipes/detect-new-run-key-pointing-to-suspicious-folder.md)
- [Detect New Virtual Smart Card Creation via TpmVscMgr.EXE](https://docs.query.ai/recipes/detect-new-virtual-smart-card-creation-via-tpmvscmgrexe.md)
- [Detect NPPSpy Hacktool Usage with FSQL](https://docs.query.ai/recipes/detect-nppspy-hacktool-usage-with-fsql.md)
- [Detect NTDS.DIT Creation by Uncommon Parent Process](https://docs.query.ai/recipes/detect-ntdsdit-creation-by-uncommon-parent-process.md)
- [Detect NTDS.DIT Creation By Uncommon Process](https://docs.query.ai/recipes/detect-ntdsdit-creation-by-uncommon-process.md)
- [Detect NTDS.DIT File Creation](https://docs.query.ai/recipes/detect-ntdsdit-file-creation.md)
- [Detect NTFS Alternate Data Stream Write via PowerShell](https://docs.query.ai/recipes/detect-ntfs-alternate-data-stream-write-via-powershell.md)
- [Detect Obfuscated PowerShell Execution via Clip.exe](https://docs.query.ai/recipes/detect-obfuscated-powershell-execution-via-clipexe.md)
- [Detect Office Application Startup with Office Test Registry Key](https://docs.query.ai/recipes/detect-office-application-startup-with-office-test-registry-key.md)
- [Detect Office Macro File Creation From Suspicious Process](https://docs.query.ai/recipes/detect-office-macro-file-creation-from-suspicious-process.md)
- [Detect Office Macro File Creation](https://docs.query.ai/recipes/detect-office-macro-file-creation.md)
- [Detect Old TLS1.0/TLS1.1 Protocol Version Enabled via Registry Modification](https://docs.query.ai/recipes/detect-old-tls10tls11-protocol-version-enabled-via-registry-modification.md)
- [Detect OneDriveStandaloneUpdater.exe Proxy Download via Registry Modification](https://docs.query.ai/recipes/detect-onedrivestandaloneupdaterexe-proxy-download-via-registry-modification.md)
- [Detect OneNote Execution of Malicious Embedded Scripts](https://docs.query.ai/recipes/detect-onenote-execution-of-malicious-embedded-scripts.md)
- [Detect OpenSSH Installation via PowerShell Cmdlet](https://docs.query.ai/recipes/detect-openssh-installation-via-powershell-cmdlet.md)
- [Detect Outlook Macro Execution Without Warning via Registry Modification](https://docs.query.ai/recipes/detect-outlook-macro-execution-without-warning-via-registry-modification.md)
- [Detect Outlook VBA Addin Loaded via Outlook](https://docs.query.ai/recipes/detect-outlook-vba-addin-loaded-via-outlook.md)
- [Detect PAExec Default Named Pipe Creation with FSQL](https://docs.query.ai/recipes/detect-paexec-default-named-pipe-creation-with-fsql.md)
- [Detect Password Dumper Remote Thread in LSASS](https://docs.query.ai/recipes/detect-password-dumper-remote-thread-in-lsass.md)
- [Detect Password Policy Discovery with Get-AdDefaultDomainPasswordPolicy](https://docs.query.ai/recipes/detect-password-policy-discovery-with-get-addefaultdomainpasswordpolicy.md)
- [Detect Password Reset By User Account in Azure AD](https://docs.query.ai/recipes/detect-password-reset-by-user-account-in-azure-ad.md)
- [Detect Password Spraying with Dsacls.EXE](https://docs.query.ai/recipes/detect-password-spraying-with-dsaclsexe.md)
- [Detect PCRE.NET Package Image Load with FSQL](https://docs.query.ai/recipes/detect-pcrenet-package-image-load-with-fsql.md)
- [Detect PDF File Created by RegEdit.EXE](https://docs.query.ai/recipes/detect-pdf-file-created-by-regeditexe.md)
- [Detect Periodic Backup For System Registry Hives Enabled](https://docs.query.ai/recipes/detect-periodic-backup-for-system-registry-hives-enabled.md)
- [Detect Persistence via Disk Cleanup Handler Autorun](https://docs.query.ai/recipes/detect-persistence-via-disk-cleanup-handler-autorun.md)
- [Detect Persistence Via Hhctrl.ocx Registry Modification](https://docs.query.ai/recipes/detect-persistence-via-hhctrlocx-registry-modification.md)
- [Detect PIM Alert Setting Changes to Disabled](https://docs.query.ai/recipes/detect-pim-alert-setting-changes-to-disabled.md)
- [Detect Potential AMSI COM Server Hijacking](https://docs.query.ai/recipes/detect-potential-amsi-com-server-hijacking.md)
- [Detect Potential Arbitrary File Download via Cmdl32.exe](https://docs.query.ai/recipes/detect-potential-arbitrary-file-download-via-cmdl32exe.md)
- [Detect Potential COM Object Hijacking Via TreatAs Registry Subkey](https://docs.query.ai/recipes/detect-potential-com-object-hijacking-via-treatas-registry-subkey.md)
- [Detect Potential Credential Dumping via New Network Provider (REG)](https://docs.query.ai/recipes/detect-potential-credential-dumping-via-new-network-provider-reg.md)
- [Detect Potential CVE-2024-35250 Exploitation with ksproxy.ax](https://docs.query.ai/recipes/detect-potential-cve-2024-35250-exploitation-with-ksproxyax.md)
- [Detect Potential DCOM InternetExplorer.Application DLL Hijack](https://docs.query.ai/recipes/detect-potential-dcom-internetexplorerapplication-dll-hijack.md)
- [Detect Potential DLL Sideloading of DbgModel.DLL](https://docs.query.ai/recipes/detect-potential-dll-sideloading-of-dbgmodeldll.md)
- [Detect Potential DLL Sideloading via comctl32.dll](https://docs.query.ai/recipes/detect-potential-dll-sideloading-via-comctl32dll.md)
- [Detect Potential DLL Sideloading via VMware Xfer](https://docs.query.ai/recipes/detect-potential-dll-sideloading-via-vmware-xfer.md)
- [Detect Potential EventLog File Location Tampering](https://docs.query.ai/recipes/detect-potential-eventlog-file-location-tampering.md)
- [Detect Potential File Download via MS-AppInstaller Protocol Handler](https://docs.query.ai/recipes/detect-potential-file-download-via-ms-appinstaller-protocol-handler.md)
- [Detect Potential File Extension Spoofing Using Right-to-Left Override](https://docs.query.ai/recipes/detect-potential-file-extension-spoofing-using-right-to-left-override.md)
- [Detect Potential Homoglyph Attacks in Filenames](https://docs.query.ai/recipes/detect-potential-homoglyph-attacks-in-filenames.md)
- [Detect Potential Invoke-Mimikatz PowerShell Script Activity](https://docs.query.ai/recipes/detect-potential-invoke-mimikatz-powershell-script-activity.md)
- [Detect Potential Kapeka Decrypted Backdoor Files](https://docs.query.ai/recipes/detect-potential-kapeka-decrypted-backdoor-files.md)
- [Detect Potential Keylogger Activity with FSQL](https://docs.query.ai/recipes/detect-potential-keylogger-activity-with-fsql.md)
- [Detect Potential Mfdetours.DLL Sideloading](https://docs.query.ai/recipes/detect-potential-mfdetoursdll-sideloading.md)
- [Detect Potential Packet Capture Activity Via Start-NetEventSession](https://docs.query.ai/recipes/detect-potential-packet-capture-activity-via-start-neteventsession.md)
- [Detect Potential Persistence via App Paths Registry Modification](https://docs.query.ai/recipes/detect-potential-persistence-via-app-paths-registry-modification.md)
- [Detect Potential Persistence via AutodialDLL Registry Key Modification](https://docs.query.ai/recipes/detect-potential-persistence-via-autodialdll-registry-key-modification.md)
- [Detect Potential Persistence via CHM Helper DLL Modification](https://docs.query.ai/recipes/detect-potential-persistence-via-chm-helper-dll-modification.md)
- [Detect Potential Persistence via Custom Protocol Handler](https://docs.query.ai/recipes/detect-potential-persistence-via-custom-protocol-handler.md)
- [Detect Potential Persistence via DLLPathOverride in Registry](https://docs.query.ai/recipes/detect-potential-persistence-via-dllpathoverride-in-registry.md)
- [Detect Potential Persistence via Event Viewer Events.asp](https://docs.query.ai/recipes/detect-potential-persistence-via-event-viewer-eventsasp.md)
- [Detect Potential Persistence via GlobalFlags or SilentProcessExit](https://docs.query.ai/recipes/detect-potential-persistence-via-globalflags-or-silentprocessexit.md)
- [Detect Potential Persistence via LSA Extensions](https://docs.query.ai/recipes/detect-potential-persistence-via-lsa-extensions.md)
- [Detect Potential Persistence Via Microsoft Office Add-In](https://docs.query.ai/recipes/detect-potential-persistence-via-microsoft-office-add-in.md)
- [Detect Potential Persistence Via Netsh Helper DLL](https://docs.query.ai/recipes/detect-potential-persistence-via-netsh-helper-dll.md)
- [Detect Potential Persistence via Office Startup Folder](https://docs.query.ai/recipes/detect-potential-persistence-via-office-startup-folder.md)
- [Detect Potential Persistence via Outlook Form Creation](https://docs.query.ai/recipes/detect-potential-persistence-via-outlook-form-creation.md)
- [Detect Potential Persistence via Outlook Home Page](https://docs.query.ai/recipes/detect-potential-persistence-via-outlook-home-page.md)
- [Detect Potential Persistence via Outlook LoadMacroProviderOnBoot Setting](https://docs.query.ai/recipes/detect-potential-persistence-via-outlook-loadmacroprovideronboot-setting.md)
- [Detect Potential Persistence via Scrobj.dll COM Hijacking](https://docs.query.ai/recipes/detect-potential-persistence-via-scrobjdll-com-hijacking.md)
- [Detect Potential Process Hollowing Activity](https://docs.query.ai/recipes/detect-potential-process-hollowing-activity.md)
- [Detect Potential Registry Persistence via DbgManagedDebugger](https://docs.query.ai/recipes/detect-potential-registry-persistence-via-dbgmanageddebugger.md)
- [Detect Potential Remote Credential Dumping Activity via CrackMapExec or Impacket-Secretsdump](https://docs.query.ai/recipes/detect-potential-remote-credential-dumping-activity-via-crackmapexec-or-impacket-secretsdump.md)
- [Detect Potential SAM Database Dumps](https://docs.query.ai/recipes/detect-potential-sam-database-dumps.md)
- [Detect Potential Shim Database Persistence via Sdbinst.EXE](https://docs.query.ai/recipes/detect-potential-shim-database-persistence-via-sdbinstexe.md)
- [Detect Potential Webshell Creation on Static Website](https://docs.query.ai/recipes/detect-potential-webshell-creation-on-static-website.md)
- [Detect PowerShell ADRecon Execution](https://docs.query.ai/recipes/detect-powershell-adrecon-execution.md)
- [Detect PowerShell Archiving to Temp Directories](https://docs.query.ai/recipes/detect-powershell-archiving-to-temp-directories.md)
- [Detect PowerShell Command History Disabling](https://docs.query.ai/recipes/detect-powershell-command-history-disabling.md)
- [Detect PowerShell Compression to Suspicious Temp Folders](https://docs.query.ai/recipes/detect-powershell-compression-to-suspicious-temp-folders.md)
- [Detect PowerShell Creating Binary/Script Files](https://docs.query.ai/recipes/detect-powershell-creating-binaryscript-files.md)
- [Detect PowerShell Decompress Commands](https://docs.query.ai/recipes/detect-powershell-decompress-commands.md)
- [Detect Powershell Executed From Headless ConHost Process](https://docs.query.ai/recipes/detect-powershell-executed-from-headless-conhost-process.md)
- [Detect PowerShell Get-Clipboard Activity](https://docs.query.ai/recipes/detect-powershell-get-clipboard-activity.md)
- [Detect PowerShell Get-Process LSASS in ScriptBlock using FSQL](https://docs.query.ai/recipes/detect-powershell-get-process-lsass-in-scriptblock-using-fsql.md)
- [Detect PowerShell History Clearing](https://docs.query.ai/recipes/detect-powershell-history-clearing-1.md)
- [Detect PowerShell History Clearing](https://docs.query.ai/recipes/detect-powershell-history-clearing.md)
- [Detect PowerShell Hotfix Enumeration](https://docs.query.ai/recipes/detect-powershell-hotfix-enumeration.md)
- [Detect PowerShell ICMP Exfiltration](https://docs.query.ai/recipes/detect-powershell-icmp-exfiltration.md)
- [Detect PowerShell Imports from Suspicious Directories](https://docs.query.ai/recipes/detect-powershell-imports-from-suspicious-directories.md)
- [Detect PowerShell Instance Creation via Named Pipe](https://docs.query.ai/recipes/detect-powershell-instance-creation-via-named-pipe.md)
- [Detect Powershell Local Email Collection](https://docs.query.ai/recipes/detect-powershell-local-email-collection.md)
- [Detect PowerShell LocalAccount Manipulation](https://docs.query.ai/recipes/detect-powershell-localaccount-manipulation.md)
- [Detect PowerShell Logging Disabled Via Registry Key Tampering](https://docs.query.ai/recipes/detect-powershell-logging-disabled-via-registry-key-tampering.md)
- [Detect PowerShell Module File Creation by Non-PowerShell Process](https://docs.query.ai/recipes/detect-powershell-module-file-creation-by-non-powershell-process.md)
- [Detect PowerShell MSI Installs via Win32_Product](https://docs.query.ai/recipes/detect-powershell-msi-installs-via-win32_product.md)
- [Detect PowerShell New-LocalUser Activity](https://docs.query.ai/recipes/detect-powershell-new-localuser-activity.md)
- [Detect PowerShell Obfuscation via Character Join](https://docs.query.ai/recipes/detect-powershell-obfuscation-via-character-join.md)
- [Detect PowerShell Profile Modifications](https://docs.query.ai/recipes/detect-powershell-profile-modifications.md)
- [Detect PowerShell Remote Session Creation](https://docs.query.ai/recipes/detect-powershell-remote-session-creation.md)
- [Detect PowerShell Remoting Enablement via FSQL](https://docs.query.ai/recipes/detect-powershell-remoting-enablement-via-fsql.md)
- [Detect PowerShell Root Certificate Installation](https://docs.query.ai/recipes/detect-powershell-root-certificate-installation.md)
- [Detect PowerShell Scheduled Task Creation](https://docs.query.ai/recipes/detect-powershell-scheduled-task-creation.md)
- [Detect PowerShell Script Changing Permissions via Set-Acl](https://docs.query.ai/recipes/detect-powershell-script-changing-permissions-via-set-acl.md)
- [Detect PowerShell Script Dropped Via PowerShell.EXE](https://docs.query.ai/recipes/detect-powershell-script-dropped-via-powershellexe.md)
- [Detect PowerShell Scripts Gathering Peripheral Device Information](https://docs.query.ai/recipes/detect-powershell-scripts-gathering-peripheral-device-information.md)
- [Detect PowerShell Scripts with File Reading and DNS Resolving](https://docs.query.ai/recipes/detect-powershell-scripts-with-file-reading-and-dns-resolving.md)
- [Detect PowerShell Scripts with File Upload Capabilities](https://docs.query.ai/recipes/detect-powershell-scripts-with-file-upload-capabilities.md)
- [Detect PowerShell Set-Acl on Windows Folder](https://docs.query.ai/recipes/detect-powershell-set-acl-on-windows-folder.md)
- [Detect PowerShell Software Discovery](https://docs.query.ai/recipes/detect-powershell-software-discovery.md)
- [Detect Powershell Virtualization Environment](https://docs.query.ai/recipes/detect-powershell-virtualization-environment.md)
- [Detect PowerShell Web Access Installation via PsScript](https://docs.query.ai/recipes/detect-powershell-web-access-installation-via-psscript.md)
- [Detect PowerShell Write-EventLog Usage with RawData](https://docs.query.ai/recipes/detect-powershell-write-eventlog-usage-with-rawdata.md)
- [Detect PowerShell Zip Activity in Temp Folders](https://docs.query.ai/recipes/detect-powershell-zip-activity-in-temp-folders.md)
- [Detect PowerSploit/Empire Scheduled Task Creation](https://docs.query.ai/recipes/detect-powersploitempire-scheduled-task-creation.md)
- [Detect PowerTool Execution](https://docs.query.ai/recipes/detect-powertool-execution.md)
- [Detect Prefetch File Deletion](https://docs.query.ai/recipes/detect-prefetch-file-deletion.md)
- [Detect Process Deletion of Its Own Executable](https://docs.query.ai/recipes/detect-process-deletion-of-its-own-executable.md)
- [Detect Process Monitor Driver Creation By Non-Sysinternals Binary](https://docs.query.ai/recipes/detect-process-monitor-driver-creation-by-non-sysinternals-binary.md)
