DFIR Windows Security Event Overview.xml

<!--
  Created by: Jacob Wilson (original)
  Date: January 2026
  Purpose: Expanded DFIR Windows Security Event Overview with broad IOC coverage
  Contact: dfirvault@gmail.com, dfirvault.com, https://shorturl.at/QMT5M
--><form theme="dark" version="1">
  <label>DFIR Windows Security + IOC Hunting Dashboard</label>
  <fieldset submitButton="true" autoRun="true">
    <input type="time" token="field1" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="dropdown" token="index" searchWhenChanged="true">
      <label>Index</label>
      <search>
        <query>index=* | stats count by index</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="">None</choice>
      <prefix>index="</prefix>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <suffix>"</suffix>
    </input>
    <input type="multiselect" token="accountname" searchWhenChanged="true">
      <label>Account_Name</label>
      <search>
        <query>$index$ | eval Account_Name=lower(Account_Name) |search $customfield$|stats count by Account_Name</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">All</choice>
      <valuePrefix>Account_Name="</valuePrefix>
      <valueSuffix>*"</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>Account_Name</fieldForLabel>
      <fieldForValue>Account_Name</fieldForValue>
    </input>
    <input type="multiselect" token="computername" searchWhenChanged="true">
      <label>ComputerName</label>
      <search>
        <query>$index$ | eval ComputerName=lower(ComputerName) |search $customfield$|stats count by ComputerName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">All</choice>
      <valuePrefix>ComputerName="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>ComputerName</fieldForLabel>
      <fieldForValue>ComputerName</fieldForValue>
    </input>
    <input type="text" token="customfield">
      <label>Advanced query</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="span">
      <label>Span</label>
      <default>30m</default>
    </input>
    <input type="dropdown" token="field5" searchWhenChanged="true">
      <label>GMT Offset</label>
      <initialValue>0</initialValue>
      <default>0</default>
      <choice value="-12">-12:00</choice>
      <choice value="-11.5">-11:30</choice>
      <choice value="-11">-11:00</choice>
      <choice value="-10.5">-10:30</choice>
      <choice value="-10">-10:00</choice>
      <choice value="-9.5">-09:30</choice>
      <choice value="-9">-09:00</choice>
      <choice value="-8.5">-08:30</choice>
      <choice value="-8">-08:00</choice>
      <choice value="-7.5">-07:30</choice>
      <choice value="-7">-07:00</choice>
      <choice value="-6.5">-06:30</choice>
      <choice value="-6">-06:00</choice>
      <choice value="-5.5">-05:30</choice>
      <choice value="-5">-05:00</choice>
      <choice value="-4.5">-04:30</choice>
      <choice value="-4">-04:00</choice>
      <choice value="-3.5">-03:30</choice>
      <choice value="-3">-03:00</choice>
      <choice value="-2.5">-02:30</choice>
      <choice value="-2">-02:00</choice>
      <choice value="-1.5">-01:30</choice>
      <choice value="-1">-01:00</choice>
      <choice value="-0.5">-00:30</choice>
      <choice value="0">00:00</choice>
      <choice value="0.5">+00:30</choice>
      <choice value="1">+01:00</choice>
      <choice value="1.5">+01:30</choice>
      <choice value="2">+02:00</choice>
      <choice value="2.5">+02:30</choice>
      <choice value="3">+03:00</choice>
      <choice value="3.5">+03:30</choice>
      <choice value="4">+04:00</choice>
      <choice value="4.5">+04:30</choice>
      <choice value="5">+05:00</choice>
      <choice value="5.5">+05:30</choice>
      <choice value="6">+06:00</choice>
      <choice value="6.5">+06:30</choice>
      <choice value="7">+07:00</choice>
      <choice value="7.5">+07:30</choice>
      <choice value="8">+08:00</choice>
      <choice value="8.5">+08:30</choice>
      <choice value="9">+09:00</choice>
      <choice value="9.5">+09:30</choice>
      <choice value="10">+10:00</choice>
      <choice value="10.5">+10:30</choice>
      <choice value="11">+11:00</choice>
      <choice value="11.5">+11:30</choice>
      <choice value="12">+12:00</choice>
    </input>
    <input type="dropdown" token="ioc_category" searchWhenChanged="true">
