Copy-and-paste hunts in KQL, SPL and Elastic. Every one is time-bounded, says what telemetry it needs, names the benign things it will return, and states whether it has ever actually been run.
Every hunt is time-bounded, because an unbounded search against a year of data is an outage. Every hunt names what it returns that is not evil. And every variant says whether it has been run, syntax checked, or only written.
IIS, Apache, nginx and Java application servers do not normally start cmd, PowerShell or a Unix shell. When they do, it is the most reliable sign of a web shell in use, on Windows and Linux alike.
New or changed inbox rules with forwarding, deletion or move actions, across every mailbox. The rule an attacker leaves behind to watch for invoices and hide the replies.
Every addition to a privileged Active Directory group in the last week, with who made it. Three event IDs, because the groups are three different scopes.
Finds rclone by what the binary says about itself rather than by its file name, so a copy renamed to svchost.exe in a user folder still shows up. The commonest data theft tool in ransomware operations.
Accounts with five or more failed MFA challenges in an hour, in Entra ID and Okta. The signature of somebody holding the password and waiting for a tired approval.
For each account, the successful sign-ins from an IP address not seen for that account in the previous 30 days. The first question in any unfamiliar sign-in alert, asked across the whole tenant at once.
Finds LSASS dumps taken with a DLL that ships in System32, whether the export is named or called by ordinal. One idea in three query languages, each bounded to seven days.
Event 1102 is the first record of the new log, so it survives the clearing and names the account that did it. One of the cheapest hunts there is, and worth thirty days rather than seven.