- [Detect Process Reconnaissance via WMIC](https://docs.query.ai/recipes/detect-process-reconnaissance-via-wmic.md)
- [Detect PSAsyncShell Asynchronous TCP Reverse Shell](https://docs.query.ai/recipes/detect-psasyncshell-asynchronous-tcp-reverse-shell.md)
- [Detect PSAttack PowerShell Hack Tool Usage](https://docs.query.ai/recipes/detect-psattack-powershell-hack-tool-usage.md)
- [Detect PsExec Execution from Suspicious Locations via PipeName](https://docs.query.ai/recipes/detect-psexec-execution-from-suspicious-locations-via-pipename.md)
- [Detect PSScriptPolicyTest Creation By Uncommon Process](https://docs.query.ai/recipes/detect-psscriptpolicytest-creation-by-uncommon-process.md)
- [Detect PST Export Using New-ComplianceSearchAction](https://docs.query.ai/recipes/detect-pst-export-using-new-compliancesearchaction.md)
- [Detect Public AWS RDS Instance Restoration from Snapshot](https://docs.query.ai/recipes/detect-public-aws-rds-instance-restoration-from-snapshot.md)
- [Detect QuarksPwDump Dump File Creation](https://docs.query.ai/recipes/detect-quarkspwdump-dump-file-creation.md)
- [Detect Rclone Config File Creation](https://docs.query.ai/recipes/detect-rclone-config-file-creation.md)
- [Detect RDP Enable/Disable via Win32_TerminalServiceSetting WMI Class](https://docs.query.ai/recipes/detect-rdp-enabledisable-via-win32_terminalservicesetting-wmi-class.md)
- [Detect .RDP File Creation By Uncommon Applications](https://docs.query.ai/recipes/detect-rdp-file-creation-by-uncommon-applications.md)
- [Detect RDP Lateral Movement via Startup Folder Backdoor](https://docs.query.ai/recipes/detect-rdp-lateral-movement-via-startup-folder-backdoor.md)
- [Detect RDP Remote Assistance Feature Enabled via Registry](https://docs.query.ai/recipes/detect-rdp-remote-assistance-feature-enabled-via-registry.md)
- [Detect RDP Sensitive Settings Changed to Zero](https://docs.query.ai/recipes/detect-rdp-sensitive-settings-changed-to-zero.md)
- [Detect RDS Security Group Modifications](https://docs.query.ai/recipes/detect-rds-security-group-modifications.md)
- [Detect Register New IFilter For Persistence](https://docs.query.ai/recipes/detect-register-new-ifilter-for-persistence.md)
- [Detect Registry Entries for Azorult Malware](https://docs.query.ai/recipes/detect-registry-entries-for-azorult-malware.md)
- [Detect Registry Index Value Removal to Hide Scheduled Task](https://docs.query.ai/recipes/detect-registry-index-value-removal-to-hide-scheduled-task.md)
- [Detect Registry Key Deletion for Defender Scan Context Menu](https://docs.query.ai/recipes/detect-registry-key-deletion-for-defender-scan-context-menu.md)
- [Detect Registry Modification of Screensaver Binary Path](https://docs.query.ai/recipes/detect-registry-modification-of-screensaver-binary-path.md)
- [Detect Registry Modification to Hide File Extension](https://docs.query.ai/recipes/detect-registry-modification-to-hide-file-extension.md)
- [Detect Registry Modification via VBScript in PowerShell](https://docs.query.ai/recipes/detect-registry-modification-via-vbscript-in-powershell.md)
- [Detect Registry Modifications Disabling Internal Tools](https://docs.query.ai/recipes/detect-registry-modifications-disabling-internal-tools.md)
- [Detect Registry Modifications to Disable Privacy Settings Experience](https://docs.query.ai/recipes/detect-registry-modifications-to-disable-privacy-settings-experience.md)
- [Detect Registry Persistence via Port Monitors](https://docs.query.ai/recipes/detect-registry-persistence-via-port-monitors.md)
- [Detect Registry Persistence via Windows Telemetry](https://docs.query.ai/recipes/detect-registry-persistence-via-windows-telemetry.md)
- [Detect Registry Tampering by Suspicious Processes](https://docs.query.ai/recipes/detect-registry-tampering-by-suspicious-processes.md)
- [Detect RemCom Default Named Pipe Creation](https://docs.query.ai/recipes/detect-remcom-default-named-pipe-creation.md)
- [Detect Remote Code Execution via Winrm.vbs](https://docs.query.ai/recipes/detect-remote-code-execution-via-winrmvbs.md)
- [Detect Remote Connection via Anonymous Computer - AllowAnonymousCallback](https://docs.query.ai/recipes/detect-remote-connection-via-anonymous-computer-allowanonymouscallback.md)
- [Detect Remote File Download via Findstr](https://docs.query.ai/recipes/detect-remote-file-download-via-findstr.md)
- [Detect Remote LSASS Process Access via WinRM](https://docs.query.ai/recipes/detect-remote-lsass-process-access-via-winrm.md)
- [Detect Remote PowerShell Sessions via PS Module Logs](https://docs.query.ai/recipes/detect-remote-powershell-sessions-via-ps-module-logs.md)
- [Detect Remote PowerShell Sessions](https://docs.query.ai/recipes/detect-remote-powershell-sessions.md)
- [Detect Remote Thread Creation in KeePass.exe](https://docs.query.ai/recipes/detect-remote-thread-creation-in-keepassexe.md)
- [Detect Remote Thread Creation via PowerShell in Uncommon Target Processes](https://docs.query.ai/recipes/detect-remote-thread-creation-via-powershell-in-uncommon-target-processes.md)
- [Detect Remote Thread Creation via Ttdinject.exe](https://docs.query.ai/recipes/detect-remote-thread-creation-via-ttdinjectexe.md)
- [Detect RemoteKrbRelay SMB Relay Secrets Dump Module File Creation](https://docs.query.ai/recipes/detect-remotekrbrelay-smb-relay-secrets-dump-module-file-creation.md)
- [Detect Remotely Hosted HTA File Execution via Mshta.EXE](https://docs.query.ai/recipes/detect-remotely-hosted-hta-file-execution-via-mshtaexe.md)
- [Detect Renamed Powershell Execution](https://docs.query.ai/recipes/detect-renamed-powershell-execution.md)
- [Detect Renamed Sysinternals Sdelete Execution](https://docs.query.ai/recipes/detect-renamed-sysinternals-sdelete-execution.md)
- [Detect Roles Assigned Outside PIM](https://docs.query.ai/recipes/detect-roles-assigned-outside-pim.md)
- [Detect Rubeus HackTool Execution via ScriptBlock Logs](https://docs.query.ai/recipes/detect-rubeus-hacktool-execution-via-scriptblock-logs.md)
- [Detect Run Once Task Configuration in Registry](https://docs.query.ai/recipes/detect-run-once-task-configuration-in-registry.md)
- [Detect Rundll32 Execution Without Parameters](https://docs.query.ai/recipes/detect-rundll32-execution-without-parameters.md)
- [Detect RunMRU Registry Key Deletion](https://docs.query.ai/recipes/detect-runmru-registry-key-deletion.md)
- [Detect RURAT Execution From Unusual Locations](https://docs.query.ai/recipes/detect-rurat-execution-from-unusual-locations.md)
- [Detect S3Browser IAM Policy with Default Bucket Name](https://docs.query.ai/recipes/detect-s3browser-iam-policy-with-default-bucket-name.md)
- [Detect Scheduled TaskCache Change by Uncommon Program](https://docs.query.ai/recipes/detect-scheduled-taskcache-change-by-uncommon-program.md)
- [Detect SCR File Write Events Outside System Folders](https://docs.query.ai/recipes/detect-scr-file-write-events-outside-system-folders.md)
- [Detect ScreenConnect Remote Access Tool Execution](https://docs.query.ai/recipes/detect-screenconnect-remote-access-tool-execution.md)
- [Detect ScreenConnect Temporary File Creation](https://docs.query.ai/recipes/detect-screenconnect-temporary-file-creation.md)
- [Detect ScreenSaver Registry Key Set via Rundll32](https://docs.query.ai/recipes/detect-screensaver-registry-key-set-via-rundll32.md)
- [Detect Seatbelt Execution via Command-Line Analysis](https://docs.query.ai/recipes/detect-seatbelt-execution-via-command-line-analysis.md)
- [Detect Security Event Logging Disabled via MiniNt Registry Key](https://docs.query.ai/recipes/detect-security-event-logging-disabled-via-minint-registry-key.md)
- [Detect Security Software Discovery Via Powershell Script](https://docs.query.ai/recipes/detect-security-software-discovery-via-powershell-script.md)
- [Detect SharpEvtMute HackTool DLL Load via FSQL](https://docs.query.ai/recipes/detect-sharpevtmute-hacktool-dll-load-via-fsql.md)
- [Detect SharpWSUS/WSUSpendu Execution via FSQL](https://docs.query.ai/recipes/detect-sharpwsuswsuspendu-execution-via-fsql.md)
- [Detect Shell Open Registry Key Manipulation for Persistence and UAC Bypass](https://docs.query.ai/recipes/detect-shell-open-registry-key-manipulation-for-persistence-and-uac-bypass.md)
- [Detect Sign-in Failures Due to Conditional Access](https://docs.query.ai/recipes/detect-sign-in-failures-due-to-conditional-access.md)
- [Detect Sign-ins from Anonymous IP Addresses](https://docs.query.ai/recipes/detect-sign-ins-from-anonymous-ip-addresses.md)
- [Detect SILENTTRINITY Stager Execution via PE Metadata](https://docs.query.ai/recipes/detect-silenttrinity-stager-execution-via-pe-metadata.md)
- [Detect SSP Added to LSA Configuration](https://docs.query.ai/recipes/detect-ssp-added-to-lsa-configuration.md)
- [Detect Sticky Key Backdoor Usage via Registry Modification](https://docs.query.ai/recipes/detect-sticky-key-backdoor-usage-via-registry-modification.md)
- [Detect Successful Authentications From Unapproved Countries](https://docs.query.ai/recipes/detect-successful-authentications-from-unapproved-countries.md)
- [Detect Suspicious Application Allowed Through Exploit Guard via FSQL](https://docs.query.ai/recipes/detect-suspicious-application-allowed-through-exploit-guard-via-fsql.md)
- [Detect Suspicious ASP.NET Compilation Paths](https://docs.query.ai/recipes/detect-suspicious-aspnet-compilation-paths.md)
- [Detect Suspicious ASPX File Drop by Exchange](https://docs.query.ai/recipes/detect-suspicious-aspx-file-drop-by-exchange.md)
- [Detect Suspicious Binaries and Scripts in Public Folder using FSQL](https://docs.query.ai/recipes/detect-suspicious-binaries-and-scripts-in-public-folder-using-fsql.md)
- [Detect Suspicious Binaries Dropped in Spool Drivers Color Folder](https://docs.query.ai/recipes/detect-suspicious-binaries-dropped-in-spool-drivers-color-folder.md)
- [Detect Suspicious CertReq Command to Download with FSQL](https://docs.query.ai/recipes/detect-suspicious-certreq-command-to-download-with-fsql.md)
- [Detect Suspicious Certutil File Downloads from Direct IPs](https://docs.query.ai/recipes/detect-suspicious-certutil-file-downloads-from-direct-ips.md)
- [Detect Suspicious CodePage Switch via CHCP](https://docs.query.ai/recipes/detect-suspicious-codepage-switch-via-chcp.md)
- [Detect Suspicious Commands via Run Dialog Box - Registry](https://docs.query.ai/recipes/detect-suspicious-commands-via-run-dialog-box-registry.md)
- [Detect Suspicious Compression with Compress-Archive](https://docs.query.ai/recipes/detect-suspicious-compression-with-compress-archive.md)
- [Detect Suspicious Computer Machine Password Reset via PowerShell](https://docs.query.ai/recipes/detect-suspicious-computer-machine-password-reset-via-powershell.md)
- [Detect Suspicious Dbgcore/Dbghelp DLL Loads from Uncommon Locations](https://docs.query.ai/recipes/detect-suspicious-dbgcoredbghelp-dll-loads-from-uncommon-locations.md)
- [Detect Suspicious Desktop Background Change via Reg.exe](https://docs.query.ai/recipes/detect-suspicious-desktop-background-change-via-regexe.md)
- [Detect Suspicious Desktopimgdownldr File Creation](https://docs.query.ai/recipes/detect-suspicious-desktopimgdownldr-file-creation.md)
- [Detect Suspicious DMP/HDMP File Creation via FSQL](https://docs.query.ai/recipes/detect-suspicious-dmphdmp-file-creation-via-fsql.md)
- [Detect Suspicious Electron App Command Lines](https://docs.query.ai/recipes/detect-suspicious-electron-app-command-lines.md)
- [Detect Suspicious Encoded Scripts in WMI Consumer](https://docs.query.ai/recipes/detect-suspicious-encoded-scripts-in-wmi-consumer.md)
- [Detect Suspicious Eventlog Clearing via PowerShell](https://docs.query.ai/recipes/detect-suspicious-eventlog-clearing-via-powershell.md)
- [Detect Suspicious Executable File Creation](https://docs.query.ai/recipes/detect-suspicious-executable-file-creation.md)
- [Detect Suspicious File Access to Browser Credential Storage](https://docs.query.ai/recipes/detect-suspicious-file-access-to-browser-credential-storage.md)
- [Detect Suspicious File Creation by ArcSOC.exe](https://docs.query.ai/recipes/detect-suspicious-file-creation-by-arcsocexe.md)
- [Detect Suspicious File Creation by Colorcpl.exe](https://docs.query.ai/recipes/detect-suspicious-file-creation-by-colorcplexe.md)
- [Detect Suspicious File Creation in Fake Recycle Bin](https://docs.query.ai/recipes/detect-suspicious-file-creation-in-fake-recycle-bin.md)
- [Detect Suspicious File Creation in Uncommon AppData Folder](https://docs.query.ai/recipes/detect-suspicious-file-creation-in-uncommon-appdata-folder.md)
- [Detect Suspicious File Creation via OneNote](https://docs.query.ai/recipes/detect-suspicious-file-creation-via-onenote.md)
- [Detect Suspicious File Drop by Exchange via FSQL](https://docs.query.ai/recipes/detect-suspicious-file-drop-by-exchange-via-fsql.md)
- [Detect Suspicious File Write to SharePoint Layouts Directory](https://docs.query.ai/recipes/detect-suspicious-file-write-to-sharepoint-layouts-directory.md)
- [Detect Suspicious FileFix Execution Pattern](https://docs.query.ai/recipes/detect-suspicious-filefix-execution-pattern.md)
- [Detect Suspicious Files Created in PerfLogs Directory](https://docs.query.ai/recipes/detect-suspicious-files-created-in-perflogs-directory.md)
- [Detect Suspicious Files in Default GPO Folder](https://docs.query.ai/recipes/detect-suspicious-files-in-default-gpo-folder.md)
- [Detect Suspicious Get Information for SMB Share Using PowerShell Module](https://docs.query.ai/recipes/detect-suspicious-get-information-for-smb-share-using-powershell-module.md)
- [Detect Suspicious GetTypeFromCLSID ShellExecute via Powershell](https://docs.query.ai/recipes/detect-suspicious-gettypefromclsid-shellexecute-via-powershell.md)
- [Detect Suspicious GPO Discovery Using Get-GPO Cmdlet](https://docs.query.ai/recipes/detect-suspicious-gpo-discovery-using-get-gpo-cmdlet.md)
- [Detect Suspicious GrantedAccess Flags on LSASS](https://docs.query.ai/recipes/detect-suspicious-grantedaccess-flags-on-lsass.md)
- [Detect Suspicious Inbox Forwarding via FSQL](https://docs.query.ai/recipes/detect-suspicious-inbox-forwarding-via-fsql.md)
- [Detect Suspicious Interactive PowerShell as SYSTEM](https://docs.query.ai/recipes/detect-suspicious-interactive-powershell-as-system.md)
- [Detect Suspicious Invoke-Item From Mount-DiskImage](https://docs.query.ai/recipes/detect-suspicious-invoke-item-from-mount-diskimage.md)
- [Detect Suspicious Kerberos Ticket Request via PowerShell Script](https://docs.query.ai/recipes/detect-suspicious-kerberos-ticket-request-via-powershell-script.md)
- [Detect Suspicious LNK Double Extension File Creation](https://docs.query.ai/recipes/detect-suspicious-lnk-double-extension-file-creation.md)
- [Detect Suspicious Microsoft Office Child Processes](https://docs.query.ai/recipes/detect-suspicious-microsoft-office-child-processes.md)
- [Detect Suspicious Mount-DiskImage Activity](https://docs.query.ai/recipes/detect-suspicious-mount-diskimage-activity.md)
- [Detect Suspicious MSExchangeMailboxReplication ASPX Write](https://docs.query.ai/recipes/detect-suspicious-msexchangemailboxreplication-aspx-write.md)
- [Detect Suspicious .NET CLR Usage Log Artifacts](https://docs.query.ai/recipes/detect-suspicious-net-clr-usage-log-artifacts.md)
- [Detect Suspicious Network Scanning Using Command-Line Loops](https://docs.query.ai/recipes/detect-suspicious-network-scanning-using-command-line-loops.md)
- [Detect Suspicious ODBC Driver Registration](https://docs.query.ai/recipes/detect-suspicious-odbc-driver-registration.md)
