// reference · query patterns

KQL Pattern Bank
the boring 70%, documented

Auto-extracted from every KC7 lab writeup — each tagged @bank query gets promoted here with its source lab attached. Write the investigation once; the reference builds itself.

9
patterns banked
5
categories
6
ATT&CK techniques
1
source labs
auto-generated from vault · last lab 2026-07-12
// investigations
✓ complete Easy

A Scandal in Valdoria

The Valdorian Times prints an unapproved, defamatory OpEd days before a mayoral election. Chase the phishing lure through two victims, a plink tunnel, and a forged document handoff to find out who really sent it.

9 patterns banked proof of completion →
in progress Easy

Jojo's Hospital: A Ransomware Investigation

0 patterns banked
// reference · extracted patterns
filter
PTN-009 email chains

Characterise a phishing sender

Email
| where recipient == "sonia_gose@valdoriantimes.news"
| where subject contains "apply"
banked from A Scandal in Valdoria T1566.002
PTN-010 email chains

Pivot recipient to click

OutboundNetworkEvents
| where src_ip == "10.10.0.3"
| where url contains "promotionrecruit"
banked from A Scandal in Valdoria T1566.002
PTN-022 process

Trace a downloaded file to disk

FileCreationEvents
| where hostname == "UL0M-MACHINE"
| where filename == "Valdorian_Times_Editorial_Offer_Letter.docx"
banked from A Scandal in Valdoria T1204.002
PTN-006 timeline / pivot

Window around an indicator

FileCreationEvents
| where hostname == "UL0M-MACHINE"
| where timestamp >= datetime(2024-01-05 10:24:04+00:00) and timestamp < datetime(2024-01-05 10:34:04+00:00)
banked from A Scandal in Valdoria — technique
PTN-023 process

Find processes spawned by a malicious script

ProcessEvents
| where hostname == "UL0M-MACHINE"
| where process_commandline contains "hacktivist_manifesto.ps1"
banked from A Scandal in Valdoria T1059.001
PTN-024 c2 / beaconing

Confirm a tunnel tool's connection details

ProcessEvents
| where hostname == "UL0M-MACHINE"
| where process_commandline contains "plink"
banked from A Scandal in Valdoria T1572
PTN-025 process

Enumerate discovery commands in an attack window

ProcessEvents
| where hostname == "UL0M-MACHINE"
| where parent_process_name == "cmd.exe"
| where timestamp >= datetime(2024-01-06) and timestamp <= datetime(2024-01-07)
banked from A Scandal in Valdoria T1033
PTN-026 process

Search network events by filename substring

ProcessEvents
| where hostname == "A37A-DESKTOP"
| where process_name == "cmd.exe"
banked from A Scandal in Valdoria — technique
PTN-027 exfiltration

Detect archive-then-upload exfil via process commands

ProcessEvents
| where hostname == "A37A-DESKTOP"
| where process_name == "cmd.exe"
banked from A Scandal in Valdoria T1560.001