From 3539cb25eff4ddf2aff79841e5e27de9daf5b27c Mon Sep 17 00:00:00 2001
From: "detections-ai[bot]"
 <222691694+detections-ai[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:24:36 +0000
Subject: [PATCH] Update file at
 /KQL/preemptive-search-for-artoken-phaas-domain-lures.kql

---
 KQL/preemptive-search-for-artoken-phaas-domain-lures.kql | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 KQL/preemptive-search-for-artoken-phaas-domain-lures.kql

diff --git a/KQL/preemptive-search-for-artoken-phaas-domain-lures.kql b/KQL/preemptive-search-for-artoken-phaas-domain-lures.kql
new file mode 100644
index 0000000..185bb3e
--- /dev/null
+++ b/KQL/preemptive-search-for-artoken-phaas-domain-lures.kql
@@ -0,0 +1,8 @@
+let ARTokenCFIOC=externaldata(Domain:string)
+[h'https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/ARTokenIOC.csv']
+with (format='csv', ignoreFirstRecord=true)
+| project Domain;
+DeviceNetworkEvents
+| where Timestamp > ago(30d)
+| where ActionType == "ConnectionSuccess"
+| where RemoteUrl has_any(ARTokenCFIOC)
\ No newline at end of file