      <label>IOC Category (optional filter)</label>
      <choice value="*">All Categories</choice>
      <choice value="network">Network (IP/Domain/URL/Onion)</choice>
      <choice value="crypto">Cryptocurrency Addresses</choice>
      <choice value="hash">Hashes (MD5/SHA1/SHA256)</choice>
      <choice value="malware_tool">Malware Tools (Mimikatz, Cobalt, Empire...)</choice>
      <choice value="cred_access">Credential Access (sekurlsa, lsass, procdump...)</choice>
      <choice value="c2_shell">C2 and Shells (beacon, reverse_shell, meterpreter...)</choice>
      <choice value="lolbas">LOLBAS and Suspicious Commands</choice>
      <choice value="persistence">Persistence (schtasks, registry_run...)</choice>
      <choice value="lateral">Lateral Movement (psexec, wmic, winrm...)</choice>
      <choice value="defense_evasion">Defense Evasion (amsi bypass, wevtutil...)</choice>
      <choice value="exfiltration">Exfiltration (rclone, scp...)</choice>
      <choice value="ransomware">Ransomware (vssadmin delete, .lockbit...)</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Common Event Codes - 10,000 foot view</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype="wineventlog:security" Account_Name!="DWM-*" Account_Name!="UMFD-*" Account_Name!=SYSTEM Account_Name!="LOCAL SERVICE" Account_Name!="NETWORK SERVICE" Account_Name!="*$$" Account_Name!="ANONYMOUS LOGON" Account_Name!="IUSR"
| eval Trigger=case(EventCode=516, "Audit Logs Modified",EventCode=517, "Audit Logs Modified",EventCode=612, "Audit Logs Modified",EventCode=623, "Audit Logs Modified",EventCode=806, "Audit Logs Modified",EventCode=807, "Audit Logs Modified",EventCode=1101, "Audit Logs Modified",EventCode=1102, "Audit Logs Modified",EventCode=4612, "Audit Logs Modified",EventCode=4621, "Audit Logs Modified",EventCode=4694, "Audit Logs Modified",EventCode=4695, "Audit Logs Modified",EventCode=4715, "Audit Logs Modified",EventCode=4719, "Audit Logs Modified",EventCode=4817, "Audit Logs Modified",EventCode=4885, "Audit Logs Modified",EventCode=4902, "Audit Logs Modified",EventCode=4906, "Audit Logs Modified",EventCode=4907, "Audit Logs Modified",EventCode=4912, "Audit Logs Modified", EventCode=642, "Account Modification",EventCode=646, "Account Modification",EventCode=685, "Account Modification",EventCode=4738, "Account Modification",EventCode=4742, "Account Modification",EventCode=4781, "Account Modification", EventCode=1102, "Audit Logs Cleared/Deleted",EventCode=517, "Audit Logs Cleared/Deleted", EventCode=628, "Passwords Changed",EventCode=627, "Passwords Changed",EventCode=4723, "Passwords Changed",EventCode=4724, "Passwords Changed", EventCode=528, "Successful Logons",EventCode=540, "Successful Logons",EventCode=4624, "Successful Logons", EventCode=4625, "Failed Logons",EventCode=529, "Failed Logons",EventCode=530, "Failed Logons",EventCode=531, "Failed Logons",EventCode=532, "Failed Logons",EventCode=533, "Failed Logons",EventCode=534, "Failed Logons",EventCode=535, "Failed Logons",EventCode=536, "Failed Logons",EventCode=537, "Failed Logons",EventCode=539, "Failed Logons", EventCode=576, "Escalation of Privileges",EventCode=4672, "Escalation of Privileges",EventCode=577, "Escalation of Privileges",EventCode=4673, "Escalation of Privileges",EventCode=578, "Escalation of Privileges",EventCode=4674, "Escalation of Privileges") 
| stats earliest(_time) as Initial_Occurrence latest(_time) as Latest_Occurrence values(Account_Name) as Account_Names values(host) as Hosts count sparkline by Trigger
| sort - count
| convert ctime(Initial_Occurrence) ctime(Latest_Occurrence)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="Trigger">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Count of Account_Name</title>
      <chart>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ |search $accountname$ $computername$ $customfield$|stats count by Account_Name</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>Count of ComputerName</title>
      <chart>
        <search>
          <query>$index$  |search $accountname$ $computername$ $customfield$|stats count by ComputerName</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Failed Logon Attempts</title>
      <table>
        <search>
