Validate Queries

Workflow runs for Validate Queries

• Suspicious Screen Connect Internet Download Query

  completed successfully:
  Validate Queries#392:Pull request#90synchronizebydweissbacher
  Nicholas-devsec:suspicious_screen_connect_internet_download

  Oct 16, 20269s
  More actions for workflow run 392

• Suspicious Screen Connect Internet Download Query

  completed successfully:
  Validate Queries#391:Pull request#90openedbyNicholas-devsec
  Nicholas-devsec:suspicious_screen_connect_internet_download

  Oct 9, 202613s
  More actions for workflow run 391

• Add focused CrowdStrike CQL agent skills

  failed:
  Validate Queries#390:Pull request#89openedbyyayalingo
  yayalingo:add-vscode-cql-agent-skills

  Sep 29, 20266h 6m 48s
  More actions for workflow run 390

• Merge pull request #88 from ByteRay-Labs/submission/Public_IP_Success…

  completed successfully:
  Validate Queries#389:Commit74d6a96pushedbyPolaceka
  main

  Sep 28, 202612s
  More actions for workflow run 389

• Merge pull request #87 from ByteRay-Labs/submission/Citrix_NetScaler_…

  completed successfully:
  Validate Queries#388:Commit31ecf9cpushedbyPolaceka
  main

  Sep 28, 202612s
  More actions for workflow run 388

• [Submission] Public IP Successfully Authenticated Following Brute Force Activity

  completed successfully:
  Validate Queries#387:Pull request#88openedbycql-hub-submission-bot-v2[bot]Bot
  submission/Public_IP_Successfully_Authenticated_Following_Brute_Force_Activity

  Sep 28, 202611s
  More actions for workflow run 387

• Add query: Public IP Successfully Authenticated Following Brute Force…

  completed successfully:
  Validate Queries#386:Commitce82e6dpushedbycql-hub-submission-bot-v2[bot]Bot
  submission/Public_IP_Successfully_Authenticated_Following_Brute_Force_Activity

  Sep 28, 202616s
  More actions for workflow run 386

• [Submission] Citrix NetScaler - CVE-2026-88771 Pitboss Command-Injection String in Logs

  completed successfully:
  Validate Queries#385:Pull request#87openedbycql-hub-submission-bot-v2[bot]Bot
  submission/Citrix_NetScaler_CVE_2026_88771_Pitboss_Command_Injection_String_in_Logs

  Sep 28, 202610s
  More actions for workflow run 385

• Add query: Citrix NetScaler - CVE-2026-88771 Pitboss Command-Injectio…

  completed successfully:
  Validate Queries#384:Commit2d0f44bpushedbycql-hub-submission-bot-v2[bot]Bot
  submission/Citrix_NetScaler_CVE_2026_88771_Pitboss_Command_Injection_String_in_Logs

  Sep 28, 202613s
  More actions for workflow run 384

• fix(queries): rework suspicious-powershell-execution hunt

  completed successfully:
  Validate Queries#383:Commit64530cfpushedbydweissbacher
  main

  Sep 14, 202611s
  More actions for workflow run 383

• Add COM and TypeLib per-user hijacking hunts (T1546.015, T1574.008)

  failed:
  Validate Queries#382:Pull request#86openedbyclivoa
  clivoa:add-com-and-typelib-hijack-hunts

  Sep 13, 202616d 2h 44m 3s
  More actions for workflow run 382

• Merge pull request #85 from ByteRay-Labs/submission/Mail_Inbox_Rule_A…

  completed successfully:
  Validate Queries#381:Commitea7ad74pushedbydweissbacher
  main

  Sep 11, 202616s
  More actions for workflow run 381

• [Submission] Mail: Inbox Rule Auto-Forwards or Hides Messages (Potential BEC Persistence)

  completed successfully:
  Validate Queries#380:Pull request#85openedbycql-hub-submission-bot-v2[bot]Bot
  submission/Mail_Inbox_Rule_Auto_Forwards_or_Hides_Messages_Potential_BEC_Persistence

