MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1018Remote System Discovery

Discovery

View on MITRE ATT&CK →

1 Query

Anomalous SMB Session Volume Indicating Network Reconnaissance

mediumtestingDefender XDR

Microsoft Defender for Endpoint·DeviceNetworkEvents

let Threshold = 50;
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort == 445
| summarize TotalIPs = dcount(RemoteIP), RemoteIPs = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 15m)
| where TotalIPs >= Threshold
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, TotalIPs, RemoteIPs
| sort by TotalIPs desc

Bert-JanP (adapted) · last tested 2025-03-01

attack.mitre.org
github.com

Tuning notes

Vulnerability scanners (Nessus, Qualys) and SCCM will trigger this pattern. Exclude scanner IPs and management servers. Adjust Threshold based on network size.

+ Add another query for this technique →