Fix broken reference links in Microsoft 365 Defender hunting queries

[d4rk-pri0r]

Change(s):

• Repaired 17 dead reference links across 17 files under Hunting Queries/Microsoft 365 Defender/:
  • 14 Sigma rule links — the Original Sigma Rule links point at rules/apt/... paths in github.com/Neo23x0/sigma that no longer exist: the repository is now SigmaHQ/sigma and the rules were moved (mostly under rules-emerging-threats/) and renamed with logsource prefixes. Each link now targets the rule's current path, verified to exist on SigmaHQ/sigma master. The scheduled task creation retarget was additionally confirmed by the rule's unchanged id GUID (92626ddd-662c-49e3-ac59-f6535f12d189).
  • 1 blog reference (Execution/detect-anomalous-process-trees.yaml) — the article moved from mergene.medium.com to posts.bluraven.io (same slug; verified live).
  • 1 documentation link (Protection events/ExploitGuardAsrDescriptions.yaml) — the docs.microsoft.com/.../enable-attack-surface-reduction page 404s; now points at its current home, learn.microsoft.com/en-us/defender-endpoint/enable-attack-surface-reduction (verified live).
  • 1 self-repo link (Defense evasion/UpdateStsRefreshToken[Solorigate].yaml) — Detections/AuditLogs/StsRefreshTokenModification.yaml no longer exists; the query moved to Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/ (verified on master).

Reason for Change(s):

• These are all human-facing reference links in descriptions and comments; every one currently 404s or dead-ends, so readers can't reach the cited source material. All replacement URLs verified resolving. Links whose targets no longer exist anywhere (three retired Sigma rules, a withdrawn PDF) were deliberately left untouched rather than guessed at, and the one dead URL inside an externaldata() data source was also left alone — replacing a query's live data feed is a functional change, not a link repair.
• Follows the same link-integrity audit as Fix malformed migration links in Hunting Queries/AWSCloudTrail #14684 and Fix malformed GitHub URLs in BehaviorAnalytics hunting queries #14691.

Version Updated:

• N/A — none of the touched files carry a version field (legacy hunting queries); no query logic or schema fields changed.

Testing Completed:

• Yes — link-integrity change only, no functional edits. All 17 files strict-parsed as YAML; every rewritten URL verified (SigmaHQ paths checked against the live repository tree, web targets return 200, self-repo target exists on master); no new spelling issues introduced.

Checked that the validations are passing and have addressed any issues that are present:

• Yes — description/comment text only; no KQL logic touched.