- [Detect Suspicious Odbcconf.EXE Execution with Non-Standard Response File](https://docs.query.ai/recipes/detect-suspicious-odbcconfexe-execution-with-non-standard-response-file.md)
- [Detect Suspicious Outlook Macro Creation](https://docs.query.ai/recipes/detect-suspicious-outlook-macro-creation.md)
- [Detect Suspicious Parent Double Extension File Execution](https://docs.query.ai/recipes/detect-suspicious-parent-double-extension-file-execution.md)
- [Detect Suspicious Path in Keyboard Layout IME File Registry Value](https://docs.query.ai/recipes/detect-suspicious-path-in-keyboard-layout-ime-file-registry-value.md)
- [Detect Suspicious Ping/Copy Command Combination](https://docs.query.ai/recipes/detect-suspicious-pingcopy-command-combination.md)
- [Detect Suspicious PowerShell Download Activity](https://docs.query.ai/recipes/detect-suspicious-powershell-download-activity.md)
- [Detect Suspicious PowerShell Download Using System.Net.WebClient](https://docs.query.ai/recipes/detect-suspicious-powershell-download-using-systemnetwebclient.md)
- [Detect Suspicious PowerShell Hidden Window Style](https://docs.query.ai/recipes/detect-suspicious-powershell-hidden-window-style.md)
- [Detect Suspicious PowerShell in Registry Run Keys](https://docs.query.ai/recipes/detect-suspicious-powershell-in-registry-run-keys.md)
- [Detect Suspicious PowerShell Invocations](https://docs.query.ai/recipes/detect-suspicious-powershell-invocations-1.md)
- [Detect Suspicious PowerShell Invocations](https://docs.query.ai/recipes/detect-suspicious-powershell-invocations-2.md)
- [Detect Suspicious PowerShell Invocations](https://docs.query.ai/recipes/detect-suspicious-powershell-invocations.md)
- [Detect Suspicious PowerShell Local Group Enumeration](https://docs.query.ai/recipes/detect-suspicious-powershell-local-group-enumeration.md)
- [Detect Suspicious PowerShell Mailbox SMTP Forward Rule](https://docs.query.ai/recipes/detect-suspicious-powershell-mailbox-smtp-forward-rule.md)
- [Detect Suspicious PowerShell Module File Creation](https://docs.query.ai/recipes/detect-suspicious-powershell-module-file-creation.md)
- [Detect Suspicious Printer Driver Installation with Empty Manufacturer](https://docs.query.ai/recipes/detect-suspicious-printer-driver-installation-with-empty-manufacturer.md)
- [Detect Suspicious Process Discovery with Get-Process](https://docs.query.ai/recipes/detect-suspicious-process-discovery-with-get-process.md)
- [Detect Suspicious Program Names and Command-Lines](https://docs.query.ai/recipes/detect-suspicious-program-names-and-command-lines.md)
- [Detect Suspicious Regsvr32 HTTP IP Pattern](https://docs.query.ai/recipes/detect-suspicious-regsvr32-http-ip-pattern.md)
- [Detect Suspicious Run Key Creation from Downloaded Files](https://docs.query.ai/recipes/detect-suspicious-run-key-creation-from-downloaded-files.md)
- [Detect Suspicious Scheduled Task Creation in System32 Tasks](https://docs.query.ai/recipes/detect-suspicious-scheduled-task-creation-in-system32-tasks.md)
- [Detect Suspicious Scheduled Task Creation Involving Temp Folder](https://docs.query.ai/recipes/detect-suspicious-scheduled-task-creation-involving-temp-folder.md)
- [Detect Suspicious Scripting in WMI Consumers](https://docs.query.ai/recipes/detect-suspicious-scripting-in-wmi-consumers.md)
- [Detect Suspicious Self Extraction Directive File Creation](https://docs.query.ai/recipes/detect-suspicious-self-extraction-directive-file-creation.md)
- [Detect Suspicious Service DACL Modification via Set-Service Cmdlet](https://docs.query.ai/recipes/detect-suspicious-service-dacl-modification-via-set-service-cmdlet.md)
- [Detect Suspicious ShellExec_RunDLL Call Via Ordinal](https://docs.query.ai/recipes/detect-suspicious-shellexec_rundll-call-via-ordinal.md)
- [Detect Suspicious Shim Database Patching Activity](https://docs.query.ai/recipes/detect-suspicious-shim-database-patching-activity.md)
- [Detect Suspicious Startup Folder Persistence](https://docs.query.ai/recipes/detect-suspicious-startup-folder-persistence.md)
- [Detect Suspicious Sysinternals Tool Usage via Registry Key Creation](https://docs.query.ai/recipes/detect-suspicious-sysinternals-tool-usage-via-registry-key-creation.md)
- [Detect Suspicious SYSTEM User Process Creation](https://docs.query.ai/recipes/detect-suspicious-system-user-process-creation.md)
- [Detect Suspicious TXT File Creation in User Desktop via Command Prompt](https://docs.query.ai/recipes/detect-suspicious-txt-file-creation-in-user-desktop-via-command-prompt.md)
- [Detect Suspicious Unblock-File Usage](https://docs.query.ai/recipes/detect-suspicious-unblock-file-usage.md)
- [Detect Suspicious vss_ps.dll Load](https://docs.query.ai/recipes/detect-suspicious-vss_psdll-load.md)
- [Detect Suspicious Vsstrace.dll Load](https://docs.query.ai/recipes/detect-suspicious-vsstracedll-load.md)
- [Detect Suspicious WDAC Policy File Creation](https://docs.query.ai/recipes/detect-suspicious-wdac-policy-file-creation.md)
- [Detect Suspicious Win32_NTEventlogFile Class Usage in PowerShell Scripts](https://docs.query.ai/recipes/detect-suspicious-win32_nteventlogfile-class-usage-in-powershell-scripts.md)
- [Detect Suspicious Windows Feature Enabling via PowerShell](https://docs.query.ai/recipes/detect-suspicious-windows-feature-enabling-via-powershell.md)
- [Detect Suspicious WindowsTerminal Child Processes](https://docs.query.ai/recipes/detect-suspicious-windowsterminal-child-processes.md)
- [Detect SyncAppvPublishingServer Execution to Bypass PowerShell Restriction](https://docs.query.ai/recipes/detect-syncappvpublishingserver-execution-to-bypass-powershell-restriction.md)
- [Detect Sysinternals Tool Execution via Registry Key Creation](https://docs.query.ai/recipes/detect-sysinternals-tool-execution-via-registry-key-creation.md)
- [Detect Sysinternals Tools Execution via Registry Key Creation](https://docs.query.ai/recipes/detect-sysinternals-tools-execution-via-registry-key-creation.md)
- [Detect Sysmon Driver Altitude Changes](https://docs.query.ai/recipes/detect-sysmon-driver-altitude-changes.md)
- [Detect Sysmon Uninstallation Attempts](https://docs.query.ai/recipes/detect-sysmon-uninstallation-attempts.md)
- [Detect System Process Names in Unsuspected Locations](https://docs.query.ai/recipes/detect-system-process-names-in-unsuspected-locations.md)
- [Detect Tampering Attempts on Sophos AV Registry Keys](https://docs.query.ai/recipes/detect-tampering-attempts-on-sophos-av-registry-keys.md)
- [Detect Tampering of Windows Defender via Remove-MpPreference](https://docs.query.ai/recipes/detect-tampering-of-windows-defender-via-remove-mppreference.md)
- [Detect Tampering of Windows Defender via ScriptBlockLogging](https://docs.query.ai/recipes/detect-tampering-of-windows-defender-via-scriptblocklogging.md)
- [Detect Terminal Server Client Connection History Cleared via Registry Deletion](https://docs.query.ai/recipes/detect-terminal-server-client-connection-history-cleared-via-registry-deletion.md)
- [Detect Tomcat WebServer Logs Deletion](https://docs.query.ai/recipes/detect-tomcat-webserver-logs-deletion.md)
- [Detect TruffleHog Execution in AWS Environment](https://docs.query.ai/recipes/detect-trufflehog-execution-in-aws-environment.md)
- [Detect TruffleHog Execution](https://docs.query.ai/recipes/detect-trufflehog-execution.md)
- [Detect UAC Bypass Using Event Viewer](https://docs.query.ai/recipes/detect-uac-bypass-using-event-viewer.md)
- [Detect UAC Bypass Using MSConfig Token Modification - File Creation](https://docs.query.ai/recipes/detect-uac-bypass-using-msconfig-token-modification-file-creation.md)
- [Detect UAC Bypass Using .NET Code Profiler on MMC](https://docs.query.ai/recipes/detect-uac-bypass-using-net-code-profiler-on-mmc.md)
- [Detect UAC Bypass Using Windows Media Player - File Creation](https://docs.query.ai/recipes/detect-uac-bypass-using-windows-media-player-file-creation.md)
- [Detect UAC Bypass via Winsat Path Parsing](https://docs.query.ai/recipes/detect-uac-bypass-via-winsat-path-parsing.md)
- [Detect UAC Notification Disabled via Registry Tampering](https://docs.query.ai/recipes/detect-uac-notification-disabled-via-registry-tampering.md)
- [Detect UAC Secure Desktop Prompt Disabled via Registry Modification](https://docs.query.ai/recipes/detect-uac-secure-desktop-prompt-disabled-via-registry-modification.md)
- [Detect Unsigned DLLs Loaded by Windows Utilities](https://docs.query.ai/recipes/detect-unsigned-dlls-loaded-by-windows-utilities.md)
- [Detect Updates to User Risk and MFA Registration Policy](https://docs.query.ai/recipes/detect-updates-to-user-risk-and-mfa-registration-policy.md)
- [Detect Use of Short Name Path in Image](https://docs.query.ai/recipes/detect-use-of-short-name-path-in-image.md)
- [Detect User Access Blocked by Azure Conditional Access](https://docs.query.ai/recipes/detect-user-access-blocked-by-azure-conditional-access.md)
- [Detect User Added to Azure AD Admin Role](https://docs.query.ai/recipes/detect-user-added-to-azure-ad-admin-role.md)
- [Detect User Discovery and Export via Get-ADUser Cmdlet in PowerShell](https://docs.query.ai/recipes/detect-user-discovery-and-export-via-get-aduser-cmdlet-in-powershell.md)
- [Detect User Removal From Group](https://docs.query.ai/recipes/detect-user-removal-from-group.md)
- [Detect Users Added to Global or Device Admin Roles](https://docs.query.ai/recipes/detect-users-added-to-global-or-device-admin-roles.md)
- [Detect Users Authenticating To Other Azure AD Tenants](https://docs.query.ai/recipes/detect-users-authenticating-to-other-azure-ad-tenants.md)
- [Detect VBScript Payload Stored in Registry](https://docs.query.ai/recipes/detect-vbscript-payload-stored-in-registry.md)
- [Detect VHD Image Download Via Browser](https://docs.query.ai/recipes/detect-vhd-image-download-via-browser.md)
- [Detect Volume Shadow Copy Creation with PowerShell](https://docs.query.ai/recipes/detect-volume-shadow-copy-creation-with-powershell.md)
- [Detect Volume Shadow Copy Deletion via WMI with PowerShell](https://docs.query.ai/recipes/detect-volume-shadow-copy-deletion-via-wmi-with-powershell.md)
- [Detect VolumeShadowCopy Symlink Creation Via Mklink](https://docs.query.ai/recipes/detect-volumeshadowcopy-symlink-creation-via-mklink.md)
- [Detect WFP Filter Added via Registry Modification](https://docs.query.ai/recipes/detect-wfp-filter-added-via-registry-modification.md)
- [Detect Windows Binaries Writing Suspicious Extensions](https://docs.query.ai/recipes/detect-windows-binaries-writing-suspicious-extensions.md)
- [Detect Windows Binary Executed From WSL](https://docs.query.ai/recipes/detect-windows-binary-executed-from-wsl.md)
- [Detect Windows Credential Editor Registry Activity](https://docs.query.ai/recipes/detect-windows-credential-editor-registry-activity.md)
- [Detect Windows Defender Exclusions Added via PowerShell](https://docs.query.ai/recipes/detect-windows-defender-exclusions-added-via-powershell.md)
- [Detect Windows Defender Exclusions Added via Registry](https://docs.query.ai/recipes/detect-windows-defender-exclusions-added-via-registry.md)
- [Detect Windows Defender Functionality Disabling via Registry Keys](https://docs.query.ai/recipes/detect-windows-defender-functionality-disabling-via-registry-keys.md)
- [Detect Windows Defender Tampering via PowerShell](https://docs.query.ai/recipes/detect-windows-defender-tampering-via-powershell.md)
- [Detect Windows Defender Tampering via Remove-MpPreference](https://docs.query.ai/recipes/detect-windows-defender-tampering-via-remove-mppreference.md)
- [Detect Windows Defender Tampering via WMIC](https://docs.query.ai/recipes/detect-windows-defender-tampering-via-wmic.md)
- [Detect Windows Defender Threat Severity Default Action Modification](https://docs.query.ai/recipes/detect-windows-defender-threat-severity-default-action-modification.md)
- [Detect Windows Firewall Profile Disabled via PowerShell](https://docs.query.ai/recipes/detect-windows-firewall-profile-disabled-via-powershell.md)
- [Detect Windows LAPS Credential Dump From Entra ID](https://docs.query.ai/recipes/detect-windows-laps-credential-dump-from-entra-id.md)
- [Detect Windows Recall Enabled by Deleted Registry Value](https://docs.query.ai/recipes/detect-windows-recall-enabled-by-deleted-registry-value.md)
- [Detect Windows Recall Feature Enabled via Registry](https://docs.query.ai/recipes/detect-windows-recall-feature-enabled-via-registry.md)
- [Detect Windows Registry Trust Record Modification](https://docs.query.ai/recipes/detect-windows-registry-trust-record-modification.md)
- [Detect Windows Screen Capture using CopyFromScreen](https://docs.query.ai/recipes/detect-windows-screen-capture-using-copyfromscreen.md)
- [Detect Windows Shell/Scripting File Writes to Suspicious Folders](https://docs.query.ai/recipes/detect-windows-shellscripting-file-writes-to-suspicious-folders.md)
- [Detect Windows Terminal Profile Modification by Uncommon Process](https://docs.query.ai/recipes/detect-windows-terminal-profile-modification-by-uncommon-process.md)
- [Detect Winlogon Helper DLL Loading via Registry Modification](https://docs.query.ai/recipes/detect-winlogon-helper-dll-loading-via-registry-modification.md)
- [Detect Winnti Dropper File Creation](https://docs.query.ai/recipes/detect-winnti-dropper-file-creation.md)
- [Detect WinPwn Execution via ScriptBlock Content](https://docs.query.ai/recipes/detect-winpwn-execution-via-scriptblock-content.md)
- [Detect WMI ActiveScriptEventConsumers Activity via Scrcons.EXE DLL Load](https://docs.query.ai/recipes/detect-wmi-activescripteventconsumers-activity-via-scrconsexe-dll-load.md)
- [Detect WMI Backdoor in Exchange Transport Agent](https://docs.query.ai/recipes/detect-wmi-backdoor-in-exchange-transport-agent.md)
- [Detect WMI Event Consumer Creating Named Pipe](https://docs.query.ai/recipes/detect-wmi-event-consumer-creating-named-pipe.md)
- [Detect WMI Event Subscription Creation](https://docs.query.ai/recipes/detect-wmi-event-subscription-creation.md)
- [Detect WMI Lateral Movement with WmiPrvSE Spawning PowerShell](https://docs.query.ai/recipes/detect-wmi-lateral-movement-with-wmiprvse-spawning-powershell.md)
- [Detect WMI Persistence via Script Event Consumer File Write](https://docs.query.ai/recipes/detect-wmi-persistence-via-script-event-consumer-file-write.md)
- [Detect WMImplant Hack Tool Usage](https://docs.query.ai/recipes/detect-wmimplant-hack-tool-usage.md)
- [Detect Wow6432Node Autorun Key Modifications](https://docs.query.ai/recipes/detect-wow6432node-autorun-key-modifications.md)
- [Detecting Account Removal from Domain Admin Group via FSQL](https://docs.query.ai/recipes/detecting-account-removal-from-domain-admin-group-via-fsql.md)
- [Detecting Active Directory Enumeration via PowerShell AD Module](https://docs.query.ai/recipes/detecting-active-directory-enumeration-via-powershell-ad-module.md)
- [Detecting Active Directory Group Enumeration with Get-AdGroup Cmdlet](https://docs.query.ai/recipes/detecting-active-directory-group-enumeration-with-get-adgroup-cmdlet.md)
- [Detecting Active Directory Manipulation via System.DirectoryServices.AccountManagement](https://docs.query.ai/recipes/detecting-active-directory-manipulation-via-systemdirectoryservicesaccountmanagement.md)
- [Detecting AdvancedRun Execution](https://docs.query.ai/recipes/detecting-advancedrun-execution.md)
- [Detecting Alternate PowerShell Hosts via Named Pipes](https://docs.query.ai/recipes/detecting-alternate-powershell-hosts-via-named-pipes.md)
