All free toolsFree tool · Threat hunting
Would you spot OAuth abuse or token theft in your tenant?
A ready library of 44 KQL hunting queries, 15 detection rules and 5 indicator lists for Microsoft Sentinel and Defender XDR.
- Microsoft 365 Threat Hunting Library
- Output: KQL library
- Free, no trial or account needed
Check your inbox
The link is on its way
We sent the download link to . It works for 7 days. Can’t find it? Check your junk folder.
While you wait: see Griffin31What it finds
- 44 hunting queries: OAuth consent abuse, device-code phishing, infostealers, inbox forwarding, federation changes
- 13 Microsoft Sentinel analytics rules and 2 Defender XDR custom detections
- 5 indicator lists: malicious OAuth apps, infostealer infrastructure, phishing kits, threat actor IPs, file hashes
- Source attribution for every query, rule and indicator
Why it matters
Each item is tied to a real incident or attacker technique, mapped to MITRE ATT&CK, and explains what a real hit looks like and what to do next.
How it works
- 01Get the libraryLeave your details and we email you the download link.
- 02Pick a huntEach .kql file explains why it matters, the data it needs and how to tune it.
- 03Run itPaste the query into Sentinel Logs or Defender advanced hunting.
- 04Keep watchingDeploy the detection rules so the important hunts run on their own.
Requirements
- Microsoft Sentinel or Microsoft Defender XDR advanced hunting
What it can touch
Queries only read your logs. Detection rules are added only if you deploy them.
Griffin31
This tool checks one area. Griffin31 checks your whole tenant.
More than 370 Microsoft 365 security settings, the evidence behind every result, what to fix first, and an email when a setting slips back.
More free tools
Conditional AccessConditional Access Policy AnalyzerScore your Conditional Access policies and find the gaps attackers use.IdentityEntra App Registration AuditFind risky app permissions, expiring credentials and unused apps.Data and collaborationSharePoint Sites AuditFind the sites, OneDrives and Teams shared too widely.