MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1210Exploitation of Remote Services

Lateral Movement

View on MITRE ATT&CK →

2 Queries

CVE-2026-33824 — IKEEXT Service Anomaly

highexperimentalMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceEvents

// IKEEXT service anomalies hosted by svchost.exe — CVE-2026-33824 exploitation indicator
DeviceEvents
| where ActionType in ("ServiceInstalled", "ProcessCreatedFromNativeCode")
| where InitiatingProcessFileName =~ "svchost.exe"
| where AdditionalFields has "IKEEXT"
| project Timestamp, DeviceName, DeviceId, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields
| order by Timestamp desc

triathIC · last tested 2026-04-28

attack.mitre.org

Tuning notes

Map Host entity to DeviceName/DeviceId in the analytics rule. In Sentinel, configure Incident Settings → Group related alerts → 'Grouping alerts into a single incident if all the entities match' on Host within a 1h lookback, and check 'Group alerts triggered by this analytics rule with alerts from other rules that produced the same entities' so this rule and KQL-T1210-002 correlate into one incident per host. Baseline-tune for legitimate IKEEXT service restarts triggered by VPN client installs or Windows Update.

CVE-2026-33824 — External IKEv2 Inbound Volume

mediumexperimentalMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceNetworkEvents

// External IKEv2 traffic volume on UDP 500 / 4500 — CVE-2026-33824 scan/exploit heuristic
DeviceNetworkEvents
| where Protocol == "Udp"
| where RemotePort in (500, 4500)
| where RemoteIPType != "Private"
| summarize PacketCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, DeviceId, RemoteIP, RemotePort
| where PacketCount > 50
| order by PacketCount desc

triathIC · last tested 2026-04-28

attack.mitre.org

Tuning notes

Map Host entity to DeviceName/DeviceId and IP entity to RemoteIP. In Sentinel, configure Incident Settings → Group related alerts → 'Grouping alerts into a single incident if all the entities match' on Host within a 1h lookback, and enable cross-rule grouping so this rule and KQL-T1210-001 correlate into one incident per host. The PacketCount > 50 threshold is intentionally conservative — VPN gateways and DirectAccess servers exceed this easily under normal load; raise the threshold or exclude known concentrator hosts before enabling as a near-real-time rule.

+ Add another query for this technique →