# \#lcql

**URL:** https://community.limacharlie.com/tag/lcql/13.md

[Latest](https://community.limacharlie.com/latest.md) · [Categories](https://community.limacharlie.com/categories.md) · [Tags](https://community.limacharlie.com/tags.md)

---

## [Tracking Down Artifact GUIDs](https://community.limacharlie.com/t/tracking-down-artifact-guids/592)

<div class="topic-metadata">

**Author:** [@joshlemon](https://community.limacharlie.com/u/joshlemon)\
**Replies:** 0\
**Last updated:** [February 9, 2026, 6:46pm UTC](https://community.limacharlie.com/t/tracking-down-artifact-guids/592 "2026-02-09T18:46:04Z")

</div>

In the past few cases I’ve worked on, I’ve used the Extensions for Plaso and Hayabusa, which are great for retrieving artifacts and processing them automatically. However, I’ve run into an issue where I need to match the…

---

## [Add support for \`d\` (days) in LCQL timeframe selection](https://community.limacharlie.com/t/add-support-for-d-days-in-lcql-timeframe-selection/414)

<div class="topic-metadata">

**Author:** [@ecapuano](https://community.limacharlie.com/u/ecapuano)\
**Replies:** 0\
**Last updated:** [July 9, 2025, 5:18pm UTC](https://community.limacharlie.com/t/add-support-for-d-days-in-lcql-timeframe-selection/414 "2025-07-09T17:18:03Z")

</div>

When writing LCQL queries that span days/weeks/months, would be nice to be able to use something like -30d instead of -720h

---

## [No Query Console in the New UI](https://community.limacharlie.com/t/no-query-console-in-the-new-ui/299)

<div class="topic-metadata">

**Author:** [@chadmando](https://community.limacharlie.com/u/chadmando)\
**Replies:** 1\
**Last updated:** [May 7, 2025, 7:48pm UTC](https://community.limacharlie.com/t/no-query-console-in-the-new-ui/299 "2025-05-07T19:48:54Z")

</div>

I don’t see the Query Console in the Modern Theme. Is it really not there (yet) or am I not looking in the right spot?

---

## [Developing A Baseline For Sensitive Process Access](https://community.limacharlie.com/t/developing-a-baseline-for-sensitive-process-access/72)

<div class="topic-metadata">

**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\
**Replies:** 0\
**Last updated:** [February 18, 2025, 10:57pm UTC](https://community.limacharlie.com/t/developing-a-baseline-for-sensitive-process-access/72 "2025-02-18T22:57:46Z")

</div>

Description of the query: A starter query which leverages field projection to provide a high-level view of SENSITIVE\_PROCESS\_ACCESS activity for an org for developing a baseline or identifying outliers. Query: -24h | …

---

## [Tracking Failed Windows Logons for Threat Hunting](https://community.limacharlie.com/t/tracking-failed-windows-logons-for-threat-hunting/56)

<div class="topic-metadata">

**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\
**Replies:** 0\
**Last updated:** [February 17, 2025, 9:22pm UTC](https://community.limacharlie.com/t/tracking-failed-windows-logons-for-threat-hunting/56 "2025-02-17T21:22:06Z")

</div>

Description of the query: Find all failed logons, and return specifically the SrcIP, LogonType, Username, and SrcHostname of the logons. Useful for developing baselines and threat hunting for exposed systems being brute…

---

## [Is rundll32.exe Executed Without Expected Dll Path?](https://community.limacharlie.com/t/is-rundll32-exe-executed-without-expected-dll-path/55)

<div class="topic-metadata">

**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\
**Replies:** 0\
**Last updated:** [February 17, 2025, 9:19pm UTC](https://community.limacharlie.com/t/is-rundll32-exe-executed-without-expected-dll-path/55 "2025-02-17T21:19:37Z")

</div>

Description of the query: Look for executions of rundll32.exe with its expected CLI args (a path to a DLL) Query: -6h | plat==windows | NEW\_PROCESS EXISTING\_PROCESS | event/FILE\_PATH contains "rundll32.exe" AND event/…