I know much of the aspect is environment related but it is possible to detect certain IoCs through pre-made queries