Aegis
// Investigation

Hunt library

Saved queries turn a one-off investigation into a check anyone on the rota can repeat. Save a hunt from the console after you have proved it returns what you expect.

4saved hunts27total executions
Hunt console

Impossible travel candidates

Successful authentications originating outside the primary region in the last day.

12 runs
type:AUTHENTICATION_SUCCESS country:!USA last:24h
Analyst · last run
Run

Encoded interpreter execution

PowerShell invoked with a base64 payload.

7 runs
process:powershell cmd:-enc
Analyst · last run
Run

Privileged directory changes

Account creation and administrative group modification.

5 runs
type:USER_CREATED
Analyst · last run
Run

Perimeter denies by source

Edge blocks in the last six hours, for scanning triage.

3 runs
type:NETWORK_DENY last:6h
Zain Khan
Run

Starting points

Query patterns worth keeping, if the library is still empty.

  • Failed auth in the last day
    type:AUTHENTICATION_FAILURE last:24h
    Run
  • Encoded PowerShell
    process:powershell cmd:-enc
    Run
  • Critical activity outside the US
    severity:CRITICAL country:!USA
    Run
  • Everything touching jsmith
    user:jsmith
    Run
  • Firewall denies
    source:"Palo Alto" action:deny
    Run