PTN-009 email chains
Characterise a phishing sender
Email | where recipient == "sonia_gose@valdoriantimes.news" | where subject contains "apply"
banked from A Scandal in Valdoria T1566.002
// reference · query patterns
KQL Pattern Bank
the boring 70%, documented
Auto-extracted from every KC7 lab writeup — each tagged @bank query gets promoted here with its source lab attached. Write the investigation once; the reference builds itself.
16
patterns banked
5
categories
9
ATT&CK techniques
2
source labs
auto-generated from vault · last lab 2026-08-10
KC7 Foundation · Pathway Complete
Security Analyst I
Indicators of compromise, investigative hypotheses, structured KQL analysis — every lab below is a step on this pathway
verify badge ↗
// investigations
✓ complete Easy
Jojo's Hospital: A Ransomware Investigation
Ransomware locks up files across Jojo's Hospital and drops a ransom note on the Senior IT Administrator's own machine. Trace the encryption back through a rogue download, a month-old successful login, and a promo-email lure on a completely different host.
7 patterns banked proof of completion →
✓ complete Easy
A Scandal in Valdoria
The Valdorian Times prints an unapproved, defamatory OpEd days before a mayoral election. Chase the phishing lure through two victims, a plink tunnel, and a forged document handoff to find out who really sent it.
9 patterns banked proof of completion →
in progress
Untitled
0 patterns banked
// reference · extracted patterns
filter
PTN-010 email chains
Pivot recipient to click
OutboundNetworkEvents | where src_ip == "10.10.0.3" | where url contains "promotionrecruit"
banked from A Scandal in Valdoria T1566.002
PTN-022 process
Trace a downloaded file to disk
FileCreationEvents | where hostname == "UL0M-MACHINE" | where filename == "Valdorian_Times_Editorial_Offer_Letter.docx"
banked from A Scandal in Valdoria T1204.002
PTN-006 timeline / pivot
Window around an indicator
FileCreationEvents | where hostname == "UL0M-MACHINE" | where timestamp >= datetime(2024-01-05 10:24:04+00:00) and timestamp < datetime(2024-01-05 10:34:04+00:00)
banked from A Scandal in Valdoria — technique
PTN-023 process
Find processes spawned by a malicious script
ProcessEvents | where hostname == "UL0M-MACHINE" | where process_commandline contains "hacktivist_manifesto.ps1"
banked from A Scandal in Valdoria T1059.001
PTN-024 c2 / beaconing
Confirm a tunnel tool's connection details
ProcessEvents | where hostname == "UL0M-MACHINE" | where process_commandline contains "plink"
banked from A Scandal in Valdoria T1572
PTN-025 process
Enumerate discovery commands in an attack window
ProcessEvents | where hostname == "UL0M-MACHINE" | where parent_process_name == "cmd.exe" | where timestamp >= datetime(2024-01-06) and timestamp <= datetime(2024-01-07)
banked from A Scandal in Valdoria T1033
PTN-026 process
Search network events by filename substring
ProcessEvents | where hostname == "A37A-DESKTOP" | where process_name == "cmd.exe"
banked from A Scandal in Valdoria — technique
PTN-027 exfiltration
Detect archive-then-upload exfil via process commands
ProcessEvents | where hostname == "A37A-DESKTOP" | where process_name == "cmd.exe"
banked from A Scandal in Valdoria T1560.001
PTN-028 process
Scope ransomware impact by encrypted-file count
FileCreationEvents | where filename endswith ".encrypted" | count
banked from Jojo's Hospital: A Ransomware Investigation T1486
PTN-029 process
Count distinct hosts affected by an indicator
FileCreationEvents | where filename endswith ".encrypted" | distinct hostname | count
banked from Jojo's Hospital: A Ransomware Investigation T1486
PTN-030 process
Locate the source host of a named indicator file
FileCreationEvents | where filename == "We_Have_Your_Data_Pay_Up.txt"
banked from Jojo's Hospital: A Ransomware Investigation — technique
PTN-031 process
Review process activity on a host during an incident window
ProcessEvents | where hostname == "AMFB-MACHINE" | where timestamp between (datetime(2024-06-17) .. datetime(2024-06-18)) | sort by timestamp desc
banked from Jojo's Hospital: A Ransomware Investigation — technique
PTN-032 process
Confirm a suspicious binary's download source via network logs
OutboundNetworkEvents | where url has "patient_data_exporter.exe"
banked from Jojo's Hospital: A Ransomware Investigation T1105
PTN-033 c2 / beaconing
Pivot a malicious domain to its hosting infrastructure
PassiveDns | where domain == "secure-health-access.com" | distinct ip
banked from Jojo's Hospital: A Ransomware Investigation — technique
PTN-034 c2 / beaconing
Confirm attacker login using stolen credentials
AuthenticationEvents
| where src_ip in ("203.0.113.1", "203.0.113.2") banked from Jojo's Hospital: A Ransomware Investigation T1078