What is a useful starter set of threat-hunting queries?

Threat hunting is not starting from an alert, it is targeted searching for behaviour that alerts miss. For SMBs, four or five monthly queries in Defender Advanced Hunting or Sentinel surface things nobody reported.

Try this first

1. 1Inbox rules into suspicious folders: EmailEvents joined with EmailUrlInfo, or via OfficeActivity where Operation == 'New-InboxRule' and Parameters contain Move to Deleted Items, Junk Email, RSS Feeds, or a single-letter folder.
2. 2Mass downloads from SharePoint or OneDrive: CloudAppEvents where ActionType == 'FileDownloaded' and per-user-per-hour count above baseline (start at 100).
3. 3Sign-ins from countries you do not operate in: SigninLogs where Location is outside your expected set and ResultType == 0 (success). Filter out break-glass accounts.
4. 4New OAuth app consents: AuditLogs where OperationName == 'Consent to application'. A user granting access to an unknown app is an early signal of token theft.
5. 5Unexpected PowerShell on endpoints: DeviceProcessEvents where FileName == 'powershell.exe' and CommandLine contains IEX, DownloadString, or -enc. Lots of false positives, but it teaches you what normal looks like.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.