          <query>$index$ sourcetype="WinEventLog:security" EventCode=4625 $accountname$ $customfield$ $computername$
| eval hammer=_time
| eval Workstation_Name=lower(Workstation_Name)
| eval host=lower(host)
| bucket span=5m hammer 
| stats count sparkline by Account_Name, host, hammer, Workstation_Name
| rename hammer as "5 minute blocks" host as "Target Host" Workstation_Name as "sourcetype Host"
| convert ctime("5 minute blocks")</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="Account_Name">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Target Host">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="sourcetype Host">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <title>Timechart of Failed Attempts to Logon</title>
      <chart>
        <search>
          <query>$index$ sourcetype="WinEventLog:security" EventCode=4625 $accountname$ $computername$ $customfield$
| timechart span=1h count by host</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Successful Logons</title>
      <table>
        <search>
          <query>$index$ sourcetype="WinEventLog:security" EventCode=4624 (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10 OR Logon_Type=11 OR Logon_Type=3) Account_Name!="DWM-*" Account_Name!="UMFD-*" $accountname$ $computername$ $customfield$
| eval Workstation_Name=lower(Workstation_Name)
| eval host=lower(host)
| eval hammer=_time 
| bucket span=1d@d hammer 
| stats values(Logon_Type) as "Logon Type" count sparkline by Account_Name host, hammer, Workstation_Name
| rename hammer as "Start of Day" host as "Target Host" Workstation_Name as "sourcetype Host"
| convert ctime("Start of Day")
| sort - "Start of Day"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Target Host">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="sourcetype Host">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Account_Name">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <title>Timechart of Successful Logons</title>
      <chart>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype="WinEventLog:security" EventCode=4624 (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10 OR Logon_Type=11 OR Logon_Type=3) Account_Name!="DWM-*" Account_Name!="UMFD-*" $accountname$ $computername$ $customfield$
| timechart span=1h count by host</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Failed Login Events</title>
      <input type="multiselect" token="multi_select1" searchWhenChanged="true">
        <label>Field Section:</label>
        <choice value="_time">_time</choice>
        <choice value="host">host</choice>
        <choice value="Account_Name">Account_Name</choice>
        <choice value="src_ip">src_ip</choice>
        <choice value="EventCode">EventCode</choice>
        <choice value="Logon_Type">Logon_Type</choice>
        <choice value="Logon_Process">Logon_Process</choice>
        <delimiter>, </delimiter>
        <default>host,Logon_Type,EventCode,src_ip,Account_Name</default>
      </input>
      <table>
        <search>
          <query>$index$ sourcetype="WinEventLog:Security" $accountname$ $computername$ $customfield$ TaskCategory=Logon Keywords="Audit Failure" | fillnull value=* src_ip EventCode | stats count by $multi_select1$ 
| sort -count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Successful Login Events</title>
      <input type="multiselect" token="multi_select2" searchWhenChanged="true">
        <label>Field Section:</label>
        <choice value="_time">_time</choice>
        <choice value="host">host</choice>
        <choice value="Account_Name">Account_Name</choice>
        <choice value="src_ip">src_ip</choice>
        <choice value="EventCode">EventCode</choice>
        <choice value="Logon_Type">Logon_Type</choice>
        <choice value="Logon_Process">Logon_Process</choice>
        <choice value="Process_Name">Process_Name</choice>
        <delimiter>, </delimiter>
        <default>host,Account_Name,src_ip,Logon_Type,EventCode</default>
      </input>
      <table>
        <search>
          <query>$index$ sourcetype="WinEventLog:Security" $customfield$ TaskCategory=Logon Keywords="Audit Success" Account_Name!="DWM-*" Account_Name!="UMFD-*" Account_Name!=SYSTEM Account_Name!="LOCAL SERVICE" Account_Name!="NETWORK SERVICE" Account_Name!="*$$" Account_Name!="ANONYMOUS LOGON" Account_Name!="IUSR" $accountname$  $computername$ $customfield$| fillnull value=* src_ip EventCode Logon_Type, Logon_Process, Process_Name | stats count by $multi_select2$ 
