Hunt with context.
Not just queries.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Analyst notes: Confirm parent-child relationship and inspect signed binaries, scripts and user context. Office add-ins and approved automation can trigger.

Author: CyberIntel original. Syntax and schema reference ↗

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("EncodedCommand", "enc", "DownloadString")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

Analyst notes: Encoded commands may be legitimate administration. Decode offline in an isolated analysis environment and correlate with initiating process and device.

Author: CyberIntel original. Syntax and schema reference ↗

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 earliest=-24h
| stats count as failures dc(ComputerName) as hosts by Account_Name, src_ip
| where failures >= 10
| sort - failures

Analyst notes: Replace index=wineventlog with your actual index; event fields and aliases differ by TA. Tune thresholds for service accounts and known scanners.

Author: CyberIntel original. Syntax and schema reference ↗

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688 earliest=-7d
| eval cmd=coalesce(Process_Command_Line, CommandLine)
| where like(lower(cmd), "%powershell%")
| table _time host Account_Name New_Process_Name cmd

Analyst notes: Requires process creation auditing and command line inclusion. Adjust field extractions and avoid treating administrative scripting as automatically malicious.

Author: CyberIntel original. Syntax and schema reference ↗

index=dns earliest=-24h
| stats count as requests dc(src_ip) as clients by query
| where clients <= 2 AND requests >= 3
| sort - requests
| head 100

Analyst notes: Adapt index and query field to your DNS source. Rare domains alone are not malicious; enrich with reputation, domain age and requesting process.

Author: CyberIntel original. Syntax and schema reference ↗

rule CI_Demo_PowerShell_Strings
{
    meta:
        description = "Demo only: executable with PowerShell-related strings"
        author = "CyberIntel"
    strings:
        $mz = { 4D 5A }
        $ps1 = "powershell.exe" ascii nocase
        $ps2 = "-EncodedCommand" ascii nocase
    condition:
        filesize < 20MB and $mz at 0 and ($ps1 or $ps2)
}

Analyst notes: Educational heuristic, likely false positives in installers and admin software; no malware-family attribution. Run against trusted samples in a controlled lab.

Author: CyberIntel original. Syntax and schema reference ↗

rule CI_Demo_Script_Eval_Atob
{
    meta:
        description = "Demo only: common JavaScript decoding patterns"
        author = "CyberIntel"
    strings:
        $a = "eval(" ascii nocase
        $b = "atob(" ascii nocase
        $c = "fromCharCode(" ascii nocase
    condition:
        filesize < 5MB and 2 of ($a, $b, $c)
}

Analyst notes: A noisy educational indicator; legitimate applications commonly use eval and atob. Correlate with origin and obfuscation rather than auto-blocking.

Author: CyberIntel original. Syntax and schema reference ↗

rule CI_Demo_PE_URL_Shell
{
    meta:
        description = "Demo only: PE with network and shell strings"
        author = "CyberIntel"
    strings:
        $mz = { 4D 5A }
        $url = "http://" ascii nocase
        $url2 = "https://" ascii nocase
        $shell = "cmd.exe" ascii nocase
    condition:
        filesize < 20MB and $mz at 0 and ($shell and 1 of ($url, $url2))
}

Analyst notes: Generic strings are not maliciousness proofs. Useful only as a starting point for educational triage and enrichment.

Author: CyberIntel original. Syntax and schema reference ↗