A Claude Code skill that writes and runs Defender KQL hunts
From the community · not tested by us
Tired of pasting KQL into the Defender portal, they built an mde-hunt skill with Claude Code: they ask in plain English, Claude writes the KQL and a script runs it; the first hunt found AnyDesk renamed as Invoice_Viewer.exe.
Details
Posted by@Securityinbits
DateOct 17, 2026
Category⚙️ Automation & ops
Found viaX
Summary written by ToolPassed from the public post. Claims are the poster’s; we haven’t reproduced this.