- [Detecting Alternate PowerShell Hosts](https://docs.query.ai/recipes/detecting-alternate-powershell-hosts.md)
- [Detecting AppCertDlls Registry Key Modifications for Persistence](https://docs.query.ai/recipes/detecting-appcertdlls-registry-key-modifications-for-persistence.md)
- [Detecting Application Permission Grants in Microsoft Azure](https://docs.query.ai/recipes/detecting-application-permission-grants-in-microsoft-azure.md)
- [Detecting Application Use of Device Code Authentication Flow](https://docs.query.ai/recipes/detecting-application-use-of-device-code-authentication-flow.md)
- [Detecting AS-REP Roasting Reconnaissance via Get-ADUser Enumeration](https://docs.query.ai/recipes/detecting-as-rep-roasting-reconnaissance-via-get-aduser-enumeration.md)
- [Detecting Automated Collection Commands in PowerShell Scripts](https://docs.query.ai/recipes/detecting-automated-collection-commands-in-powershell-scripts.md)
- [Detecting AWS RDS Cluster Modifications or Deletions](https://docs.query.ai/recipes/detecting-aws-rds-cluster-modifications-or-deletions.md)
- [Detecting AWS SecurityHub Findings Evasion](https://docs.query.ai/recipes/detecting-aws-securityhub-findings-evasion.md)
- [Detecting Azure CloudShell Creation with FSQL](https://docs.query.ai/recipes/detecting-azure-cloudshell-creation-with-fsql.md)
- [Detecting Azure Permission Grants](https://docs.query.ai/recipes/detecting-azure-permission-grants.md)
- [Detecting AzureHound Activity via User-Agent](https://docs.query.ai/recipes/detecting-azurehound-activity-via-user-agent.md)
- [Detecting Backup Deletion via Wbadmin.EXE](https://docs.query.ai/recipes/detecting-backup-deletion-via-wbadminexe.md)
- [Detecting Bad Opsec PowerShell Code Artifacts](https://docs.query.ai/recipes/detecting-bad-opsec-powershell-code-artifacts.md)
- [Detecting Base64/Hex Decoding via Certutil.EXE](https://docs.query.ai/recipes/detecting-base64hex-decoding-via-certutilexe.md)
- [Detecting Batch Script Execution via PowerShell](https://docs.query.ai/recipes/detecting-batch-script-execution-via-powershell.md)
- [Detecting Browser Login Data Access via PowerShell](https://docs.query.ai/recipes/detecting-browser-login-data-access-via-powershell.md)
- [Detecting Changes to PIM Settings](https://docs.query.ai/recipes/detecting-changes-to-pim-settings.md)
- [Detecting Chrome VPN Extension Installation via Registry Modification](https://docs.query.ai/recipes/detecting-chrome-vpn-extension-installation-via-registry-modification.md)
- [Detecting Cisco ASA Exploitation Activity (detecting-cisco-asa-exploitation-activity)](https://docs.query.ai/recipes/detecting-cisco-asa-exploitation-activity-detecting-cisco-asa-exploitation-activity.md)
- [Detecting Clipboard Data Collection via pbpaste (detecting-clipboard-data-collection-via-pbpaste)](https://docs.query.ai/recipes/detecting-clipboard-data-collection-via-pbpaste-detecting-clipboard-data-collection-via-pbpaste.md)
- [Detecting CoercedPotato Hacktool Execution](https://docs.query.ai/recipes/detecting-coercedpotato-hacktool-execution.md)
- [Detecting COM Hijacking Registry Key Deletion](https://docs.query.ai/recipes/detecting-com-hijacking-registry-key-deletion.md)
- [Detecting Computer Discovery and Export via Get-ADComputer Cmdlet in PowerShell](https://docs.query.ai/recipes/detecting-computer-discovery-and-export-via-get-adcomputer-cmdlet-in-powershell.md)
- [Detecting ConvertTo-SecureString Cmdlet Usage in Command Line](https://docs.query.ai/recipes/detecting-convertto-securestring-cmdlet-usage-in-command-line.md)
- [Detecting COR Profiler Environment Variables with FSQL](https://docs.query.ai/recipes/detecting-cor-profiler-environment-variables-with-fsql.md)
- [Detecting Credential Access Attempts via PowerShell Script Analysis](https://docs.query.ai/recipes/detecting-credential-access-attempts-via-powershell-script-analysis.md)
- [Detecting Credential Dumping from Windows Credential Manager Using PowerShell](https://docs.query.ai/recipes/detecting-credential-dumping-from-windows-credential-manager-using-powershell.md)
- [Detecting Credential Enumeration from Windows Credential Manager via PowerShell](https://docs.query.ai/recipes/detecting-credential-enumeration-from-windows-credential-manager-via-powershell.md)
- [Detecting Crypto Wallet Access by Uncommon Apps](https://docs.query.ai/recipes/detecting-crypto-wallet-access-by-uncommon-apps.md)
- [Detecting CSharp Streamer RAT via .NET Executable Image Loading](https://docs.query.ai/recipes/detecting-csharp-streamer-rat-via-net-executable-image-loading.md)
- [Detecting Curl Download and Execute Combination](https://docs.query.ai/recipes/detecting-curl-download-and-execute-combination.md)
- [Detecting Data Exfiltration via DataSvcUtil.exe](https://docs.query.ai/recipes/detecting-data-exfiltration-via-datasvcutilexe.md)
- [Detecting Disabled MFA to Bypass Authentication in Azure](https://docs.query.ai/recipes/detecting-disabled-mfa-to-bypass-authentication-in-azure.md)
- [Detecting Disabled Office Macro Warnings via Registry Modification](https://docs.query.ai/recipes/detecting-disabled-office-macro-warnings-via-registry-modification.md)
- [Detecting Disabled Scheduled Tasks via FSQL](https://docs.query.ai/recipes/detecting-disabled-scheduled-tasks-via-fsql.md)
- [Detecting Disabled Windows Defender Eventlog via FSQL](https://docs.query.ai/recipes/detecting-disabled-windows-defender-eventlog-via-fsql.md)
- [Detecting Displaying Hidden Files Feature Disabled](https://docs.query.ai/recipes/detecting-displaying-hidden-files-feature-disabled.md)
- [Detecting DSRM Registry Value Tampering](https://docs.query.ai/recipes/detecting-dsrm-registry-value-tampering.md)
- [Detecting Dynamic CSharp Compilation Artefacts with FSQL](https://docs.query.ai/recipes/detecting-dynamic-csharp-compilation-artefacts-with-fsql.md)
- [Detecting eDiscovery PST Export Activity](https://docs.query.ai/recipes/detecting-ediscovery-pst-export-activity.md)
- [Detecting EditionUpgradeManager COM Interface Function Calls](https://docs.query.ai/recipes/detecting-editionupgrademanager-com-interface-function-calls.md)
- [Detecting Empire PowerShell Launch Parameters with FSQL](https://docs.query.ai/recipes/detecting-empire-powershell-launch-parameters-with-fsql.md)
- [Detecting ESX Admins Group Creation via Net.exe or PowerShell](https://docs.query.ai/recipes/detecting-esx-admins-group-creation-via-netexe-or-powershell.md)
- [Detecting ETW Tampering via CommandLine in .NET Processes](https://docs.query.ai/recipes/detecting-etw-tampering-via-commandline-in-net-processes.md)
- [Detecting ETW Trace Disablement via PowerShell Cmdlets](https://docs.query.ai/recipes/detecting-etw-trace-disablement-via-powershell-cmdlets.md)
- [Detecting Excessive Global Administrator Assignments in Azure PIM](https://docs.query.ai/recipes/detecting-excessive-global-administrator-assignments-in-azure-pim.md)
- [Detecting Executable Creations by Microsoft Sync Center](https://docs.query.ai/recipes/detecting-executable-creations-by-microsoft-sync-center.md)
- [Detecting Execution from Alternate Data Streams](https://docs.query.ai/recipes/detecting-execution-from-alternate-data-streams.md)
- [Detecting F-Secure C3 Usage via Rundll32](https://docs.query.ai/recipes/detecting-f-secure-c3-usage-via-rundll32.md)
- [Detecting Failed AWS Console Login Attempts](https://docs.query.ai/recipes/detecting-failed-aws-console-login-attempts.md)
- [Detecting Frequent Role Activations in Azure PIM](https://docs.query.ai/recipes/detecting-frequent-role-activations-in-azure-pim.md)
- [Detecting Google Cloud Kubernetes Admission Controller Activity](https://docs.query.ai/recipes/detecting-google-cloud-kubernetes-admission-controller-activity.md)
- [Detecting Google Cloud Kubernetes CronJob Activity](https://docs.query.ai/recipes/detecting-google-cloud-kubernetes-cronjob-activity.md)
- [Detecting Hacktool Process Access](https://docs.query.ai/recipes/detecting-hacktool-process-access.md)
- [Detecting Hidden Directory Creation via NTFS INDEX_ALLOCATION Stream with FSQL](https://docs.query.ai/recipes/detecting-hidden-directory-creation-via-ntfs-index_allocation-stream-with-fsql.md)
- [Detecting Hidden Files with Attrib.exe](https://docs.query.ai/recipes/detecting-hidden-files-with-attribexe.md)
- [Detecting Hidden Services via Set-Service Cmdlet](https://docs.query.ai/recipes/detecting-hidden-services-via-set-service-cmdlet.md)
- [Detecting Hidden User Account Creation via Registry Modification](https://docs.query.ai/recipes/detecting-hidden-user-account-creation-via-registry-modification.md)
- [Detecting IE Registry Setting Modifications](https://docs.query.ai/recipes/detecting-ie-registry-setting-modifications.md)
- [Detecting Impersonate Hack Tool Execution](https://docs.query.ai/recipes/detecting-impersonate-hack-tool-execution.md)
- [Detecting Invoke-Obfuscation VAR++ LAUNCHER via PowerShell Script Analysis](https://docs.query.ai/recipes/detecting-invoke-obfuscation-var-launcher-via-powershell-script-analysis.md)
- [Detecting Invoke-Obfuscation VAR++ LAUNCHER with FSQL](https://docs.query.ai/recipes/detecting-invoke-obfuscation-var-launcher-with-fsql.md)
- [Detecting Invoke-Obfuscation via Clip.exe in PowerShell Scripts](https://docs.query.ai/recipes/detecting-invoke-obfuscation-via-clipexe-in-powershell-scripts.md)
- [Detecting ISO or Image Mount Indicators in Recent Files](https://docs.query.ai/recipes/detecting-iso-or-image-mount-indicators-in-recent-files.md)
- [Detecting Kali Linux Installation via WSL](https://docs.query.ai/recipes/detecting-kali-linux-installation-via-wsl.md)
- [Detecting KamiKakaBot Activity via Scheduled Task Creation](https://docs.query.ai/recipes/detecting-kamikakabot-activity-via-scheduled-task-creation.md)
- [Detecting Legacy Authentication Protocols](https://docs.query.ai/recipes/detecting-legacy-authentication-protocols.md)
- [Detecting Lodctr.exe Execution for Performance Counter Rebuild](https://docs.query.ai/recipes/detecting-lodctrexe-execution-for-performance-counter-rebuild.md)
- [Detecting LSASS Credential Dumping via SilentProcessExit Registry Monitoring](https://docs.query.ai/recipes/detecting-lsass-credential-dumping-via-silentprocessexit-registry-monitoring.md)
- [Detecting LSASS Memory Dumps via Comsvcs DLL using FSQL](https://docs.query.ai/recipes/detecting-lsass-memory-dumps-via-comsvcs-dll-using-fsql.md)
- [Detecting LSASS Process Clone for Credential Dumping](https://docs.query.ai/recipes/detecting-lsass-process-clone-for-credential-dumping.md)
- [Detecting Malicious CloudTrail Usage via System Manager](https://docs.query.ai/recipes/detecting-malicious-cloudtrail-usage-via-system-manager.md)
- [Detecting or Hunting Malicious Network Activity from Specific IP Addresses](https://docs.query.ai/recipes/detecting-malicious-network-activity-from-specific-ip-addresses.md)
- [Detecting Malicious Usage of IMDS Credentials Outside AWS Infrastructure](https://docs.query.ai/recipes/detecting-malicious-usage-of-imds-credentials-outside-aws-infrastructure.md)
- [Detecting Malicious XLL Add-in Registration via PowerShell](https://docs.query.ai/recipes/detecting-malicious-xll-add-in-registration-via-powershell.md)
- [Detecting MFA Disablement via FSQL](https://docs.query.ai/recipes/detecting-mfa-disablement-via-fsql.md)
- [Detecting MsXml COM Object Instantiation in Powershell Scripts](https://docs.query.ai/recipes/detecting-msxml-com-object-instantiation-in-powershell-scripts.md)
- [Detecting Multiple Remote Desktop Sessions via Registry Modification](https://docs.query.ai/recipes/detecting-multiple-remote-desktop-sessions-via-registry-modification.md)
- [Detecting Network Connection Discovery with Get-NetTCPConnection in PowerShell](https://docs.query.ai/recipes/detecting-network-connection-discovery-with-get-nettcpconnection-in-powershell.md)
- [Detecting Network Connection Discovery with Get-NetTCPConnection](https://docs.query.ai/recipes/detecting-network-connection-discovery-with-get-nettcpconnection.md)
- [Detecting New Remote Desktop Connection via Mstsc.EXE](https://docs.query.ai/recipes/detecting-new-remote-desktop-connection-via-mstscexe.md)
- [Detecting Ngrok Execution via Process Activity](https://docs.query.ai/recipes/detecting-ngrok-execution-via-process-activity.md)
- [Detecting Non-Standard nsswitch.conf Creation (detecting-non-standard-nsswitch-conf-creation)](https://docs.query.ai/recipes/detecting-non-standard-nsswitchconf-creation-detecting-non-standard-nsswitch-conf-creation.md)
- [Detecting Nslookup PowerShell Download Cradle](https://docs.query.ai/recipes/detecting-nslookup-powershell-download-cradle.md)
- [Detecting O365 Mail Forwarding Activity (detecting-o365-mail-forwarding-activity)](https://docs.query.ai/recipes/detecting-o365-mail-forwarding-activity-detecting-o365-mail-forwarding-activity.md)
- [Detecting Obfuscated Ordinal Calls via Rundll32 with FSQL](https://docs.query.ai/recipes/detecting-obfuscated-ordinal-calls-via-rundll32-with-fsql.md)
- [Detecting or Hunting Malicious Process Activity](https://docs.query.ai/recipes/detecting-or-hunting-malicious-process-activity.md)
- [Detecting Over Permissive Permissions Granted via Dsacls.EXE](https://docs.query.ai/recipes/detecting-over-permissive-permissions-granted-via-dsaclsexe.md)
- [Detecting Password Set to Never Expire via WMI using FSQL](https://docs.query.ai/recipes/detecting-password-set-to-never-expire-via-wmi-using-fsql.md)
- [Detecting Persistence via TypedPaths using CommandLine](https://docs.query.ai/recipes/detecting-persistence-via-typedpaths-using-commandline.md)
- [Detecting PIM Approvals and Denials](https://docs.query.ai/recipes/detecting-pim-approvals-and-denials.md)
- [Detecting Potential AMSI Bypass Script Using NULL Bits](https://docs.query.ai/recipes/detecting-potential-amsi-bypass-script-using-null-bits.md)
- [Detecting Potential CobaltStrike Service Installations via Registry Modification](https://docs.query.ai/recipes/detecting-potential-cobaltstrike-service-installations-via-registry-modification.md)
- [Detecting Potential CVE-2024-37085 Exploitation via Suspicious ESX Admins Group Activity](https://docs.query.ai/recipes/detecting-potential-cve-2024-37085-exploitation-via-suspicious-esx-admins-group-activity.md)
- [Detecting Potential Data Stealing via Chromium Headless Debugging](https://docs.query.ai/recipes/detecting-potential-data-stealing-via-chromium-headless-debugging.md)
- [Detecting Potential In-Memory Execution via Reflection.Assembly](https://docs.query.ai/recipes/detecting-potential-in-memory-execution-via-reflectionassembly.md)
- [Detecting Potential KamiKakaBot Activity via Winlogon Shell Persistence using FSQL](https://docs.query.ai/recipes/detecting-potential-kamikakabot-activity-via-winlogon-shell-persistence-using-fsql.md)
- [Detecting Potential KamiKakaBot Activity via Winlogon Shell Persistence](https://docs.query.ai/recipes/detecting-potential-kamikakabot-activity-via-winlogon-shell-persistence.md)
- [Detecting Potential MFA Bypass Using Legacy Client Authentication](https://docs.query.ai/recipes/detecting-potential-mfa-bypass-using-legacy-client-authentication.md)
- [Detecting Potential Persistence via Mpnotify Registry Key Modification](https://docs.query.ai/recipes/detecting-potential-persistence-via-mpnotify-registry-key-modification.md)
- [Detecting Potential Persistence via Security Descriptor Manipulation in PowerShell Scripts](https://docs.query.ai/recipes/detecting-potential-persistence-via-security-descriptor-manipulation-in-powershell-scripts.md)
