Michael ag-michael

## ADenrichment.html
<style>
#reportrow {
  position:relative;
  overflow-wrap:anywhere;
  border-bottom:solid 1px;
}
</style>

<div class="panel panel-info" ng-if="success">
    <div class="panel-heading">

## FalconHuntqueries.md

      
              1 file
            
          
              8 forks
            
          
              0 comments
            
          
              38 stars
            
          
                ag-michael
                / FalconHuntqueries.md
            
            
              Last active
              November 23, 2023 12:02
            
              
                Falcon hunt queries
              
          
    timestamp convert:


 convert ctime(timestamp/1000)

.top,.club,.xyz,.ru domain lookups where the amount of lookup for the domain is more than 1 and less than 4 per computer


aid=* event_simpleName=DnsRequest | regex DomainName=".*\.top$|.*\.club$|.*\.xyz$|.*\.ru$|[0-9]+.*\.\w$" | stats values(ComputerName) count by DomainName| where count &lt;4 | sort – count
	<style>
	#reportrow {
	position:relative;
	overflow-wrap:anywhere;
	border-bottom:solid 1px;
	}
	</style>

	<div class="panel panel-info" ng-if="success">
	<div class="panel-heading">