| sort -count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Powershell activity</title>
      <table>
        <search>
          <query>$index$ TaskCategory="Execute a Remote Command" |search Path !=""| search $computername$ $customfield$|eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")|  table time_utc, time_gmt_$field5$, Path, Value, parameters | sort -_time DESC</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Processes</title>
      <table>
        <search>
          <query>$index$ Process_Name="*" $accountname$  |search $accountname$ $computername$ $customfield$| eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")| table time_utc, time_gmt_$field5$, Account_Name, Process_Name, ComputerName, EventCode</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>RDP Success Events</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$| search TaskCategory=Logon  Keywords="Audit Success" | eval Destination_Host=host    |eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")| table  time_utc, time_gmt_$field5$, EventCode, EventType, Destination_Host, Account_Domain, Account_Name, Source_Network_Address, Workstation_Name</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>RDP Failure Events</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$| search $accountname$ TaskCategory=Logon  Keywords="Audit Failure" | eval Destination_Host=host    | eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")|table  time_utc, time_gmt_$field5$, EventCode, EventType, Destination_Host, Account_Domain, Account_Name, Source_Network_Address, Workstation_Name</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Newly Created Accounts</title>
      <event>
        <search>
          <query>$index$ |search EventCode=4720 $customfield$</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
    <panel>
      <event>
        <title>Evidence of ZeroLogon Activity</title>
        <search>
          <query>$index$  $computername$ Account_Name="ANONYMOUS LOGON" EventCode=4742 $customfield$  |eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")|  table time_utc, time_gmt_$field5$, host, Account_Domain,SAM_Account_Name</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Accounts that were created and then deleted in under an hour</title>
        <search>
          <query>$index$ sourcetype="WinEventLog:Security" (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) $customfield$ | eval status=case(EventCode=630, "Account Deletion", EventCode=4726, "Account Deletion", EventCode=624, "Account Creation", EventCode=4720, "Account Creation") |transaction Account_Name startswith=status="Account Creation" endswith=status="Account Deletion" maxevents=2  | where duration &lt; 3600 | table host, src_Account_Name, Account_Name, Account_Domain, _time</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Accounts that were created</title>
        <search>
          <query>$index$ sourcetype="WinEventLog:Security" (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) $customfield$ |eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")|  table host, time_utc, time_gmt_$field5$,src_Account_Name, Account_Name, Account_Domain, EventCode</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Accounts added/removed to Domain Admins and other sensitive groups.</title>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype=WinEventLog:Security (EventCode=4728 OR EventCode=4729) (Group_Name="*Domain Admins*" OR Group_Name="*OtherGroup*")
|eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")| rename src_Account_Name AS "Actioned By", name as "Action Taken"
| table host "Actioned By" Account_Name "Action Taken" Group_Name Account_Domain  time_utc, time_gmt_$field5$,
| sort - time_utc</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Accounts that had their password's changed not by themselves</title>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype="WinEventLog:Security" (EventCode IN ("628","627","4723","4724"))
| eval time_utc=_time+(3600*0)|eval time_utc=strftime(time_utc,"%Y-%m-%d %H:%M:%S")|