  Sep 11, 202610s
  More actions for workflow run 380

• Add query: Mail: Inbox Rule Auto-Forwards or Hides Messages (Potentia…

  completed successfully:
  Validate Queries#379:Commit355157epushedbycql-hub-submission-bot-v2[bot]Bot
  submission/Mail_Inbox_Rule_Auto_Forwards_or_Hides_Messages_Potential_BEC_Persistence

  Sep 11, 202611s
  More actions for workflow run 379

• Merge pull request #83 from ByteRay-Labs/submission/Crowdstrike_Falco…

  completed successfully:
  Validate Queries#378:Commit290c107pushedbydweissbacher
  main

  Sep 4, 202614s
  More actions for workflow run 378

• FalconFlank: merge into one pipeline, join to ProcessRollup2, expand …

  completed successfully:
  Validate Queries#377:Commit103632fpushedbydweissbacher
  submission/Crowdstrike_Falcon_0day_Privilege_Escalation_Vulnerability_FalconFlank

  Sep 4, 202615s
  More actions for workflow run 377

• [Submission] Crowdstrike Falcon 0day Privilege Escalation Vulnerability FalconFlank

  completed successfully:
  Validate Queries#376:Pull request#83synchronizebydweissbacher
  submission/Crowdstrike_Falcon_0day_Privilege_Escalation_Vulnerability_FalconFlank

  Sep 4, 202621s
  More actions for workflow run 376

• [Submission] Crowdstrike Falcon 0day Privilege Escalation Vulnerability FalconFlank

  completed successfully:
  Validate Queries#375:Pull request#83openedbycql-hub-submission-bot-v2[bot]Bot
  submission/Crowdstrike_Falcon_0day_Privilege_Escalation_Vulnerability_FalconFlank

  Sep 4, 202618s
  More actions for workflow run 375

• Add query: Crowdstrike Falcon 0day Privilege Escalation Vulnerability…

  completed successfully:
  Validate Queries#374:Commitbcb8b4fpushedbycql-hub-submission-bot-v2[bot]Bot
  submission/Crowdstrike_Falcon_0day_Privilege_Escalation_Vulnerability_FalconFlank

  Sep 4, 202611s
  More actions for workflow run 374

• Merge pull request #80 from ByteRay-Labs/submission/Command_History_w…

  completed successfully:
  Validate Queries#373:Commit97036capushedbydweissbacher
  main

  Sep 1, 202617s
  More actions for workflow run 373

• [Submission] Command History with Process Tree

  completed successfully:
  Validate Queries#372:Pull request#80synchronizebydweissbacher
  submission/Command_History_with_Process_Tree

  Sep 1, 202612s
  More actions for workflow run 372

• Rework PR #80 query: add ExecutionChain and groupBy correlation, MITR…

  completed successfully:
  Validate Queries#371:Commit51d3d5bpushedbydweissbacher
  submission/Command_History_with_Process_Tree

  Sep 1, 202616s
  More actions for workflow run 371

• Merge pull request #82 from ByteRay-Labs/submission/Internet_Exposed_…

  completed successfully:
  Validate Queries#370:Commit02a75b9pushedbydweissbacher
  main

  Sep 1, 202615s
  More actions for workflow run 370

• [Submission] Internet-Exposed RDP - Inbound Accepts from Public IPs

  completed successfully:
  Validate Queries#369:Pull request#82openedbycql-hub-submission-bot-v2[bot]Bot
  submission/Internet_Exposed_RDP_Inbound_Accepts_from_Public_IPs

  Sep 1, 202611s
  More actions for workflow run 369

• Add query: Internet-Exposed RDP - Inbound Accepts from Public IPs

  completed successfully:
  Validate Queries#368:Commitc1e2348pushedbycql-hub-submission-bot-v2[bot]Bot
  submission/Internet_Exposed_RDP_Inbound_Accepts_from_Public_IPs

  Sep 1, 202611s
  More actions for workflow run 368