KQL Hunting query Generator

Microsoft 365 Defender focussed.

Input fields are optional, if left blank they are ignored.

1. Enter search:

2. Set Time Range:

3. Enter user account name:

4. Enter device name:

5. Enter source IP:

6. Enter destination IP:

7. Enter url:

8.1. Enter process name:

8.2. Select Command-line arguments: DownloadFile DownloadData DownloadString WebRequest WebClient Invoke-Item Invoke-WebRequest Invoke-Expression Start-Process Out-File Hidden WebClient Shellcode http https

9. Select project Column mode:
All Network mode

10. Select the maximum result limit:
200 50 100 300 500 1000

@b41ss