Purple Knight

[Purple Knight @Purp_Knight]

@grok Find the programmer

[Purple Knight @Purp_Knight]

@techspence Phishing resistant MFA + hardening everything :)

[Purple Knight @Purp_Knight]

@techspence @DirectoryRanger MS Defender for Identity

[Purple Knight @Purp_Knight]

@ellishlomo Do we need a licence for MDTI or it is generally available?

[Purple Knight @Purp_Knight]

@RussianPanda9xx @TheDFIRReport That's a great opportunity

[Purple Knight @Purp_Knight]

@ismailsaymaz 25 yıllık rüyadan yeni mi uyandın

[Purple Knight @Purp_Knight]

@jstrosch I was always wondering how I could make a dynamic analysis without connection

[Purple Knight @Purp_Knight]

@BertJanCyber My favourite part is to run it via live response which makes the process much simpler

[Purple Knight @Purp_Knight]

@BertJanCyber @JeffreyAppel7 Actually I used this blog post but i didnt see the restriction policy. We created a policy that excludes trusted location and grant access the user if they log in from compliant/hybrid joined devices. I dont know if this is the right way

[Deutsche Telekom CERT @DTCERT]

🚨 Telekom Security detected a major #vishing campaign against multiple targets in #Germany, likely related to a ransomware group. We are still analyzing, but here is what we know so far 🧵1/x

[Purple Knight @Purp_Knight]

@nas_bench @TheDFIRReport Looking forward to it

[The DFIR Report @TheDFIRReport]

🎄 Holiday Giveaway! 🎁

✨ Get 1 FREE DFIR Labs case or entry to our next CTF!

How to enter:
👍 Like
🔁 Retweet
💬 Comment - Share your feedback on The DFIR Report and earn DOUBLE entries! 🎉

🎯 Winners will be announced on December 25th. Good luck!

[Purple Knight @Purp_Knight]

@alitajran Hi Ali,

we want to roll out mfa for all real users in our business units. I think we can manage it with logic app and graph api. But i couldn't find proper documentation. Could you refer me some artikels for that?

[Mehmet Ergene @Cyb3rMonk]

🚀 Exciting News and a Giveaway! 🚀

Announcing my new course: Advanced Hands-On KQL for Threat Hunting and Detection Engineering! 🎓✨

This course is designed to take you from zero to master, equipping you with cutting-edge skills to stay ahead in the cybersecurity game. Here’s what you can expect:
🔍 Advanced Time Series Anomaly Detection: Discover methods you’ve never seen before.
🔗 Attack Path & Execution Chain Detection with Process Mining: A novel approach to threat detection.
🌐 Attack Pattern Detection Using Graph Semantics: Start thinking in graphs and revolutionize your detection and investigation skills.

And now, the exciting part! 🎁 I’m giving away 1 FREE seat in the course! To enter:

1️⃣ Follow @BluRavenSec
2️⃣ Like and repost this post
3️⃣ Comment why you want to join

https://t.co/sf06Wd2n97

#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #MicrosoftDefenderXDR #Defender #cybersecurity #KQLForSecurityAnalysts #ThreatHunting #DetectionEngineering #training #dfir #incidentresponse

[Purple Knight @Purp_Knight]

@vxunderground @Cyb3rMonk Please please pick me up😎

[Purple Knight @Purp_Knight]

@RacWatchin8872 @banthisguy9349 I saw hardcopy.exe as well. What does it do exactly?

[Purple Knight @Purp_Knight]

@banthisguy9349 What an obfuscated powershell script is it

[Purple Knight @Purp_Knight]

@vxunderground I would like The Definitive Guide to KQL (eBook) (x10)

[Purple Knight @Purp_Knight]

@nas_bench @TheDFIRReport Super excited