Open Issues Need Help
View All on GitHub Add a MITRE ATT&CK Navigator coverage layer (JSON) about 2 hours ago
documentation good first issue
SecLists, but for M365 defenders — paste-ready, ATT&CK-mapped KQL threat-hunting queries + IOC lists for Entra ID, Intune & Microsoft 365 (Defender XDR & Sentinel).
#advanced-hunting#bec#blue-team#detection-as-code#detection-engineering#dfir#entra-id#incident-response#intune#kql#m365#microsoft-365#microsoft-defender#microsoft-sentinel#mitre-attack#powershell#security#soc#threat-hunting
good first issue detection
SecLists, but for M365 defenders — paste-ready, ATT&CK-mapped KQL threat-hunting queries + IOC lists for Entra ID, Intune & Microsoft 365 (Defender XDR & Sentinel).
#advanced-hunting#bec#blue-team#detection-as-code#detection-engineering#dfir#entra-id#incident-response#intune#kql#m365#microsoft-365#microsoft-defender#microsoft-sentinel#mitre-attack#powershell#security#soc#threat-hunting
Add Intune Autopilot / enrollment-abuse hunting queries about 2 hours ago
help wanted detection
SecLists, but for M365 defenders — paste-ready, ATT&CK-mapped KQL threat-hunting queries + IOC lists for Entra ID, Intune & Microsoft 365 (Defender XDR & Sentinel).
#advanced-hunting#bec#blue-team#detection-as-code#detection-engineering#dfir#entra-id#incident-response#intune#kql#m365#microsoft-365#microsoft-defender#microsoft-sentinel#mitre-attack#powershell#security#soc#threat-hunting
Add a confirmed-malicious OAuth app ID to the IOC list (with source) about 2 hours ago
help wanted good first issue ioc
SecLists, but for M365 defenders — paste-ready, ATT&CK-mapped KQL threat-hunting queries + IOC lists for Entra ID, Intune & Microsoft 365 (Defender XDR & Sentinel).
#advanced-hunting#bec#blue-team#detection-as-code#detection-engineering#dfir#entra-id#incident-response#intune#kql#m365#microsoft-365#microsoft-defender#microsoft-sentinel#mitre-attack#powershell#security#soc#threat-hunting