Master XQL
Queries

dataset = xdr_data
| filter lowercase(action_process_image_name) = "powershell.exe"
| filter lowercase(action_process_image_command_line) contains "invoke-webrequest" or lowercase(action_process_image_command_line) contains "iwr"

dataset = xdr_data
| filter lowercase(event_type) = "process injection"
| filter lowercase(action_process_image_name) = "lsass.exe"
| filter lowercase(actor_process_image_name) != "svchost.exe"

dataset = xdr_data
| filter lowercase(event_type) = "process execution"
| comp count(action_process_image_name) as execution_count by actor_process_image_name, action_process_image_name
| filter execution_count < 5

dataset = xdr_data
| filter lowercase(event_type) = "removable storage"
| fields device_name, action_device_product_id, action_device_vendor_id, action_file_name
| sort desc by _time

dataset = xdr_data
| filter lowercase(action_process_image_name) in ("wmiprvse.exe", "scrcons.exe")
| filter lowercase(action_process_image_command_line) contains "activescripteventconsumer" or lowercase(action_process_image_command_line) contains "commandlineeventconsumer"

dataset = xdr_data
| filter lowercase(event_type) = "kerberos authentication"
| filter lowercase(action_kerberos_ticket_encryption_type) = "rc4-hmac"
| filter lowercase(action_kerberos_ticket_type) = "service ticket"