This is for my crappy (but hopefully useful) MDE and Sentinel KQL queries! #KQLThePlanet
Remember
Filenames can be changed File hashes can be changed Ports can be altered Signing Certs can be stolen IPs can be rotated etc.
Welcome to the cyber layer cake son!