eval time_gmt_$field5$=_time+(3600*$field5$)| eval time_gmt_$field5$=strftime(time_gmt_$field5$,"%Y-%m-%d %H:%M:%S")| eval s_Account_Namename = mvindex(Account_Name, 0), t_Account_Namename = mvindex(Account_Name, 1), s_domain = mvindex(Account_Domain, 0), t_domain = mvindex(Account_Domain, 1)
| eval s_output = s_Account_Namename."@".s_domain, t_output = t_Account_Namename."@".t_domain
| where s_Account_Namename!=t_Account_Namename
| table host, s_output, t_output, time_utc, time_gmt_$field5$</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Windows Authentication events</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype="wineventlog:security" action=success (EventCode=4624 OR EventCode=4634 ) Account_Name!="anonymous logon" Account_Name!="DWM-*" Account_Name!="UMFD-*" Account_Name!=SYSTEM Account_Name!=*$ (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10)
| convert timeformat="%a %B %d %Y" ctime(_time) AS Date 
| streamstats earliest(_time) AS login, latest(_time) AS logout by Date, host, Account_Name
| eval session_duration=logout-login
| where session_duration &gt; 5
| eval h=floor(session_duration/3600) 
| eval m=floor((session_duration-(h*3600))/60) 
| eval SessionDuration=h."h ".m."m " 
| convert timeformat=" %m/%d/%y - %I:%M %P" ctime(login) AS login 
| convert timeformat=" %m/%d/%y - %I:%M %P" ctime(logout) AS logout 
| stats count AS auth_event_count, earliest(login) as login, max(SessionDuration) AS sesion_duration, latest(logout) as logout, values(Logon_Type) AS logon_types by Date, host, Account_Name
| sort + login</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="host">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Account_Name">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <title>Privileged Account Events</title>
      <input type="multiselect" token="multi_select3" searchWhenChanged="true">
        <label>Field Section:</label>
        <choice value="_time">_time</choice>
        <choice value="host">host</choice>
        <choice value="Account_Name">Account_Name</choice>
        <choice value="signature">signature</choice>
        <choice value="vendor_privilege">vendor_privilege</choice>
        <choice value="member_id">member_id</choice>
        <choice value="Keywords">Keywords</choice>
        <default>Account_Name</default>
        <delimiter>, </delimiter>
      </input>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype="WinEventLog:Security" $customfield$ TaskCategory="Special Logon" Account_Name!="DWM-*" Account_Name!="UMFD-*" Account_Name!=SYSTEM Account_Name!="LOCAL SERVICE" Account_Name!="NETWORK SERVICE" Account_Name!="*$" Account_Name!="ANONYMOUS LOGON" Account_Name!="IUSR" | stats count by $multi_select3$ | sort -count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Potential IOC Matches - Overview (High Level)</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:Security", "WinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:PowerShell*") $accountname$ $computername$ $customfield$
| rex field=_raw "(?i)(?&lt;ipv4_address&gt;\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b)|(?&lt;domain&gt;(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,})|(?&lt;md5&gt;[a-f0-9]{32})|(?&lt;sha256&gt;[a-f0-9]{64})|(?&lt;mimikatz&gt;mimikatz)|(?&lt;cobalt&gt;cobalt\.strike)|(?&lt;beacon&gt;beacon)|(?&lt;lsass&gt;lsass\.exe)|(?&lt;sekurlsa&gt;sekurlsa::logonpasswords)|(?&lt;procdump&gt;procdump)|(?&lt;rundll32&gt;rundll32)|(?&lt;bitsadmin&gt;bitsadmin.*transfer)|(?&lt;schtasks&gt;schtasks.*create)|(?&lt;psexec&gt;psexec)"
| eval ioc_type=coalesce(ipv4_address, domain, md5, sha256, mimikatz, cobalt, beacon, lsass, sekurlsa, procdump, rundll32, bitsadmin, schtasks, psexec, "none")
| where ioc_type!="none"
| stats count sparkline by ioc_type, host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">15</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Malware Tools and C2 Keywords (Mimikatz, Cobalt, Empire, Beacon...)</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype IN ("WinEventLog:*", "*PowerShell*") $customfield$
| search "mimikatz" OR "cobalt.strike" OR "beacon" OR "empire" OR "metasploit" OR "nishang" OR "covenant" OR "poshc2" OR "merlin" OR "meterpreter" OR "rubeus" OR "sekurlsa" OR "dcsync"
