𝐁𝐨𝐧𝐚𝐢𝐫

Cyberdefense Specialist 🛡
It's a dirty job but someone has to do it

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

- Block the Windows Run Command Box
- Change defualt app for files such as JS, PS1 and CMD (block automatic double click execution)
- Use some good Ad-blocker

In general harden such devices, they will probably never need those functionalities but they will be less exposed!💻

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Loved the new video from @altsitoX

https://t.co/cRIs7z8wEp

Pls do this to your Pop's, Mom's and Grangran devices, they need this the most especcially when they will click the next fake AI advertisement 👴

Moreover, I reccomend the following.....

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

@vxunderground @nikhil_mitt @struppigel Malware Analysis for Hedgehogs Bundle 🍀

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Doing some tests it appears that this happens when you do two extend like so
| extend str = iff(cond , split(cond), str)

this will only work for the second one, maybe a bug?

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Apparently if you have two extend operands in a #kql query in order to overwrite a field it just considers the last one...

Need to find a way to modify the same field in two different ways 😥

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

- For internal search you need to have a watchlist (in this case NetworkHierarchy) with the networks present in the perimeter
- The Network name will mostly give you the SSID of the net the device is connected to. (This can tell you if the user is outside of the office)

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

𝐇𝐨𝐰 𝐭𝐨 𝐪𝐮𝐢𝐜𝐤𝐥𝐲 𝐥𝐢𝐧𝐤 𝐢𝐧𝐭𝐞𝐫𝐧𝐚𝐥 𝐈𝐏 𝐭𝐨 𝐡𝐨𝐬𝐭/𝐧𝐞𝐭𝐰𝐨𝐫𝐤 𝐧𝐚𝐦𝐞 in #kql
1/2

let Address = "<IP>";
DeviceNetworkInfo
| where Timestamp > ago(30d)
| extend MonthDay = format_datetime(Timestamp, 'MM-dd')
| where IPAddresses contains Address
...

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

2/2
...
| evaluate ipv4_lookup(NetworkHierarchyLookup, Address,SearchKey,true)
| extend NetworkName= tostring(parse_json(ConnectedNetworks).[0].Name)
| distinct DeviceName,name, group, Country, MonthDay, NetworkName

#Sentinel #Defender #Network

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

The idea is simple: by quantifying how often a particular alert type appears in your environment, you add a layer of context that goes beyond severity or confidence scores.

Not incredibly complex, but sometimes also small and simple stuff can go great lengths :D

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

𝗨𝘀𝗶𝗻𝗴 𝗿𝗮𝗿𝗶𝘁𝘆 𝗼𝗳 𝘁𝗵𝗲 𝗮𝗹𝗲𝗿𝘁 𝗮𝘀 𝗮𝗻 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗲𝗻𝗿𝗶𝗰𝗵𝗺𝗲𝗻𝘁 𝘁𝗮𝗴 𝗼𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗫𝗗𝗥
https://t.co/u8tf73Qnrh

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Apparently there is no easy way of doing it like with other supervisors. Looking areound the best solution will be to create a virtual switch with OSwith.

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Trying to build my investigation/detonation env with #Ubuntu #LXD

So far everything super, but I am having trouble with the creation of a span port in order to allow the sensor to listen in on the traffic of the detonation environment.

Ayone has had similar problems or idea?

[spencer @techspence]

Pentesting internal networks is 75% finding things admins already knew were a problem but don’t have the time, money or team to fix 😔

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

The best choice now is to use GraphAPI's

https://t.co/UaDs5UoyUl

this gives you all info from both consoles but I see that creating a query over this endpoint is not the best. For example I cannot filter over the title of the alert.

Will iterate in the playbook apparently 🤷‍♂️

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

A bit frustrating how tables in #Defender #XDR have still specific alert ids for Defender and Sentinel logs.

Trying to create a playbook that looks at features like
incident resolution
device name
user name
region

no single table has all of it and joins are not really doable

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Here is the doc about it
https://t.co/5E816Ez9qN

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Apparently the #Sentinel logic app connector for Defender is not really the best choice for XDR queries.

I tried a query on AlertEvidence and is telling me that it cannot find it (?)

I went ahead and used a HTTP one with calls to the hunt running query api

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

I tried moving it before and after other instructions, nothing seems to work. It's just a string, that's what is strange.

I opened a ticket with MS.

Anyone else has had similar cases? #KQL #bug

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

A simple "extend" kills my KQL query.

I am playing around on a query capable of looking at changes in email traffic flow. After doing some counting and joining I tried to add a

extend Today = format_datetime(now(), 'MM-dd')

And I am not receiving any more results #KQL

[𝐁𝐨𝐧𝐚𝐢𝐫 @Il_Colombo]

Man, I love the smell of Advanced Hunting crashes in the morning

#AH #Defender #KQL