- [Detecting Potential Persistence via TypedPaths Registry Modification](https://docs.query.ai/recipes/detecting-potential-persistence-via-typedpaths-registry-modification.md)
- [Detecting Potential Persistence via Visual Studio Tools for Office Add-ins](https://docs.query.ai/recipes/detecting-potential-persistence-via-visual-studio-tools-for-office-add-ins.md)
- [Detecting Potential PowerShell Persistence via User Profile Modification](https://docs.query.ai/recipes/detecting-potential-powershell-persistence-via-user-profile-modification.md)
- [Detecting Potential Qakbot Registry Activity](https://docs.query.ai/recipes/detecting-potential-qakbot-registry-activity.md)
- [Detecting Potential Ransomware Activity in Microsoft 365](https://docs.query.ai/recipes/detecting-potential-ransomware-activity-in-microsoft-365.md)
- [Detecting Potential RemoteFXvGPUDisablement.EXE Abuse via PowerShell Module](https://docs.query.ai/recipes/detecting-potential-remotefxvgpudisablementexe-abuse-via-powershell-module.md)
- [Detecting Potential RemoteFXvGPUDisablement.EXE Abuse via PowerShell ScriptBlock](https://docs.query.ai/recipes/detecting-potential-remotefxvgpudisablementexe-abuse-via-powershell-scriptblock.md)
- [Detecting Potential SMB Relay Attack Tool Execution](https://docs.query.ai/recipes/detecting-potential-smb-relay-attack-tool-execution.md)
- [Detecting Powercat Usage via PowerShell Command Lines](https://docs.query.ai/recipes/detecting-powercat-usage-via-powershell-command-lines.md)
- [Detecting Powershell ADS File Storage](https://docs.query.ai/recipes/detecting-powershell-ads-file-storage.md)
- [Detecting PowerShell as a Service in Registry](https://docs.query.ai/recipes/detecting-powershell-as-a-service-in-registry.md)
- [Detecting PowerShell Console History Clearing](https://docs.query.ai/recipes/detecting-powershell-console-history-clearing.md)
- [Detecting PowerShell Get-Clipboard Cmdlet Usage via CLI](https://docs.query.ai/recipes/detecting-powershell-get-clipboard-cmdlet-usage-via-cli.md)
- [Detecting PowerShell Obfuscation via Rundll32 with FSQL](https://docs.query.ai/recipes/detecting-powershell-obfuscation-via-rundll32-with-fsql.md)
- [Detecting PowerView Cmdlets in PowerShell Script Blocks](https://docs.query.ai/recipes/detecting-powerview-cmdlets-in-powershell-script-blocks.md)
- [Detecting PPL Tampering via WerFaultSecure.exe](https://docs.query.ai/recipes/detecting-ppl-tampering-via-werfaultsecureexe.md)
- [Detecting Privileged Account Creation in Azure](https://docs.query.ai/recipes/detecting-privileged-account-creation-in-azure.md)
- [Detecting Python .pth File Creation on macOS (detecting-python-pth-file-creation-on-macos)](https://docs.query.ai/recipes/detecting-python-pth-file-creation-on-macos-detecting-python-pth-file-creation-on-macos.md)
- [Detecting Python .pth File Persistence (detecting-python-pth-file-persistence)](https://docs.query.ai/recipes/detecting-python-pth-file-persistence-detecting-python-pth-file-persistence.md)
- [Detecting Rare Azure Subscription Operations](https://docs.query.ai/recipes/detecting-rare-azure-subscription-operations.md)
- [Detecting Raspberry Robin CPL Execution via FSQL](https://docs.query.ai/recipes/detecting-raspberry-robin-cpl-execution-via-fsql.md)
- [Detecting RAT Client File Creation](https://docs.query.ai/recipes/detecting-rat-client-file-creation-1.md)
- [Detecting RAT Client File Creation](https://docs.query.ai/recipes/detecting-rat-client-file-creation.md)
- [Detecting Reconnaissance via GatherNetworkInfo.VBS](https://docs.query.ai/recipes/detecting-reconnaissance-via-gathernetworkinfovbs.md)
- [Detecting Recycle Bin Registry Persistence Mechanisms](https://docs.query.ai/recipes/detecting-recycle-bin-registry-persistence-mechanisms.md)
- [Detecting Register_App.Vbs LOLScript Abuse with FSQL](https://docs.query.ai/recipes/detecting-register_appvbs-lolscript-abuse-with-fsql.md)
- [Detecting Registry-Free Process Scope COR_PROFILER Exploitation](https://docs.query.ai/recipes/detecting-registry-free-process-scope-cor_profiler-exploitation.md)
- [Detecting Registry Imports from ADS with Regedit](https://docs.query.ai/recipes/detecting-registry-imports-from-ads-with-regedit.md)
- [Detecting Renamed VsCode Tunnel Execution via File Creation](https://docs.query.ai/recipes/detecting-renamed-vscode-tunnel-execution-via-file-creation.md)
- [Detecting RestrictedAdmin Mode Registry Tampering via Process Creation](https://docs.query.ai/recipes/detecting-restrictedadmin-mode-registry-tampering-via-process-creation.md)
- [Detecting RestrictedAdminMode Registry Tampering with FSQL](https://docs.query.ai/recipes/detecting-restrictedadminmode-registry-tampering-with-fsql.md)
- [Detecting Risky Authentications from Non-Registered Devices](https://docs.query.ai/recipes/detecting-risky-authentications-from-non-registered-devices.md)
- [Detecting Role Activation Without MFA in Azure PIM](https://docs.query.ai/recipes/detecting-role-activation-without-mfa-in-azure-pim.md)
- [Detecting SD Value Removal to Hide Scheduled Tasks via Registry](https://docs.query.ai/recipes/detecting-sd-value-removal-to-hide-scheduled-tasks-via-registry.md)
- [Detecting Sensitive Role Access in Azure Kubernetes](https://docs.query.ai/recipes/detecting-sensitive-role-access-in-azure-kubernetes.md)
- [Detecting Shai-Hulud Malicious GitHub Workflow (detecting-shai-hulud-malicious-github-workflow)](https://docs.query.ai/recipes/detecting-shai-hulud-malicious-github-workflow-detecting-shai-hulud-malicious-github-workflow.md)
- [Detecting SharpMove HackTool Execution via FSQL](https://docs.query.ai/recipes/detecting-sharpmove-hacktool-execution-via-fsql.md)
- [Detecting Startup Persistence via PowerShell with FSQL](https://docs.query.ai/recipes/detecting-startup-persistence-via-powershell-with-fsql.md)
- [Detecting Successful Authentication Increase](https://docs.query.ai/recipes/detecting-successful-authentication-increase.md)
- [Detecting Suspicious Browser Activity in Azure AD](https://docs.query.ai/recipes/detecting-suspicious-browser-activity-in-azure-ad.md)
- [Detecting Suspicious CSharp Interactive Console Use via PowerShell](https://docs.query.ai/recipes/detecting-suspicious-csharp-interactive-console-use-via-powershell.md)
- [Detecting Suspicious Get-ADReplAccount Usage](https://docs.query.ai/recipes/detecting-suspicious-get-adreplaccount-usage.md)
- [Detecting Suspicious Get-Variable.exe Creation in WindowsApps](https://docs.query.ai/recipes/detecting-suspicious-get-variableexe-creation-in-windowsapps.md)
- [Detecting Suspicious Hyper-V Cmdlets](https://docs.query.ai/recipes/detecting-suspicious-hyper-v-cmdlets.md)
- [Detecting Suspicious Inbox Manipulation Rules](https://docs.query.ai/recipes/detecting-suspicious-inbox-manipulation-rules.md)
- [Detecting Suspicious IO.FileStream Usage in PowerShell Scripts](https://docs.query.ai/recipes/detecting-suspicious-iofilestream-usage-in-powershell-scripts.md)
- [Detecting Suspicious JWT Token Searches via CLI](https://docs.query.ai/recipes/detecting-suspicious-jwt-token-searches-via-cli.md)
- [Detecting Suspicious New-PSDrive to Admin Share with FSQL](https://docs.query.ai/recipes/detecting-suspicious-new-psdrive-to-admin-share-with-fsql.md)
- [Detecting Suspicious PowerShell Invocations via FSQL](https://docs.query.ai/recipes/detecting-suspicious-powershell-invocations-via-fsql.md)
- [Detecting Suspicious PowerShell Troubleshooting Pack Cmdlet Execution](https://docs.query.ai/recipes/detecting-suspicious-powershell-troubleshooting-pack-cmdlet-execution.md)
- [Detecting Suspicious Regasm/Regsvcs Execution from Uncommon Locations](https://docs.query.ai/recipes/detecting-suspicious-regasmregsvcs-execution-from-uncommon-locations.md)
- [Detecting Suspicious SAML Activity in AWS](https://docs.query.ai/recipes/detecting-suspicious-saml-activity-in-aws.md)
- [Detecting Suspicious Start-Process with PassThru in PowerShell](https://docs.query.ai/recipes/detecting-suspicious-start-process-with-passthru-in-powershell.md)
- [Detecting System Time Discovery via Command-Line Tools](https://docs.query.ai/recipes/detecting-system-time-discovery-via-command-line-tools.md)
- [Detecting Trust Access Disable for VBApplications via Registry Modification](https://docs.query.ai/recipes/detecting-trust-access-disable-for-vbapplications-via-registry-modification.md)
- [Detecting UAC Bypass via SilentCleanup Task with FSQL](https://docs.query.ai/recipes/detecting-uac-bypass-via-silentcleanup-task-with-fsql.md)
- [Detecting Uncommon Applications Accessing Sensitive Sysvol Files](https://docs.query.ai/recipes/detecting-uncommon-applications-accessing-sensitive-sysvol-files.md)
- [Detecting Uncommon Child Processes of BgInfo.EXE](https://docs.query.ai/recipes/detecting-uncommon-child-processes-of-bginfoexe.md)
- [Detecting Uncommon Port Usage with Test-NetConnection](https://docs.query.ai/recipes/detecting-uncommon-port-usage-with-test-netconnection.md)
- [Detecting Unconstrained Delegation Discovery via Get-ADComputer Cmdlet](https://docs.query.ai/recipes/detecting-unconstrained-delegation-discovery-via-get-adcomputer-cmdlet.md)
- [Detecting Unquoted Service Path Enumeration via PowerShell and WMI](https://docs.query.ai/recipes/detecting-unquoted-service-path-enumeration-via-powershell-and-wmi.md)
- [Detecting Unsigned AppX Installation Attempts via PowerShell](https://docs.query.ai/recipes/detecting-unsigned-appx-installation-attempts-via-powershell.md)
- [Detecting Unsigned Thor Scanner Execution](https://docs.query.ai/recipes/detecting-unsigned-thor-scanner-execution.md)
- [Detecting Unused Privileged Role Assignments in Azure PIM](https://docs.query.ai/recipes/detecting-unused-privileged-role-assignments-in-azure-pim.md)
- [Detecting Unusual File Deletion by Dns.exe](https://docs.query.ai/recipes/detecting-unusual-file-deletion-by-dnsexe.md)
- [Detecting Unusual File Modification by dns.exe](https://docs.query.ai/recipes/detecting-unusual-file-modification-by-dnsexe.md)
- [Detecting Unusual Processes Creating desktop.ini](https://docs.query.ai/recipes/detecting-unusual-processes-creating-desktopini.md)
- [Detecting Unusual Volume of File Deletion in Microsoft 365](https://docs.query.ai/recipes/detecting-unusual-volume-of-file-deletion-in-microsoft-365.md)
- [Detecting User Agent Spoofing in PowerShell Web Requests](https://docs.query.ai/recipes/detecting-user-agent-spoofing-in-powershell-web-requests.md)
- [Detecting vbc.exe spawning cvtres.exe for Defense Evasion](https://docs.query.ai/recipes/detecting-vbcexe-spawning-cvtresexe-for-defense-evasion.md)
- [Detecting Volume Shadow Copy Deletion via WMI with PowerShell Script](https://docs.query.ai/recipes/detecting-volume-shadow-copy-deletion-via-wmi-with-powershell-script.md)
- [Detecting VS Code Tunnel Service Installation with FSQL](https://docs.query.ai/recipes/detecting-vs-code-tunnel-service-installation-with-fsql.md)
- [Detecting Wazuh Security Platform DLL Sideloading with FSQL](https://docs.query.ai/recipes/detecting-wazuh-security-platform-dll-sideloading-with-fsql.md)
- [Detecting Weak Service Registry Permissions Checks](https://docs.query.ai/recipes/detecting-weak-service-registry-permissions-checks.md)
- [Detecting Web Request Commands and Cmdlets in PowerShell ScriptBlock Logs](https://docs.query.ai/recipes/detecting-web-request-commands-and-cmdlets-in-powershell-scriptblock-logs.md)
- [Detecting WerFault.exe/Wer.dll Creation in Unusual Folders](https://docs.query.ai/recipes/detecting-werfaultexewerdll-creation-in-unusual-folders.md)
- [Detecting Wfc.exe Execution for Defense Evasion](https://docs.query.ai/recipes/detecting-wfcexe-execution-for-defense-evasion.md)
- [Detecting Windows Defender Tamper Protection Disablement via Registry Modification](https://docs.query.ai/recipes/detecting-windows-defender-tamper-protection-disablement-via-registry-modification.md)
- [Detecting Windows Hotfix Reconnaissance via WMIC](https://docs.query.ai/recipes/detecting-windows-hotfix-reconnaissance-via-wmic.md)
- [Detecting Windows Share Mount via Net.exe](https://docs.query.ai/recipes/detecting-windows-share-mount-via-netexe.md)
- [Detecting Writes to Local Admin Share via FSQL](https://docs.query.ai/recipes/detecting-writes-to-local-admin-share-via-fsql.md)
- [Detecting XORDump Execution](https://docs.query.ai/recipes/detecting-xordump-execution.md)
- [Detecting ZipExec Execution](https://docs.query.ai/recipes/detecting-zipexec-execution.md)
- [Detection - Clickfix Process Chain Detection](https://docs.query.ai/recipes/detection-clickfix-process-chain-detection.md)
- [Device Registration Without MFA](https://docs.query.ai/recipes/device-registration-without-mfa.md)
- [DeviceCredentialDeployment Execution Detection](https://docs.query.ai/recipes/devicecredentialdeployment-execution-detection.md)
- [DHCP Callout DLL Installation Detection](https://docs.query.ai/recipes/dhcp-callout-dll-installation-detection.md)
- [DirectorySearcher PowerShell Exploitation Detection](https://docs.query.ai/recipes/directorysearcher-powershell-exploitation-detection.md)
- [Disable Exploit Guard Network Protection Detection](https://docs.query.ai/recipes/disable-exploit-guard-network-protection-detection.md)
- [Disable Macro Runtime Scan Scope Detection](https://docs.query.ai/recipes/disable-macro-runtime-scan-scope-detection.md)
- [Disable Windows Defender PUA Protection via Registry](https://docs.query.ai/recipes/disable-windows-defender-pua-protection-via-registry.md)
- [Disable Windows Firewall by Registry Modification](https://docs.query.ai/recipes/disable-windows-firewall-by-registry-modification.md)
- [Disable Windows Security Center Notifications](https://docs.query.ai/recipes/disable-windows-security-center-notifications.md)
- [DLL Execution Via Register-cimprovider.exe](https://docs.query.ai/recipes/dll-execution-via-register-cimproviderexe.md)
- [DLL Search Order Hijacking Detection](https://docs.query.ai/recipes/dll-search-order-hijacking-detection.md)
- [DLL Search Order Hijacking via Additional Space in Path](https://docs.query.ai/recipes/dll-search-order-hijacking-via-additional-space-in-path.md)
- [Dllhost.EXE Execution Anomaly Detection](https://docs.query.ai/recipes/dllhostexe-execution-anomaly-detection.md)
- [DllUnregisterServer Function Call Via Msiexec.EXE](https://docs.query.ai/recipes/dllunregisterserver-function-call-via-msiexecexe.md)
- [DPRK Threat Actor - C2 Communication DNS Indicators](https://docs.query.ai/recipes/dprk-threat-actor-c2-communication-dns-indicators.md)
- [Driver/DLL Installation via Odbcconf.EXE](https://docs.query.ai/recipes/driverdll-installation-via-odbcconfexe.md)
- [DriverQuery.EXE Execution Detection](https://docs.query.ai/recipes/driverqueryexe-execution-detection.md)
- [Dumpert Process Dumper Default File Detection](https://docs.query.ai/recipes/dumpert-process-dumper-default-file-detection.md)
- [DumpStack.log Defender Evasion in FSQL](https://docs.query.ai/recipes/dumpstacklog-defender-evasion-in-fsql.md)
- [Email Exfiltration Via Powershell](https://docs.query.ai/recipes/email-exfiltration-via-powershell.md)
- [End User Application Consent Detection](https://docs.query.ai/recipes/end-user-application-consent-detection.md)
- [End User Consent Blocked Detection](https://docs.query.ai/recipes/end-user-consent-blocked-detection.md)
- [Enumeration for 3rd Party Credentials From CLI](https://docs.query.ai/recipes/enumeration-for-3rd-party-credentials-from-cli.md)
- [Esentutl Volume Shadow Copy Service Keys](https://docs.query.ai/recipes/esentutl-volume-shadow-copy-service-keys.md)