| eval tool=case(match(_raw, "(?i)mimikatz"),"Mimikatz", match(_raw, "(?i)cobalt"),"Cobalt Strike", match(_raw, "(?i)beacon"),"Beacon", 1=1, "Other Suspicious")
| stats count sparkline values(Account_Name) as Users values(host) as Hosts by tool
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Potential Beaconing Patterns</title>
      <table>
        <search>
          <query>$index$ sourcetype="*network*" $accountname$ $computername$ $customfield$
| bucket _time span=5m
| stats count by _time, dest_ip, host
| eventstats stdev(count) as dev avg(count) as avg by dest_ip
| where dev &lt; 2 AND avg &gt; 5
| stats count sparkline by dest_ip, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Credential Dumping Artifacts (LSASS, Procdump, NTDS.dit...)</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:Security", "*Sysmon*") $accountname$ $computername$ $customfield$
| search "lsass.exe" OR "procdump" OR "pwdump" OR "ntds.dit" OR "sekurlsa" OR "dcsync" OR "shadowcopy" OR "vssadmin.*delete"
| eval technique=case(match(_raw,"lsass"),"LSASS Access/Dump", match(_raw,"procdump|pwdump"),"ProcDump/PwDump", match(_raw,"ntds.dit|dcsync"),"NTDS/DCSync", match(_raw,"shadowcopy|vssadmin"),"VSS/Shadow Copy Abuse", 1=1, "Other")
| stats count sparkline by technique, host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">20</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>LOLBAS and Suspicious Command Execution</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:*", "*Sysmon*") $accountname$ $computername$ $customfield$
| search "bitsadmin.*transfer" OR "certutil.*-decode" OR "rundll32" OR "regsvr32" OR "mshta" OR "cmstp" OR "wmic.*process.call" OR "schtasks.*create"
| eval lolbas_type=case(match(_raw,"bitsadmin"),"BITSAdmin Download", match(_raw,"certutil.*decode"),"Certutil Decode", match(_raw,"rundll32|regsvr32|mshta"),"LOLBAS Proxy Execution", 1=1, "Other")
| stats count sparkline by lolbas_type, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">20</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Reverse Shells and Web Shells</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:*", "*Sysmon*", "*PowerShell*") $accountname$ $computername$ $customfield$
| search "reverse_shell" OR "bind_shell" OR "nc.*-e" OR "netcat.*-e" OR "bash.*-i" OR "python.*socket" OR "php.*exec.*socket" OR "passthru\(" OR "shell_exec\(" OR "system\(" OR "cmd\.asp" OR "weevely" OR "eval.*base64_decode" OR "jsp_shell" OR "asp_shell"
| eval shell_type=case(match(_raw,"nc|netcat|bash|python|php"),"Reverse/Bind Shell", match(_raw,"passthru|shell_exec|system|cmd.asp|weevely|eval|jsp|asp"),"Web Shell", 1=1, "Other")
| stats count sparkline values(Account_Name) as Users values(host) as Hosts by shell_type
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <title>Persistence Mechanisms</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:Security", "*Sysmon*") $accountname$ $computername$ $customfield$
| search "schtasks.*create" OR "reg.add.*HKCU.*Run" OR "wmi_persistence" OR "Image.File.Execution.Options" OR "SilentProcessExit" OR "AppData.*Startup" OR "cronjob" OR "LaunchDaemons" OR "LaunchAgents"
| eval persistence_type=case(match(_raw,"schtasks"),"Scheduled Task", match(_raw,"reg.add.*Run"),"Registry Run Key", match(_raw,"Startup|LaunchDaemons|LaunchAgents"),"Startup Folder/Agents", 1=1, "Other")
| stats count sparkline by persistence_type, host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Lateral Movement Indicators</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:*", "*Sysmon*") $accountname$ $computername$ $customfield$
| search "psexec" OR "wmic.*/node:" OR "winrm.*invoke" OR "wmiexec" OR "dcomexec" OR "smbexec" OR "crackmapexec" OR "impacket" OR "rdp_enable" OR "smbclient" OR "winexe" OR "at.exe" OR "sc.*create"
| eval lateral_type=case(match(_raw,"psexec|winexe"),"PsExec/Winexe", match(_raw,"wmic|wmiexec"),"WMIC Exec", match(_raw,"winrm|evil-winrm"),"WinRM", match(_raw,"smb|rdp"),"SMB/RDP", 1=1, "Other")
| stats count sparkline values(host) as Hosts by lateral_type, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <title>Defense Evasion Techniques</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:*", "*Sysmon*", "*PowerShell*") $accountname$ $computername$ $customfield$
| search "amsi.*bypass" OR "uac.*bypass" OR "process.*hollow" OR "etwbypass" OR "Set-MpPreference.*Disable" OR "wevtutil.cl" OR "fsutil.usn.deletejournal" OR "timestomp"
