Detection and Hunting Queries for
Sentinel and Defender XDR

KQL detections, hunts and campaign dossiers, tested in real security operations.

Browse by category

Submit Query Feedback

GoXDR created by Göksel Atakan

0 queries

|

Pick a query from the list. Use ↑ ↓ to move, c to copy, / to search.

ATT&CK coverage matrix

MITRE ATT&CK Enterprise tactics. Deeper blue means more detections in this library. Click any tactic column to filter the hunt view to that tactic.

No coverage

1-2 queries

3-5 queries

6+ queries

Early stage: recon, initial access, execution

Mid stage: persistence through lateral movement

Late stage: collection, C2, exfiltration, impact

MITRE ATLAS tactics and techniques for AI enabled systems.

No query yet

Covered by at least one query