- [Exchange PowerShell Cmdlet History Deleted](https://docs.query.ai/recipes/exchange-powershell-cmdlet-history-deleted.md)
- [Execution via stordiag.exe](https://docs.query.ai/recipes/execution-via-stordiagexe.md)
- [Exploit Guard ProtectedFolders Registry Key Deletion](https://docs.query.ai/recipes/exploit-guard-protectedfolders-registry-key-deletion.md)
- [Exports Critical Registry Keys To a File](https://docs.query.ai/recipes/exports-critical-registry-keys-to-a-file.md)
- [Exports Registry Key To a File](https://docs.query.ai/recipes/exports-registry-key-to-a-file.md)
- [File Decryption Using Gpg4win](https://docs.query.ai/recipes/file-decryption-using-gpg4win.md)
- [File Download with Headless Browser](https://docs.query.ai/recipes/file-download-with-headless-browser.md)
- [File Encoded To Base64 Via Certutil.EXE](https://docs.query.ai/recipes/file-encoded-to-base64-via-certutilexe.md)
- [File With Suspicious Extension Downloaded Via Bitsadmin](https://docs.query.ai/recipes/file-with-suspicious-extension-downloaded-via-bitsadmin.md)
- [File With Uncommon Extension Created By An Office Application](https://docs.query.ai/recipes/file-with-uncommon-extension-created-by-an-office-application.md)
- [Firewall Configuration Discovery via Netsh.exe](https://docs.query.ai/recipes/firewall-configuration-discovery-via-netshexe.md)
- [Forfiles Command Execution Detection](https://docs.query.ai/recipes/forfiles-command-execution-detection.md)
- [Google Cloud DNS Zone Modified or Deleted](https://docs.query.ai/recipes/google-cloud-dns-zone-modified-or-deleted.md)
- [Google Cloud Service Account Disabled or Deleted](https://docs.query.ai/recipes/google-cloud-service-account-disabled-or-deleted.md)
- [Google Cloud Service Account Modified](https://docs.query.ai/recipes/google-cloud-service-account-modified.md)
- [Google Cloud SQL Database Modified or Deleted](https://docs.query.ai/recipes/google-cloud-sql-database-modified-or-deleted.md)
- [Google Cloud Storage Buckets Enumeration Detection](https://docs.query.ai/recipes/google-cloud-storage-buckets-enumeration-detection.md)
- [Google Workspace Admin Privileges Granted](https://docs.query.ai/recipes/google-workspace-admin-privileges-granted.md)
- [Google Workspace Granted Domain API Access](https://docs.query.ai/recipes/google-workspace-granted-domain-api-access.md)
- [Google Workspace MFA Disabled](https://docs.query.ai/recipes/google-workspace-mfa-disabled.md)
- [Google Workspace Role Modified or Deleted](https://docs.query.ai/recipes/google-workspace-role-modified-or-deleted.md)
- [Google Workspace Role Privilege Deleted](https://docs.query.ai/recipes/google-workspace-role-privilege-deleted.md)
- [HackTool - CobaltStrike BOF Injection Pattern](https://docs.query.ai/recipes/hacktool-cobaltstrike-bof-injection-pattern.md)
- [HackTool - CoercedPotato Named Pipe Creation](https://docs.query.ai/recipes/hacktool-coercedpotato-named-pipe-creation.md)
- [HackTool - EfsPotato Named Pipe Creation](https://docs.query.ai/recipes/hacktool-efspotato-named-pipe-creation.md)
- [HackTool - PurpleSharp Execution](https://docs.query.ai/recipes/hacktool-purplesharp-execution.md)
- [HackTool - SharpLDAPmonitor Execution](https://docs.query.ai/recipes/hacktool-sharpldapmonitor-execution.md)
- [HackTool - Typical HiveNightmare SAM File Export](https://docs.query.ai/recipes/hacktool-typical-hivenightmare-sam-file-export.md)
- [HandleKatz LSASS Handle Duplication Detection](https://docs.query.ai/recipes/handlekatz-lsass-handle-duplication-detection.md)
- [Hiding User Account Via SpecialAccounts Registry Key](https://docs.query.ai/recipes/hiding-user-account-via-specialaccounts-registry-key.md)
- [Detecting High-Severity Inbound Email Correlated with Detection Findings by Email](https://docs.query.ai/recipes/high-severity-inbound-email-correlated-with-detection-findings.md)
- [Hunting for HTML Application (HTA) Script Execution](https://docs.query.ai/recipes/html-application-hta-script-execution.md)
- [Hunting for Atomic MacOS Stealer Persistence (hunting-for-atomic-macos-stealer-persistence)](https://docs.query.ai/recipes/hunting-for-atomic-macos-stealer-persistence-hunting-for-atomic-macos-stealer-persistence.md)
- [Hunting for BRICKSTORM C2 Communication](https://docs.query.ai/recipes/hunting-for-brickstorm-c2-communication.md)
- [Hunting for BRICKSTORM File Names](https://docs.query.ai/recipes/hunting-for-brickstorm-file-names.md)
- [Hunting for BRICKSTORM IOCs (File Hashes)](https://docs.query.ai/recipes/hunting-for-brickstorm-iocs-file-hashes.md)
- [Hunting for BRICKSTORM Persistence](https://docs.query.ai/recipes/hunting-for-brickstorm-persistence.md)
- [Hunting for Cloud IAM Tampering](https://docs.query.ai/recipes/hunting-for-cloud-iam-tampering.md)
- [Hunting for Commvault QLogin Argument Injection (hunting-for-commvault-qlogin-argument-injection)](https://docs.query.ai/recipes/hunting-for-commvault-qlogin-argument-injection-hunting-for-commvault-qlogin-argument-injection.md)
- [Hunting for Commvault Webshell Drop (CVE-2025-57790) (hunting-for-commvault-webshell-drop-cve-2025-57790)](https://docs.query.ai/recipes/hunting-for-commvault-webshell-drop-cve-2025-57790-hunting-for-commvault-webshell-drop-cve-2025-57790.md)
- [Hunting for CVE-2025-32463 Exploitation (hunting-for-cve-2025-32463-exploitation)](https://docs.query.ai/recipes/hunting-for-cve-2025-32463-exploitation-hunting-for-cve-2025-32463-exploitation.md)
- [Hunting for DNS Queries to Katz Stealer Domains (hunting-for-dns-queries-to-katz-stealer-domains)](https://docs.query.ai/recipes/hunting-for-dns-queries-to-katz-stealer-domains-hunting-for-dns-queries-to-katz-stealer-domains.md)
- [Hunting for FunkLocker Ransomware File Creation (hunting-for-funklocker-ransomware-file-creation)](https://docs.query.ai/recipes/hunting-for-funklocker-ransomware-file-creation-hunting-for-funklocker-ransomware-file-creation.md)
- [Hunting for GoAnywhere MFT Exploitation (hunting-for-goanywhere-mft-exploitation)](https://docs.query.ai/recipes/hunting-for-goanywhere-mft-exploitation-hunting-for-goanywhere-mft-exploitation.md)
- [Hunting for Grixba Malware Reconnaissance (hunting-for-grixba-malware-reconnaissance)](https://docs.query.ai/recipes/hunting-for-grixba-malware-reconnaissance-hunting-for-grixba-malware-reconnaissance.md)
- [Hunting for Kalambur Backdoor C2 Activity (hunting-for-kalambur-backdoor-c2-activity)](https://docs.query.ai/recipes/hunting-for-kalambur-backdoor-c2-activity-hunting-for-kalambur-backdoor-c2-activity.md)
- [Hunting for Katz Stealer DLL Loading (hunting-for-katz-stealer-dll-loading)](https://docs.query.ai/recipes/hunting-for-katz-stealer-dll-loading-hunting-for-katz-stealer-dll-loading.md)
- [Hunting for Katz Stealer DNS Queries (hunting-for-katz-stealer-dns-queries)](https://docs.query.ai/recipes/hunting-for-katz-stealer-dns-queries-hunting-for-katz-stealer-dns-queries.md)
- [Hunting for Low Reputation eTLD DNS Queries (hunting-for-low-reputation-etld-dns-queries)](https://docs.query.ai/recipes/hunting-for-low-reputation-etld-dns-queries-hunting-for-low-reputation-etld-dns-queries.md)
- [Hunting for MFA Bruteforce Attempts](https://docs.query.ai/recipes/hunting-for-mfa-bruteforce-attempts.md)
- [Hunting for Multiple Process Terminations via Taskkill](https://docs.query.ai/recipes/hunting-for-multiple-process-terminations-via-taskkill.md)
- [Hunting for O365 Mail Forwarding Rules (hunting-for-o365-mail-forwarding-rules)](https://docs.query.ai/recipes/hunting-for-o365-mail-forwarding-rules-hunting-for-o365-mail-forwarding-rules.md)
- [Hunting for Okta Password Health Report Access (hunting-for-okta-password-health-report-access)](https://docs.query.ai/recipes/hunting-for-okta-password-health-report-access-hunting-for-okta-password-health-report-access.md)
- [Hunting for Outbound Network Exfiltration on Non-Standard Ports](https://docs.query.ai/recipes/hunting-for-outbound-network-exfiltration-on-non-standard-ports.md)
- [Hunting for Post-Exploitation Discovery via Explorer.exe or Mobsync.exe](https://docs.query.ai/recipes/hunting-for-post-exploitation-discovery-via-explorerexe-or-mobsyncexe.md)
- [Hunting for Process Discovery Activity (hunting-for-process-discovery-activity)](https://docs.query.ai/recipes/hunting-for-process-discovery-activity-hunting-for-process-discovery-activity.md)
- [Hunting for Remote WMI ActiveScriptEventConsumers (hunting-for-remote-wmi-activescripteventconsumers)](https://docs.query.ai/recipes/hunting-for-remote-wmi-activescripteventconsumers-hunting-for-remote-wmi-activescripteventconsumers.md)
- [Hunting for SAP NetWeaver Webshell Creation (hunting-for-sap-netweaver-webshell-creation)](https://docs.query.ai/recipes/hunting-for-sap-netweaver-webshell-creation-hunting-for-sap-netweaver-webshell-creation-1.md)
- [Hunting for SAP NetWeaver Webshell Creation (hunting-for-sap-netweaver-webshell-creation)](https://docs.query.ai/recipes/hunting-for-sap-netweaver-webshell-creation-hunting-for-sap-netweaver-webshell-creation-2.md)
- [Hunting for SAP NetWeaver Webshell Creation (hunting-for-sap-netweaver-webshell-creation)](https://docs.query.ai/recipes/hunting-for-sap-netweaver-webshell-creation-hunting-for-sap-netweaver-webshell-creation-3.md)
- [Hunting for SAP NetWeaver Webshell Creation (hunting-for-sap-netweaver-webshell-creation)](https://docs.query.ai/recipes/hunting-for-sap-netweaver-webshell-creation-hunting-for-sap-netweaver-webshell-creation.md)
- [Hunting for SAP NetWeaver Webshell Execution (hunting-for-sap-netweaver-webshell-execution)](https://docs.query.ai/recipes/hunting-for-sap-netweaver-webshell-execution-hunting-for-sap-netweaver-webshell-execution.md)
- [Hunting for Shai-Hulud NPM Package Exfiltration (hunting-for-shai-hulud-npm-package-exfiltration)](https://docs.query.ai/recipes/hunting-for-shai-hulud-npm-package-exfiltration-hunting-for-shai-hulud-npm-package-exfiltration.md)
- [Hunting for Suspicious CrushFTP Child Processes (hunting-for-suspicious-crushftp-child-processes)](https://docs.query.ai/recipes/hunting-for-suspicious-crushftp-child-processes-hunting-for-suspicious-crushftp-child-processes.md)
- [Hunting for Uncommon Access to Browser Credentials (hunting-for-uncommon-access-to-browser-credentials)](https://docs.query.ai/recipes/hunting-for-uncommon-access-to-browser-credentials-hunting-for-uncommon-access-to-browser-credentials.md)
- [Hunting for Wsreset Execution (hunting-for-wsreset-execution)](https://docs.query.ai/recipes/hunting-for-wsreset-execution-hunting-for-wsreset-execution.md)
- [IE Change Domain Zone Detection](https://docs.query.ai/recipes/ie-change-domain-zone-detection.md)
- [Impossible FSQL Conversion: Suspicious Svchost Process Access](https://docs.query.ai/recipes/impossible-fsql-conversion-suspicious-svchost-process-access.md)
- [Indirect Command Execution By Program Compatibility Wizard](https://docs.query.ai/recipes/indirect-command-execution-by-program-compatibility-wizard.md)
- [Indirect Inline Command Execution Via Bash.EXE](https://docs.query.ai/recipes/indirect-inline-command-execution-via-bashexe.md)
- [InfDefaultInstall.exe .inf Execution Detection](https://docs.query.ai/recipes/infdefaultinstallexe-inf-execution-detection.md)
- [Invoke-Obfuscation Obfuscated IEX Invocation Detection](https://docs.query.ai/recipes/invoke-obfuscation-obfuscated-iex-invocation-detection.md)
- [Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module](https://docs.query.ai/recipes/invoke-obfuscation-obfuscated-iex-invocation-powershell-module.md)
- [Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Detection](https://docs.query.ai/recipes/invoke-obfuscation-rundll-launcher-powershell-detection.md)
- [Invoke-Obfuscation STDIN+ Launcher - Powershell](https://docs.query.ai/recipes/invoke-obfuscation-stdin-launcher-powershell.md)
- [Invoke-Obfuscation VAR+ Launcher Detection](https://docs.query.ai/recipes/invoke-obfuscation-var-launcher-detection.md)
- [Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION Detection](https://docs.query.ai/recipes/invoke-obfuscation-var-launcher-obfuscation-detection.md)
- [Invoke-Obfuscation Via Stdin - Powershell](https://docs.query.ai/recipes/invoke-obfuscation-via-stdin-powershell.md)
- [ISO File Created Within Temp Folders](https://docs.query.ai/recipes/iso-file-created-within-temp-folders.md)
- [Kapeka Backdoor Autorun Persistence Detection](https://docs.query.ai/recipes/kapeka-backdoor-autorun-persistence-detection.md)
- [Kapeka Backdoor Execution Via RunDLL32.EXE](https://docs.query.ai/recipes/kapeka-backdoor-execution-via-rundll32exe.md)
- [Kapeka Backdoor Loaded Via Rundll32.EXE Detection](https://docs.query.ai/recipes/kapeka-backdoor-loaded-via-rundll32exe-detection.md)
- [Kapeka Backdoor Loaded Via Rundll32.EXE](https://docs.query.ai/recipes/kapeka-backdoor-loaded-via-rundll32exe.md)
- [Kapeka Backdoor Scheduled Task Creation Detection](https://docs.query.ai/recipes/kapeka-backdoor-scheduled-task-creation-detection.md)
- [Kavremover Dropped Binary LOLBIN Usage Detection](https://docs.query.ai/recipes/kavremover-dropped-binary-lolbin-usage-detection.md)
- [KrbRelayUp Execution Detection](https://docs.query.ai/recipes/krbrelayup-execution-detection.md)
- [Live Memory Dump Using Powershell](https://docs.query.ai/recipes/live-memory-dump-using-powershell.md)
- [LiveKD Driver Creation Detection](https://docs.query.ai/recipes/livekd-driver-creation-detection.md)
- [Local Accounts Discovery](https://docs.query.ai/recipes/local-accounts-discovery.md)
- [Local Groups Reconnaissance Via Wmic.EXE Conversion to FSQL](https://docs.query.ai/recipes/local-groups-reconnaissance-via-wmicexe-conversion-to-fsql.md)
- [LSASS Access Detection Limitations in FSQL](https://docs.query.ai/recipes/lsass-access-detection-limitations-in-fsql.md)
- [LSASS Memory Access by Tool With Dump Keyword In Name](https://docs.query.ai/recipes/lsass-memory-access-by-tool-with-dump-keyword-in-name.md)
- [LSASS Memory Dump by Task Manager](https://docs.query.ai/recipes/lsass-memory-dump-by-task-manager.md)
- [LSASS Process Dump Artefact in CrashDumps Folder Detection](https://docs.query.ai/recipes/lsass-process-dump-artefact-in-crashdumps-folder-detection.md)
- [Lummac Stealer Activity - Execution Of More.com And Vbc.exe](https://docs.query.ai/recipes/lummac-stealer-activity-execution-of-morecom-and-vbcexe.md)
- [Malicious IP Address Sign-In Detection](https://docs.query.ai/recipes/malicious-ip-address-sign-in-detection.md)
- [Microsoft 365 - Impossible Travel Activity Detection](https://docs.query.ai/recipes/microsoft-365-impossible-travel-activity-detection.md)
- [Microsoft 365 - User Restricted from Sending Email](https://docs.query.ai/recipes/microsoft-365-user-restricted-from-sending-email.md)
- [Microsoft Teams Sensitive File Access Detection](https://docs.query.ai/recipes/microsoft-teams-sensitive-file-access-detection.md)
- [MMC Loading Script Engines DLLs](https://docs.query.ai/recipes/mmc-loading-script-engines-dlls.md)
- [MMC20 Lateral Movement Detection](https://docs.query.ai/recipes/mmc20-lateral-movement-detection.md)
- [Modify Group Policy Settings - ScriptBlockLogging](https://docs.query.ai/recipes/modify-group-policy-settings-scriptblocklogging.md)
- [MSDT Execution Via Answer File](https://docs.query.ai/recipes/msdt-execution-via-answer-file.md)
- [Multifactor Authentication Denied Detection](https://docs.query.ai/recipes/multifactor-authentication-denied-detection.md)
- [Multifactor Authentication Interrupted](https://docs.query.ai/recipes/multifactor-authentication-interrupted.md)
