Investigation notebook

Start with a question.
Follow the evidence.

Practical, defensive hunt guides for your own monitored environment. Expand a guide, track the checklist, and adapt the starter query.

Choose by industry

Which hunts fit your business?

Retail: checkout, payment and staff access. Hospitality: reservation, guest-service and identity systems. Manufacturing: Windows engineering endpoints and OT access boundaries. SaaS: cloud identities, application access and supply-chain exposure. Confirm the required telemetry before choosing a hunt.

Retail coverage →Hospitality coverage →Manufacturing coverage →Indian SaaS startup coverage →

These are investigation playbooks, not reports of active compromises. Checklists stay in memory in this tab and reset when the page reloads. No telemetry is sent to SafeScale.

Suspicious PowerShellT1059.001 · Windows

Hypothesis

PowerShell is being used to download or execute unexpected code.

Telemetry to collect

Windows process creation (Security 4688 or Sysmon 1), PowerShell script block logging (4104), EDR process trees, and network events.

MITRE ATT&CK technique ↗

Investigation checklist

Scope the time window and confirm process/script logging coverage.Review parent processes, command lines, and the account context.Correlate downloads or outbound connections with the process tree.Compare with approved administration, software deployment, and security tooling.Document evidence and confidence; escalate corroborated suspicious activity.

0 of 5 steps complete

Starter query

KQL · Microsoft Defender XDR. Requires the relevant data connector and table permissions. Adapt the time range and fields to your environment. A match is a lead, not proof of compromise.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine contains "-enc"
    or ProcessCommandLine contains "FromBase64String"
    or ProcessCommandLine contains "DownloadString"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

Unusual successful sign-insT1078 · Identity

Hypothesis

A valid account is being used from an unexpected location, device, or session.

Telemetry to collect

Identity-provider sign-in and audit logs, MFA events, device context, and session activity.

MITRE ATT&CK technique ↗

Investigation checklist

Establish usual locations, devices, and access patterns for the account.Review unfamiliar successful sign-ins alongside preceding failures and MFA events.Check VPNs, travel, shared egress, and cloud-hosted tools as alternative explanations.Correlate subsequent mailbox, privilege, and application activity.Record findings and follow your response process for suspected account compromise.

0 of 5 steps complete

Starter query

KQL · Microsoft Sentinel / Entra sign-in logs. Requires the relevant data connector and table permissions. Adapt the time range and fields to your environment. A match is a lead, not proof of compromise.

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == "0"
| summarize SignIns=count(), IPs=make_set(IPAddress, 20),
    Apps=make_set(AppDisplayName, 20)
    by UserPrincipalName, Location
| order by SignIns desc

Unexpected scheduled tasksT1053.005 · Windows

Hypothesis

A scheduled task is being created or modified to persist or run unexpected code.

Telemetry to collect

Windows Security 4698/4702, Task Scheduler Operational logs, EDR process events, and task XML.

MITRE ATT&CK technique ↗

Investigation checklist

Check task creation and modification events across the chosen time window.Inspect task actions, triggers, run-as identity, and executable paths.Correlate creation with process ancestry, downloads, and execution events.Compare with expected software updates, management tools, and approved changes.Preserve task XML and related logs before any response action.

0 of 5 steps complete

Starter query

KQL · Microsoft Defender XDR. Requires the relevant data connector and table permissions. Adapt the time range and fields to your environment. A match is a lead, not proof of compromise.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine contains "/create"
    or ProcessCommandLine contains "/change"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

Unexpected OAuth application consentT1098 · Cloud identity

Hypothesis

An account or application is gaining unexpected access through new consent, role assignments, or credentials.

Telemetry to collect

Entra application audit logs, service-principal sign-ins, permission inventories, and approved change records. This guide does not analyse checkout scripts or industrial protocols.

MITRE ATT&CK: Account Manipulation ↗

Investigation checklist

Confirm Entra audit logs are collected and identify the relevant application owners.Review new consent grants, app permissions, and service-principal credential changes.Inspect initiating accounts, tenant context, publishers, and requested permissions.Compare with approved integrations, CI/CD changes, and expected administrator activity.Correlate with application sign-ins; preserve evidence before following your response process.

0 of 5 steps complete

Starter query

KQL · Microsoft Sentinel with Entra AuditLogs ingestion. Adapt operation names and log availability to your tenant. An event is a lead, not proof of compromise.

AuditLogs
| where TimeGenerated > ago(7d)
| where Category == "ApplicationManagement"
| where OperationName contains "Consent"
    or OperationName contains "Add app role assignment"
    or OperationName contains "Add service principal credentials"
| project TimeGenerated, OperationName, InitiatedBy, TargetResources, Result
| order by TimeGenerated desc

Start with a question.Follow the evidence.

Which hunts fit your business?

Hypothesis

Telemetry to collect

Investigation checklist

Starter query

Hypothesis

Telemetry to collect

Investigation checklist

Starter query

Hypothesis

Telemetry to collect

Investigation checklist

Starter query

Hypothesis

Telemetry to collect

Investigation checklist

Starter query

Start with a question.
Follow the evidence.