Embracing offensive tooling: Building detections against Koadic using EQL

This blog post analyzes the Koadic post-exploitation framework and demonstrates how defenders can detect its behaviors on Windows hosts using Event Query Language (EQL). It describes Koadic's use of living‑off‑the‑land tools (WSH, COM, mshta, rundll32, wmiprvse), common post‑exploitation actions (discovery, UAC bypass, file-based command redirection), and provides concrete EQL queries and macros to identify those behaviors.