kql_cheat_sheet[.]pdf

Sharing

Copy URL Twitter E-mail

General

Target

kql_cheat_sheet.pdf
Size

335KB
MD5

780630debc4d5df5bf62a7f00afef0f9
SHA1

d4d7ddb0784104907d1b87d2c3d56fe0b7f8f9d8
SHA256

8c7b54e3a88628584d279ec21bad1bda164ccf5d37b47747d25ff185147e7cdb
SHA512

36e537f91a4ca14697a42bf017b449c383e39e3032e9c07e6aee6f0e1b4615ce13984de3a69b6a1ad517ed297e80b84af1b65861b275925001db29f92cbbbec4
SSDEEP

6144:hD2iHDbP1PUg4F3p/00ae/60tcvV3cNtghtT4rpylC1ykAvrG+6Y0Kxw+gQd:hxHDbP1PUgHM/AvV3WwtPlCIxrG+69Qd

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
sample	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Files

kql_cheat_sheet.pdf
.pdf
Password: infected
- https://github.com/marcusbakker/KQL/blob/master/kql_cheat_sheet.pdf
- https://twitter.com/Bakk3rM
- https://aka.ms/lademo
- https://docs.microsoft.com/en-us/azure/kusto/query/
- https://docs.microsoft.com/en-us/azure/kusto/query/scalar-data-types/string
- https://docs.microsoft.com/en-us/azure/kusto/query/whereoperator
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/has-operator
- https://docs.microsoft.com/en-us/azure/kusto/query/countoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/agofunction
- https://docs.microsoft.com/en-us/azure/kusto/query/scalar-data-types/timespan
- https://docs.microsoft.com/en-us/azure/kusto/query/betweenoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/scalar-data-types/datetime
- https://docs.microsoft.com/en-us/azure/kusto/query/projectoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/projectawayoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/extendoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/nowfunction
- https://docs.microsoft.com/en-us/azure/kusto/query/searchoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/datatypes-string-operators
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/contains-operator
- https://docs.microsoft.com/en-us/azure/kusto/query/best-practices
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/contains-cs-operator
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/has-cs-operator
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/startswith-operator
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/endswith-operator
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/startswith-cs-operator
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/endswith-cs-operator
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/regex-operator
- https://github.com/google/re2/wiki/Syntax
- https://regex101.com/
- https://docs.microsoft.com/en-us/azure/kusto/query/notfunction
- https://docs.microsoft.com/en-us/azure/kusto/query/logicaloperators
- https://docs.microsoft.com/en-us/azure/kusto/query/summarizeoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/count-aggfunction
- https://docs.microsoft.com/en-us/azure/kusto/query/summarizeoperator#list-of-aggregation-functions
- https://docs.microsoft.com/en-us/azure/kusto/query/sortoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/strcatfunction
- https://docs.microsoft.com/en-us/azure/kusto/query/numoperators
- https://docs.microsoft.com/en-us/azure/kusto/query/splitfunction
- https://docs.microsoft.com/en-us/azure/kusto/query/parseoperator
- https://docs.microsoft.com/en-us/azure/kusto/query/extractjsonfunction
- https://docs.microsoft.com/en-us/azure/kusto/query/parsejsonfunction
- https://docs.microsoft.com/en-us/azure/kusto/query/gettypefunction
- https://docs.microsoft.com/en-us/azure/kusto/query/letstatement
- https://docs.microsoft.com/en-us/azure/kusto/query/materializefunction
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/scalar-data-types/dynamic
- https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/renderoperator?pivots=azuredataexplorer
- https://docs.microsoft.com/en-us/azure/kusto/query/joinoperator
- http://github.com/marcusbakker/KQL/blob/master/kql_cheat_sheet.pdf
- https://aka.ms/lademo.
- http://contosohotels.com
- http://DC01.na.contosohotels.com
- http://regex101.com
- Show all

Sharing

General

Malware Config

Signatures

Files

Password: infected