MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1059.001PowerShell

Execution

View on MITRE ATT&CK →

2 Queries

PowerShell Download Cradle Execution

highproductionMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("IEX", "Invoke-Expression", "Invoke-WebRequest", "Invoke-RestMethod", ".DownloadString", ".DownloadFile", "Start-BitsTransfer")
| where ProcessCommandLine !has "WindowsUpdate"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

triathIC · last tested 2025-03-01

attack.mitre.org
learn.microsoft.com

Tuning notes

Exclude SCCM/Intune management scripts and known automation service accounts. Add org-specific update scripts to the !has filter.

+ Add another query for this technique →