Copy-and-paste hunts in KQL, SPL and Elastic. Every one is time-bounded, says what telemetry it needs, names the benign things it will return, and states whether it has ever actually been run.
Every hunt is time-bounded, because an unbounded search against a year of data is an outage. Every hunt names what it returns that is not evil. And every variant says whether it has been run, syntax checked, or only written.
Finds LSASS dumps taken with a DLL that ships in System32, whether the export is named or called by ordinal. One idea in three query languages, each bounded to seven days.
Event 1102 is the first record of the new log, so it survives the clearing and names the account that did it. One of the cheapest hunts there is, and worth thirty days rather than seven.