| eval evasion_type=case(match(_raw,"amsi|uac|etw"),"Bypass (AMSI/UAC/ETW)", match(_raw,"process.*hollow"),"Process Hollowing", match(_raw,"wevtutil|fsutil|timestomp"),"Log Tampering/Timestomp", 1=1, "Other")
| stats count sparkline by evasion_type, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Exfiltration Indicators</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:*", "*Sysmon*") $accountname$ $computername$ $customfield$
| search "rclone" OR "dnscat2" OR "curl.*-T" OR "pastebin\.com" OR "anonfiles\.com" OR "mega\.nz" OR "7z.a.-p" OR "scp.*@" OR "sftp.*@" OR "ftp.*put" OR "rsync.*@" OR "dropboxusercontent.com" OR "onedrive.live.com"
| eval exfil_type=case(match(_raw,"rclone|dnscat2"),"Rclone/DNSCat", match(_raw,"curl|scp|sftp|ftp|rsync"),"Upload Commands", match(_raw,"pastebin|anonfiles|mega|dropbox|onedrive"),"Cloud Storage Sites", 1=1, "Other")
| stats count sparkline by exfil_type, host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <title>Ransomware Indicators</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:*", "*Sysmon*") $accountname$ $computername$ $customfield$
| search "vssadmin.*delete" OR "wbadmin.delete" OR "bcedit.*recoveryenabled.No" OR "README-TO-DECRYPT.txt" OR "DECRYPT_INSTRUCTIONS.txt" OR "\.lockbit" OR "\.alpha" OR "\.play" OR "\.clop" OR "conti" OR "ryuk" OR "net.stop.*(sql|veeam)"
| eval ransom_type=case(match(_raw,"vssadmin|wbadmin|bcedit"),"Shadow Copy/Backup Delete", match(_raw,"README|DECRYPT"),"Ransom Notes", match(_raw,"\.lockbit|\.alpha|\.play|\.clop"),"File Extensions", match(_raw,"conti|ryuk"),"Specific Families", 1=1, "Other")
| stats count sparkline by ransom_type, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">15</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Living-off-the-Land Binaries (Expanded)</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$ sourcetype IN ("WinEventLog:*","*Sysmon*") 
| search "regsvr32" OR "mshta" OR "cmstp" OR "installutil" OR "msbuild" OR "odbcconf" OR "hh.exe" OR "forfiles" OR "pubprn.vbs" OR "syncappvpublishingserver" OR "regasm" OR "regsvcs" OR "xwizard" OR "makecab" OR "expand" OR "extrac32"
| eval lolbin=case(
match(_raw,"regsvr32"),"regsvr32",
match(_raw,"mshta"),"mshta",
match(_raw,"cmstp"),"cmstp",
match(_raw,"installutil"),"installutil",
match(_raw,"msbuild"),"msbuild",
match(_raw,"odbcconf"),"odbcconf",
match(_raw,"hh.exe"),"hh.exe",
match(_raw,"forfiles"),"forfiles",
match(_raw,"pubprn"),"pubprn.vbs",
match(_raw,"syncappv"),"syncappv",
match(_raw,"regasm|regsvcs"),"regasm/regsvcs",
match(_raw,"xwizard"),"xwizard",
match(_raw,"makecab|expand|extrac32"),"cabinet abuse",
1=1,"other")
| stats count sparkline by lolbin, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>PowerShell Abuse (Obfuscation + Living Off PS)</title>
      <table>
        <search>
          <query>$index$ sourcetype="*PowerShell*" $accountname$ $computername$ $customfield$
| search "-enc" OR "frombase64string" OR "iex" OR "invoke-expression" OR "downloadstring" OR "new-object net.webclient" OR "add-mppreference" OR "disablebehaviormonitoring" OR "amsiutils" OR "reflection.assembly"
| eval ps_abuse=case(
match(_raw,"-enc|frombase64string"),"Encoded Payload",
match(_raw,"iex|invoke-expression"),"Invoke Expression",
match(_raw,"downloadstring|webclient"),"Download Cradle",
match(_raw,"amsi"),"AMSI Tampering",
match(_raw,"mppreference"),"Defender Tampering",
1=1,"Other")
| stats count sparkline by ps_abuse, host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Privilege Escalation Indicators</title>
      <table>
        <search>
          <query>$index$ sourcetype IN ("WinEventLog:*","*Sysmon*") $accountname$ $computername$ $customfield$
| search "token::elevate" OR "getsystem" OR "uac.bypass" OR "fodhelper" OR "sdclt" OR "eventvwr" OR "bypassuac" OR "juicypotato" OR "roguepotato" OR "printnightmare" OR "zerologon" OR "serioussam"
| eval privesc=case(
match(_raw,"juicypotato|roguepotato"),"Potato Exploit",
match(_raw,"fodhelper|sdclt|eventvwr"),"UAC Bypass",
match(_raw,"printnightmare"),"PrintNightmare",
match(_raw,"zerologon"),"ZeroLogon",
match(_raw,"serioussam"),"SeriousSAM",
1=1,"Other")
| stats count sparkline by privesc, host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