- [Narrator's Feedback-Hub Persistence Detection](https://docs.query.ai/recipes/narrators-feedback-hub-persistence-detection.md)
- [New AWS Lambda Function URL Configuration Created](https://docs.query.ai/recipes/new-aws-lambda-function-url-configuration-created.md)
- [New Custom Shim Database Created Detection](https://docs.query.ai/recipes/new-custom-shim-database-created-detection.md)
- [New Generic Credentials Added Via Cmdkey.EXE](https://docs.query.ai/recipes/new-generic-credentials-added-via-cmdkeyexe.md)
- [New Kernel Driver Detection via SC.EXE](https://docs.query.ai/recipes/new-kernel-driver-detection-via-scexe.md)
- [New Outlook Macro Created](https://docs.query.ai/recipes/new-outlook-macro-created.md)
- [New Root Certificate Authority Added Detection](https://docs.query.ai/recipes/new-root-certificate-authority-added-detection.md)
- [New TimeProviders Registered With Uncommon DLL Name](https://docs.query.ai/recipes/new-timeproviders-registered-with-uncommon-dll-name.md)
- [New User Created Via Net.EXE](https://docs.query.ai/recipes/new-user-created-via-netexe.md)
- [Nslookup PowerShell Download Cradle](https://docs.query.ai/recipes/nslookup-powershell-download-cradle.md)
- [NTDS Exfiltration Filename Patterns](https://docs.query.ai/recipes/ntds-exfiltration-filename-patterns.md)
- [Obfuscated PowerShell MSI Install via WindowsInstaller COM](https://docs.query.ai/recipes/obfuscated-powershell-msi-install-via-windowsinstaller-com.md)
- [Octopus Scanner Malware Detection](https://docs.query.ai/recipes/octopus-scanner-malware-detection.md)
- [Odbcconf.EXE Suspicious DLL Location Detection](https://docs.query.ai/recipes/odbcconfexe-suspicious-dll-location-detection.md)
- [Office Autorun Keys Modification Detection](https://docs.query.ai/recipes/office-autorun-keys-modification-detection.md)
- [Office Macro File Download](https://docs.query.ai/recipes/office-macro-file-download.md)
- [OneNote Attachment Dropped in Suspicious Location](https://docs.query.ai/recipes/onenote-attachment-dropped-in-suspicious-location.md)
- [OpenWith.exe Executes Specified Binary](https://docs.query.ai/recipes/openwithexe-executes-specified-binary.md)
- [Password Spray Detection with Azure AD Risk Events](https://docs.query.ai/recipes/password-spray-detection-with-azure-ad-risk-events.md)
- [PCRE.NET Package Temp Files Detection](https://docs.query.ai/recipes/pcrenet-package-temp-files-detection.md)
- [Perl Inline Command Execution Detection](https://docs.query.ai/recipes/perl-inline-command-execution-detection.md)
- [Persistence Via New SIP Provider](https://docs.query.ai/recipes/persistence-via-new-sip-provider.md)
- [Persistence via Sticky Key Backdoor Detection](https://docs.query.ai/recipes/persistence-via-sticky-key-backdoor-detection.md)
- [APT28 Phantom Net Voxel - Weaponized Office Docs](https://docs.query.ai/recipes/phantom-net-voxel-weaponized-office-docs.md)
- [PktMon.EXE Execution Detection](https://docs.query.ai/recipes/pktmonexe-execution-detection.md)
- [Portable Gpg.EXE Execution Detection](https://docs.query.ai/recipes/portable-gpgexe-execution-detection.md)
- [Potential Arbitrary Command Execution Via FTP.EXE](https://docs.query.ai/recipes/potential-arbitrary-command-execution-via-ftpexe.md)
- [Potential Binary Proxy Execution Via VSDiagnostics.EXE](https://docs.query.ai/recipes/potential-binary-proxy-execution-via-vsdiagnosticsexe.md)
- [Potential Bucket Enumeration on AWS](https://docs.query.ai/recipes/potential-bucket-enumeration-on-aws.md)
- [Potential CobaltStrike Process Injection Detection](https://docs.query.ai/recipes/potential-cobaltstrike-process-injection-detection.md)
- [Potential COM Objects Download Cradles Usage - PS Script](https://docs.query.ai/recipes/potential-com-objects-download-cradles-usage-ps-script.md)
- [Potential Credential Dumping Activity Via LSASS](https://docs.query.ai/recipes/potential-credential-dumping-activity-via-lsass.md)
- [Potential Credential Dumping Attempt Via PowerShell Remote Thread](https://docs.query.ai/recipes/potential-credential-dumping-attempt-via-powershell-remote-thread.md)
- [Potential Defense Evasion Via Binary Rename](https://docs.query.ai/recipes/potential-defense-evasion-via-binary-rename.md)
- [Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution](https://docs.query.ai/recipes/potential-mpclientdll-sideloading-via-offlinescannershellexe-execution.md)
- [Potential PendingFileRenameOperations Tampering](https://docs.query.ai/recipes/potential-pendingfilerenameoperations-tampering.md)
- [Potential Persistence Via Notepad++ Plugins](https://docs.query.ai/recipes/potential-persistence-via-notepad-plugins.md)
- [Potential Persistence Via Shim Database Modification](https://docs.query.ai/recipes/potential-persistence-via-shim-database-modification.md)
- [Potential Privilege Escalation Attempt Via .Exe.Local Technique](https://docs.query.ai/recipes/potential-privilege-escalation-attempt-via-exelocal-technique.md)
- [Potential Raspberry Robin CPL Execution Activity](https://docs.query.ai/recipes/potential-raspberry-robin-cpl-execution-activity.md)
- [Potential Raspberry Robin Registry Modification](https://docs.query.ai/recipes/potential-raspberry-robin-registry-modification.md)
- [Potential Renamed Rundll32 Execution](https://docs.query.ai/recipes/potential-renamed-rundll32-execution.md)
- [Potential RjvPlatform.DLL Sideloading From Default Location](https://docs.query.ai/recipes/potential-rjvplatformdll-sideloading-from-default-location.md)
- [Potential SentinelOne Shell Context Menu Scan Command Tampering](https://docs.query.ai/recipes/potential-sentinelone-shell-context-menu-scan-command-tampering.md)
- [Potential Signing Bypass via Windows Developer Features](https://docs.query.ai/recipes/potential-signing-bypass-via-windows-developer-features.md)
- [Potential SquiblyTwo Technique Execution](https://docs.query.ai/recipes/potential-squiblytwo-technique-execution.md)
- [Potential WinAPI Calls Via PowerShell Scripts](https://docs.query.ai/recipes/potential-winapi-calls-via-powershell-scripts.md)
- [Potentially Suspicious Desktop Background Change Via Registry](https://docs.query.ai/recipes/potentially-suspicious-desktop-background-change-via-registry.md)
- [Powershell Add Name Resolution Policy Table Rule](https://docs.query.ai/recipes/powershell-add-name-resolution-policy-table-rule.md)
- [PowerShell Base64 Encoded Reflective Assembly Load Detection](https://docs.query.ai/recipes/powershell-base64-encoded-reflective-assembly-load-detection.md)
- [PowerShell Console History Logs Deleted](https://docs.query.ai/recipes/powershell-console-history-logs-deleted.md)
- [PowerShell Core DLL Loaded By Non PowerShell Process](https://docs.query.ai/recipes/powershell-core-dll-loaded-by-non-powershell-process.md)
- [Powershell Defender Disable Scan Feature Detection](https://docs.query.ai/recipes/powershell-defender-disable-scan-feature-detection.md)
- [PowerShell Deleted Mounted Share Detection](https://docs.query.ai/recipes/powershell-deleted-mounted-share-detection.md)
- [Powershell DNSExfiltration Detection](https://docs.query.ai/recipes/powershell-dnsexfiltration-detection.md)
- [PowerShell Downgrade Attack Detection](https://docs.query.ai/recipes/powershell-downgrade-attack-detection.md)
- [Detect PowerShell Downloads](https://docs.query.ai/recipes/powershell-downloads.md)
- [PowerShell Execution with Potential Decryption Capabilities](https://docs.query.ai/recipes/powershell-execution-with-potential-decryption-capabilities.md)
- [Powershell Install a DLL in System Directory](https://docs.query.ai/recipes/powershell-install-a-dll-in-system-directory.md)
- [Powershell Keylogging Detection](https://docs.query.ai/recipes/powershell-keylogging-detection.md)
- [PowerShell Module File Creation Detection](https://docs.query.ai/recipes/powershell-module-file-creation-detection.md)
- [PowerShell Script Change Permission Via Set-Acl](https://docs.query.ai/recipes/powershell-script-change-permission-via-set-acl.md)
- [PowerShell Script Execution Policy Enabled Detection](https://docs.query.ai/recipes/powershell-script-execution-policy-enabled-detection.md)
- [Powershell Sensitive File Discovery](https://docs.query.ai/recipes/powershell-sensitive-file-discovery.md)
- [PowerShell Shellcode Detection](https://docs.query.ai/recipes/powershell-shellcode-detection.md)
- [Powershell Timestomp Detection](https://docs.query.ai/recipes/powershell-timestomp-detection.md)
- [Powershell Token Obfuscation - Process Creation](https://docs.query.ai/recipes/powershell-token-obfuscation-process-creation.md)
- [PowerShell Version Mismatch Detection](https://docs.query.ai/recipes/powershell-version-mismatch-detection.md)
- [Powershell WMI Persistence Detection](https://docs.query.ai/recipes/powershell-wmi-persistence-detection.md)
- [Powershell XML Execute Command Detection](https://docs.query.ai/recipes/powershell-xml-execute-command-detection.md)
- [Powerup Write Hijack DLL Detection](https://docs.query.ai/recipes/powerup-write-hijack-dll-detection.md)
- [Primary Refresh Token Access Attempt Detection](https://docs.query.ai/recipes/primary-refresh-token-access-attempt-detection-1.md)
- [Primary Refresh Token Access Attempt Detection](https://docs.query.ai/recipes/primary-refresh-token-access-attempt-detection.md)
- [PrintBrm ZIP Creation or Extraction Detection](https://docs.query.ai/recipes/printbrm-zip-creation-or-extraction-detection.md)
- [Privilege Escalation via Service Permissions Weakness](https://docs.query.ai/recipes/privilege-escalation-via-service-permissions-weakness.md)
- [Procdump Execution Detection](https://docs.query.ai/recipes/procdump-execution-detection.md)
- [Process Explorer Driver Creation By Non-Sysinternals Binary](https://docs.query.ai/recipes/process-explorer-driver-creation-by-non-sysinternals-binary.md)
- [Process Memory Dump Detection via Dotnet-Dump](https://docs.query.ai/recipes/process-memory-dump-detection-via-dotnet-dump.md)
- [Process Memory Dump via RdrLeakDiag.EXE](https://docs.query.ai/recipes/process-memory-dump-via-rdrleakdiagexe.md)
- [PSEXEC Remote Execution File Artefact Detection](https://docs.query.ai/recipes/psexec-remote-execution-file-artefact-detection.md)
- [PsExec Service File Creation Detection](https://docs.query.ai/recipes/psexec-service-file-creation-detection.md)
- [PUA - DefenderCheck Execution](https://docs.query.ai/recipes/pua-defendercheck-execution.md)
- [PUA- IOX Tunneling Tool Execution Detection](https://docs.query.ai/recipes/pua-iox-tunneling-tool-execution-detection.md)
- [PUA - Mouse Lock Execution](https://docs.query.ai/recipes/pua-mouse-lock-execution.md)
- [PUA - NirCmd Execution](https://docs.query.ai/recipes/pua-nircmd-execution.md)
- [Publisher Attachment File Dropped In Suspicious Location](https://docs.query.ai/recipes/publisher-attachment-file-dropped-in-suspicious-location.md)
- [Query Usage To Exfil Data](https://docs.query.ai/recipes/query-usage-to-exfil-data.md)
- [QuickAssist Execution Detection](https://docs.query.ai/recipes/quickassist-execution-detection.md)
- [RDP Sensitive Settings Changed](https://docs.query.ai/recipes/rdp-sensitive-settings-changed.md)
- [Recon Information Export Detection with PowerShell](https://docs.query.ai/recipes/recon-information-export-detection-with-powershell.md)
- [RedMimicry Winnti Playbook Execution Detection](https://docs.query.ai/recipes/redmimicry-winnti-playbook-execution-detection.md)
- [RedMimicry Winnti Playbook Registry Manipulation Detection](https://docs.query.ai/recipes/redmimicry-winnti-playbook-registry-manipulation-detection.md)
- [RegAsm.EXE Execution Without CommandLine Flags or Files](https://docs.query.ai/recipes/regasmexe-execution-without-commandline-flags-or-files.md)
- [Registry Explorer Policy Modification Detection](https://docs.query.ai/recipes/registry-explorer-policy-modification-detection.md)
- [Registry Modification Detection via Regini.exe](https://docs.query.ai/recipes/registry-modification-detection-via-reginiexe.md)
- [Registry Persistence via Service in Safe Mode](https://docs.query.ai/recipes/registry-persistence-via-service-in-safe-mode.md)
- [Regsvr32 DLL Execution With Suspicious File Extension](https://docs.query.ai/recipes/regsvr32-dll-execution-with-suspicious-file-extension.md)
- [RemCom Service File Creation Detection](https://docs.query.ai/recipes/remcom-service-file-creation-detection.md)
- [Remote Access Tool - ScreenConnect Remote Command Execution](https://docs.query.ai/recipes/remote-access-tool-screenconnect-remote-command-execution.md)
- [Remote Thread Creation in mstsc.exe from Suspicious Location](https://docs.query.ai/recipes/remote-thread-creation-in-mstscexe-from-suspicious-location.md)
- [Renamed MegaSync Execution Detection](https://docs.query.ai/recipes/renamed-megasync-execution-detection.md)
- [Renamed Remote Utilities RAT (RURAT) Execution Detection](https://docs.query.ai/recipes/renamed-remote-utilities-rat-rurat-execution-detection.md)
- [RipZip Attack on Startup Folder](https://docs.query.ai/recipes/ripzip-attack-on-startup-folder.md)
- [Root Certificate Installation from Suspicious Locations](https://docs.query.ai/recipes/root-certificate-installation-from-suspicious-locations.md)
- [Rundll32 Execution With Uncommon DLL Extension](https://docs.query.ai/recipes/rundll32-execution-with-uncommon-dll-extension.md)
- [Rundll32 Spawned Via Explorer.EXE FSQL Translation](https://docs.query.ai/recipes/rundll32-spawned-via-explorerexe-fsql-translation.md)
- [SafetyKatz Dump Indicator](https://docs.query.ai/recipes/safetykatz-dump-indicator.md)
- [Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE](https://docs.query.ai/recipes/schedule-task-creation-from-env-variable-or-potentially-suspicious-path-via-schtasksexe.md)
- [ScreenConnect Temporary Installation Artefact Detection](https://docs.query.ai/recipes/screenconnect-temporary-installation-artefact-detection.md)
- [ScreenConnect User Database Modification Detection](https://docs.query.ai/recipes/screenconnect-user-database-modification-detection.md)
- [ScreenConnect Web Shell Execution Detection](https://docs.query.ai/recipes/screenconnect-web-shell-execution-detection.md)
- [Script Interpreter Execution From Suspicious Folder](https://docs.query.ai/recipes/script-interpreter-execution-from-suspicious-folder.md)
- [Self Extracting Package Creation Via Iexpress.EXE From Suspicious Location](https://docs.query.ai/recipes/self-extracting-package-creation-via-iexpressexe-from-suspicious-location.md)
- [Self Extraction Directive File Creation in Suspicious Location](https://docs.query.ai/recipes/self-extraction-directive-file-creation-in-suspicious-location.md)
- [Service Binary in Suspicious Folder](https://docs.query.ai/recipes/service-binary-in-suspicious-folder.md)
- [Service DACL Abuse Detection with Sc.exe](https://docs.query.ai/recipes/service-dacl-abuse-detection-with-scexe.md)
- [ServiceDll Hijack Detection](https://docs.query.ai/recipes/servicedll-hijack-detection.md)
- [SES Identity Deletion Detection](https://docs.query.ai/recipes/ses-identity-deletion-detection.md)
- [Shadow Copies Deletion Using Operating Systems Utilities](https://docs.query.ai/recipes/shadow-copies-deletion-using-operating-systems-utilities.md)
- [Share and Session Enumeration Detection with Net.exe](https://docs.query.ai/recipes/share-and-session-enumeration-detection-with-netexe.md)
- [ShellDispatch.DLL Sideloading Detection](https://docs.query.ai/recipes/shelldispatchdll-sideloading-detection.md)