    <panel>
      <title>Remote Access Tools (RATs)</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "anydesk" OR "teamviewer" OR "screenconnect" OR "connectwise" OR "splashtop" OR "dwservice" OR "remcos" OR "njrat" OR "darkcomet" OR "asyncrat" OR "quasar"
| eval rat=case(
match(_raw,"anydesk"),"AnyDesk",
match(_raw,"teamviewer"),"TeamViewer",
match(_raw,"screenconnect|connectwise"),"ScreenConnect",
match(_raw,"splashtop"),"Splashtop",
match(_raw,"remcos"),"Remcos",
match(_raw,"njrat"),"NjRAT",
match(_raw,"asyncrat"),"AsyncRAT",
match(_raw,"quasar"),"Quasar",
1=1,"Other")
| stats count sparkline by rat, host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Cloud / Identity Abuse</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "Set-MsolUserPassword" OR "Add-AzureADDirectoryRoleMember" OR "Add-MsolRoleMember" OR "Consent to new app" OR "Graph API" OR "OAuth" OR "RefreshToken" OR "Global Administrator"
| eval cloud_abuse=case(
match(_raw,"password"),"Password Reset",
match(_raw,"RoleMember|Administrator"),"Privileged Role Abuse",
match(_raw,"OAuth|Consent"),"OAuth Abuse",
match(_raw,"RefreshToken"),"Token Theft",
1=1,"Other")
| stats count sparkline by cloud_abuse, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
    <panel>
      <title>Suspicious File Extensions</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| rex field=_raw "(?&lt;ext&gt;\.(?:exe|dll|ps1|vbs|js|hta|scr|pif|iso|img|lnk|one|jar|bat|cmd|msi|cpl))"
| stats count sparkline by ext, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Suspicious Parent → Child Chains</title>
      <table>
        <search>
          <query>$index$ sourcetype="*Sysmon*" $accountname$ $computername$ $customfield$
| search ParentImage="*winword.exe" OR ParentImage="*excel.exe" OR ParentImage="*outlook.exe" OR ParentImage="*powershell.exe" OR ParentImage="*wscript.exe"
| eval chain=ParentImage." → ".Image
| stats count sparkline by chain, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
    <panel>
      <title>Suspicious Service Creation</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "sc.exe create" OR "New-Service" OR "binPath="
| stats count sparkline by host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>WMI Persistence and Execution</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "__EventFilter" OR "CommandLineEventConsumer" OR "ActiveScriptEventConsumer" OR "wmic /node"
| stats count sparkline by host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
    <panel>
      <title>DNS Tunneling Indicators</title>
      <table>
        <search>
          <query>$index$ sourcetype="*dns*" $accountname$ $computername$ $customfield$
| eval qlen=len(query)
| where qlen &gt; 50
| stats count sparkline avg(qlen) as avg_len by query, host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Security Control Tampering</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "netsh advfirewall set allprofiles state off" OR "Set-MpPreference -Disable" OR "DisableRealtimeMonitoring" OR "Add-MpPreference -Exclusion"
| stats count sparkline by host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
    <panel>
      <title>Boot and Driver Persistence</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "bcdedit" OR "bootkit" OR "driverload" OR "fltmc load" OR "sc.exe create type= kernel"
| stats count sparkline by host
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>TOR / Proxy / VPN Indicators</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "tor.exe" OR "obfsproxy" OR "proxychains" OR "openvpn" OR "wireguard" OR "tailscale" OR "zerotier"
| stats count sparkline by host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
    <panel>
      <title>Archive / Staging Activity</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "7z a" OR "rar a" OR "tar -czf" OR "Compress-Archive" OR "makecab"
| stats count sparkline by host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Time and Log Manipulation</title>
      <table>
        <search>
          <query>$index$ $accountname$ $computername$ $customfield$
| search "w32tm /config" OR "Set-Date" OR "Clear-EventLog" OR "wevtutil cl"
| stats count sparkline by host, Account_Name
| sort - count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>