- [ShimCache Flush Detection](https://docs.query.ai/recipes/shimcache-flush-detection.md)
- [Sign-in from Malware Infected IP](https://docs.query.ai/recipes/sign-in-from-malware-infected-ip.md)
- [Sign-ins by Unknown Devices](https://docs.query.ai/recipes/sign-ins-by-unknown-devices.md)
- [Sign-ins from Non-Compliant Devices](https://docs.query.ai/recipes/sign-ins-from-non-compliant-devices.md)
- [Silence EmpireDNSAgent Detection](https://docs.query.ai/recipes/silence-empirednsagent-detection.md)
- [SmadHook.DLL Sideloading Detection](https://docs.query.ai/recipes/smadhookdll-sideloading-detection.md)
- [SQLite Firefox Profile Data DB Access Detection](https://docs.query.ai/recipes/sqlite-firefox-profile-data-db-access-detection.md)
- [Stale Accounts In A Privileged Role](https://docs.query.ai/recipes/stale-accounts-in-a-privileged-role.md)
- [Startup Folder File Write Detection](https://docs.query.ai/recipes/startup-folder-file-write-detection.md)
- [Suspect Svchost Activity Detection](https://docs.query.ai/recipes/suspect-svchost-activity-detection.md)
- [Suspicious AddinUtil.EXE CommandLine Execution](https://docs.query.ai/recipes/suspicious-addinutilexe-commandline-execution.md)
- [Suspicious Advpack Call Via Rundll32.EXE](https://docs.query.ai/recipes/suspicious-advpack-call-via-rundll32exe.md)
- [Suspicious Appended Extension Detection](https://docs.query.ai/recipes/suspicious-appended-extension-detection.md)
- [Suspicious Binary Writes Via AnyDesk](https://docs.query.ai/recipes/suspicious-binary-writes-via-anydesk.md)
- [Suspicious Camera and Microphone Access](https://docs.query.ai/recipes/suspicious-camera-and-microphone-access.md)
- [Suspicious Child Processes from ConHost](https://docs.query.ai/recipes/suspicious-child-processes-from-conhost.md)
- [Suspicious Command Patterns in Scheduled Task Creation](https://docs.query.ai/recipes/suspicious-command-patterns-in-scheduled-task-creation.md)
- [Suspicious CustomShellHost Execution](https://docs.query.ai/recipes/suspicious-customshellhost-execution.md)
- [Suspicious Deno File Written from Remote Source](https://docs.query.ai/recipes/suspicious-deno-file-written-from-remote-source.md)
- [Suspicious Diantz Alternate Data Stream Execution](https://docs.query.ai/recipes/suspicious-diantz-alternate-data-stream-execution.md)
- [Suspicious DLL Loaded via CertOC.EXE](https://docs.query.ai/recipes/suspicious-dll-loaded-via-certocexe.md)
- [Suspicious Double Extension Files](https://docs.query.ai/recipes/suspicious-double-extension-files.md)
- [Suspicious Download via Certutil.EXE Detection](https://docs.query.ai/recipes/suspicious-download-via-certutilexe-detection.md)
- [Suspicious Execution of Shutdown](https://docs.query.ai/recipes/suspicious-execution-of-shutdown.md)
- [Suspicious Extrac32 Alternate Data Stream Execution](https://docs.query.ai/recipes/suspicious-extrac32-alternate-data-stream-execution.md)
- [Suspicious File Created in Outlook Temporary Directory](https://docs.query.ai/recipes/suspicious-file-created-in-outlook-temporary-directory.md)
- [Suspicious File Download from File Sharing Domain via Curl.EXE](https://docs.query.ai/recipes/suspicious-file-download-from-file-sharing-domain-via-curlexe.md)
- [Suspicious File Download From IP Via Curl.EXE](https://docs.query.ai/recipes/suspicious-file-download-from-ip-via-curlexe.md)
- [Suspicious File Encoded To Base64 Via Certutil.EXE](https://docs.query.ai/recipes/suspicious-file-encoded-to-base64-via-certutilexe.md)
- [Suspicious File Write to Webapps Root Directory](https://docs.query.ai/recipes/suspicious-file-write-to-webapps-root-directory.md)
- [Suspicious For Loop in CMD](https://docs.query.ai/recipes/suspicious-for-loop-in-cmd.md)
- [Suspicious FromBase64String Usage On Gzip Archive - Ps Script](https://docs.query.ai/recipes/suspicious-frombase64string-usage-on-gzip-archive-ps-script.md)
- [Suspicious Get-ADDBAccount Usage Detection](https://docs.query.ai/recipes/suspicious-get-addbaccount-usage-detection.md)
- [Suspicious Get Local Groups Information](https://docs.query.ai/recipes/suspicious-get-local-groups-information.md)
- [Suspicious Group And Account Reconnaissance Activity Using Net.EXE](https://docs.query.ai/recipes/suspicious-group-and-account-reconnaissance-activity-using-netexe.md)
- [Suspicious High IntegrityLevel Conhost Legacy Option](https://docs.query.ai/recipes/suspicious-high-integritylevel-conhost-legacy-option.md)
- [Suspicious Inbox Forwarding Identity Protection](https://docs.query.ai/recipes/suspicious-inbox-forwarding-identity-protection.md)
- [Suspicious Invoke-WebRequest Execution Detection](https://docs.query.ai/recipes/suspicious-invoke-webrequest-execution-detection.md)
- [Suspicious Java Processes Spawning System Utilities](https://docs.query.ai/recipes/suspicious-java-processes-spawning-system-utilities.md)
- [Suspicious Kerberos Ticket Request via CLI](https://docs.query.ai/recipes/suspicious-kerberos-ticket-request-via-cli.md)
- [Suspicious LDAP Connection via PowerShell Script](https://docs.query.ai/recipes/suspicious-ldap-connection-via-powershell-script.md)
- [Suspicious LSASS Access with Dbgcore/Dbghelp DLLs](https://docs.query.ai/recipes/suspicious-lsass-access-with-dbgcoredbghelp-dlls.md)
- [Suspicious Msiexec Quiet Install From Remote Location](https://docs.query.ai/recipes/suspicious-msiexec-quiet-install-from-remote-location.md)
- [Suspicious Non PowerShell WSMAN COM Provider](https://docs.query.ai/recipes/suspicious-non-powershell-wsman-com-provider.md)
- [Suspicious OAuth App File Download Activities Detection](https://docs.query.ai/recipes/suspicious-oauth-app-file-download-activities-detection.md)
- [Suspicious Plink Port Forwarding Detection](https://docs.query.ai/recipes/suspicious-plink-port-forwarding-detection.md)
- [Suspicious Powercfg Execution to Change Lock Screen Timeout](https://docs.query.ai/recipes/suspicious-powercfg-execution-to-change-lock-screen-timeout.md)
- [Suspicious PowerShell Download - PoshModule](https://docs.query.ai/recipes/suspicious-powershell-download-poshmodule.md)
- [Suspicious PowerShell Get Current User](https://docs.query.ai/recipes/suspicious-powershell-get-current-user.md)
- [Suspicious PowerShell Mailbox Export to Share - PS](https://docs.query.ai/recipes/suspicious-powershell-mailbox-export-to-share-ps.md)
- [Suspicious PROCEXP152.sys File Creation Detection](https://docs.query.ai/recipes/suspicious-procexp152sys-file-creation-detection.md)
- [Suspicious RASdial Activity Detection](https://docs.query.ai/recipes/suspicious-rasdial-activity-detection.md)
- [Suspicious RDP Redirect Using TSCON Detection](https://docs.query.ai/recipes/suspicious-rdp-redirect-using-tscon-detection.md)
- [Suspicious Reconnaissance Activity Detection with Get-LocalGroupMember Cmdlet](https://docs.query.ai/recipes/suspicious-reconnaissance-activity-detection-with-get-localgroupmember-cmdlet.md)
- [Suspicious RstrtMgr.DLL Load Detection](https://docs.query.ai/recipes/suspicious-rstrtmgrdll-load-detection.md)
- [Suspicious Screensaver Binary File Creation](https://docs.query.ai/recipes/suspicious-screensaver-binary-file-creation.md)
- [Suspicious Script Execution From Temp Folder](https://docs.query.ai/recipes/suspicious-script-execution-from-temp-folder.md)
- [Suspicious Serv-U Process Pattern](https://docs.query.ai/recipes/suspicious-serv-u-process-pattern.md)
- [Suspicious SMB Share Information Gathering](https://docs.query.ai/recipes/suspicious-smb-share-information-gathering.md)
- [Suspicious SSL Connection Detection](https://docs.query.ai/recipes/suspicious-ssl-connection-detection.md)
- [Suspicious TCP Tunnel Via PowerShell Script](https://docs.query.ai/recipes/suspicious-tcp-tunnel-via-powershell-script.md)
- [Suspicious UltraVNC Execution Detection](https://docs.query.ai/recipes/suspicious-ultravnc-execution-detection.md)
- [Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE](https://docs.query.ai/recipes/suspicious-windows-defender-folder-exclusion-added-via-regexe.md)
- [Suspicious X509Enrollment in PowerShell Scripts](https://docs.query.ai/recipes/suspicious-x509enrollment-in-powershell-scripts.md)
- [SyncAppvPublishingServer Bypass Detection](https://docs.query.ai/recipes/syncappvpublishingserver-bypass-detection.md)
- [SyncAppvPublishingServer Execute Arbitrary PowerShell Code](https://docs.query.ai/recipes/syncappvpublishingserver-execute-arbitrary-powershell-code.md)
- [Sysinternals PsService Execution](https://docs.query.ai/recipes/sysinternals-psservice-execution.md)
- [Sysinternals PsSuspend Suspicious Execution](https://docs.query.ai/recipes/sysinternals-pssuspend-suspicious-execution.md)
- [SysmonEnte Execution Detection (Partial Conversion)](https://docs.query.ai/recipes/sysmonente-execution-detection-partial-conversion.md)
- [System DLL Name in Unsuspected Locations](https://docs.query.ai/recipes/system-dll-name-in-unsuspected-locations.md)
- [System Information Discovery via Registry Queries](https://docs.query.ai/recipes/system-information-discovery-via-registry-queries.md)
- [System Scripts Autorun Keys Modification Detection](https://docs.query.ai/recipes/system-scripts-autorun-keys-modification-detection.md)
- [TeamViewer Log File Deletion Detection](https://docs.query.ai/recipes/teamviewer-log-file-deletion-detection.md)
- [TeamViewer Remote Session Detection](https://docs.query.ai/recipes/teamviewer-remote-session-detection.md)
- [Temporary Access Pass Added To An Account](https://docs.query.ai/recipes/temporary-access-pass-added-to-an-account.md)
- [UAC Bypass Detection Using Disk Cleanup in FSQL](https://docs.query.ai/recipes/uac-bypass-detection-using-disk-cleanup-in-fsql.md)
- [UAC Bypass Detection Using WOW64 Logger DLL Hijack](https://docs.query.ai/recipes/uac-bypass-detection-using-wow64-logger-dll-hijack.md)
- [UAC Bypass Detection via Consent and Comctl32 File Creation](https://docs.query.ai/recipes/uac-bypass-detection-via-consent-and-comctl32-file-creation.md)
- [UAC Bypass Detection via File Creation by DllHost.exe](https://docs.query.ai/recipes/uac-bypass-detection-via-file-creation-by-dllhostexe.md)
- [UAC Bypass Detection via IEInstal.exe File Creation](https://docs.query.ai/recipes/uac-bypass-detection-via-ieinstalexe-file-creation.md)
- [UAC Bypass Detection via NTFS Reparse Point File Creation](https://docs.query.ai/recipes/uac-bypass-detection-via-ntfs-reparse-point-file-creation.md)
- [UAC Bypass Detection via Winsat Path Parsing in Registry](https://docs.query.ai/recipes/uac-bypass-detection-via-winsat-path-parsing-in-registry.md)
- [UAC Bypass Detection via WSReset Registry Modification](https://docs.query.ai/recipes/uac-bypass-detection-via-wsreset-registry-modification.md)
- [UAC Bypass Using Windows Media Player - Registry](https://docs.query.ai/recipes/uac-bypass-using-windows-media-player-registry.md)
- [UAC Bypass via Sdclt Registry Manipulation](https://docs.query.ai/recipes/uac-bypass-via-sdclt-registry-manipulation.md)
- [UAC Bypass via Windows Firewall Snap-In Hijack](https://docs.query.ai/recipes/uac-bypass-via-windows-firewall-snap-in-hijack.md)
- [Unable to Convert Sigma Rule Detecting Direct Syscall of NtOpenProcess to FSQL](https://docs.query.ai/recipes/unable-to-convert-sigma-rule-detecting-direct-syscall-of-ntopenprocess-to-fsql.md)
- [Uncommon Assistive Technology Applications Execution Via AtBroker.EXE](https://docs.query.ai/recipes/uncommon-assistive-technology-applications-execution-via-atbrokerexe.md)
- [Uncommon Extension In Keyboard Layout IME File Registry Value](https://docs.query.ai/recipes/uncommon-extension-in-keyboard-layout-ime-file-registry-value.md)
- [Uncommon Extension Shim Database Installation Via Sdbinst.EXE](https://docs.query.ai/recipes/uncommon-extension-shim-database-installation-via-sdbinstexe.md)
- [Uncommon File Created in Office Startup Folder](https://docs.query.ai/recipes/uncommon-file-created-in-office-startup-folder.md)
- [Uncommon File Creation By Mysql Daemon Process](https://docs.query.ai/recipes/uncommon-file-creation-by-mysql-daemon-process.md)
- [Uncommon Process Access Rights Detection with Limited FSQL](https://docs.query.ai/recipes/uncommon-process-access-rights-detection-with-limited-fsql.md)
- [Uncommon Sigverif.EXE Child Process Detection](https://docs.query.ai/recipes/uncommon-sigverifexe-child-process-detection.md)
- [Uncommon Svchost Parent Process Detection](https://docs.query.ai/recipes/uncommon-svchost-parent-process-detection.md)
- [Unfamiliar Sign-In Properties Detection](https://docs.query.ai/recipes/unfamiliar-sign-in-properties-detection.md)
- [Unsigned mfdetours.dll Sideloading Detection](https://docs.query.ai/recipes/unsigned-mfdetoursdll-sideloading-detection.md)
- [Unusual Child Process of dns.exe](https://docs.query.ai/recipes/unusual-child-process-of-dnsexe.md)
- [User Added To Group With CA Policy Modification Access](https://docs.query.ai/recipes/user-added-to-group-with-ca-policy-modification-access.md)
- [User Added To Privilege Role](https://docs.query.ai/recipes/user-added-to-privilege-role.md)
- [User State Changed From Guest To Member](https://docs.query.ai/recipes/user-state-changed-from-guest-to-member.md)
- [VBA DLL Loaded Via Office Application](https://docs.query.ai/recipes/vba-dll-loaded-via-office-application.md)
- [Veeam Backup Servers Credential Dumping Script Execution](https://docs.query.ai/recipes/veeam-backup-servers-credential-dumping-script-execution.md)
- [VsCode Powershell Profile Modification Detection](https://docs.query.ai/recipes/vscode-powershell-profile-modification-detection.md)
- [VSCode Tunnel Remote File Creation Detection](https://docs.query.ai/recipes/vscode-tunnel-remote-file-creation-detection.md)
- [Wdigest CredGuard Registry Modification Detection](https://docs.query.ai/recipes/wdigest-credguard-registry-modification-detection.md)
- [WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze](https://docs.query.ai/recipes/werfaultsecure-loading-dbgcore-or-dbghelp-edr-freeze.md)
- [Windows Event Log Access Tampering Detection](https://docs.query.ai/recipes/windows-event-log-access-tampering-detection.md)
- [Windows Kernel Debugger Execution Detection](https://docs.query.ai/recipes/windows-kernel-debugger-execution-detection.md)
- [Hunting for Windows Print Spooler Service Suspicious File Creation](https://docs.query.ai/recipes/windows-print-spooler-service-suspicious-file-creation.md)
- [WINEKEY Registry Modification Detection](https://docs.query.ai/recipes/winekey-registry-modification-detection.md)
- [Winget Admin Settings Modification Detection](https://docs.query.ai/recipes/winget-admin-settings-modification-detection.md)
- [WinSxS Executable File Creation By Non-System Process](https://docs.query.ai/recipes/winsxs-executable-file-creation-by-non-system-process.md)
- [WMI DLL Hijack Detection](https://docs.query.ai/recipes/wmi-dll-hijack-detection.md)
- [Wmiexec Default Output File Detection](https://docs.query.ai/recipes/wmiexec-default-output-file-detection.md)
- [Wow6432Node Classes Autorun Keys Modification Detection](https://docs.query.ai/recipes/wow6432node-classes-autorun-keys-modification-detection.md)
- [WScript/CScript File Dropper Detection](https://docs.query.ai/recipes/wscriptcscript-file-dropper-detection.md)
- [WSL Kali-Linux Usage Detection](https://docs.query.ai/recipes/wsl-kali-linux-usage-detection.md)
- [Wusa.EXE Executed By Parent Process Located In Suspicious Location](https://docs.query.ai/recipes/wusaexe-executed-by-parent-process-located-in-suspicious-location.md)