-Yiannis-

Pentester / RnD / developer of the #WarBerryPi and sometimes just ¯\_(ツ)_/¯. Opinions and tweets represent me not my company.

[-Yiannis- @Sec_GroundZero]

So i polished my KQL notes and ended up with a 70 page long pdf. You can find it here https://t.co/esDVonbFkG
Thx and credits also go to @DebugPrivilege @rpargman @olafhartong as i rely a lot on their insights.

[-Yiannis- @Sec_GroundZero]

First post after a long long time. I had the opportunity to present at @EXNESS behind-the-code event at a unique setting. The interaction and networking at a physical event was refreshing.

[CloudBreach @Cloud_Breach]

It's Launch Day for #CloudBreach! Register for #BreachingAzure Lab and get 25% discount code using the promo code "LAUNCHDAY25". #BreachingAzure challenges students to utilise the latest offensive techniques in a realistic hybrid environment. Are you ready to breach the cloud?

[Matt Eidelberg @Tyl0us]

Shoutout to @GeorgePatsias1 for his very cool project https://t.co/juzf6LH0LI. #netsec #infosec #redteam

[-Yiannis- @Sec_GroundZero]

@rpargman @DebugPrivilege @olafhartong Very happy to hear that. I learned a lot from the people sharing their work.

[-Yiannis- @Sec_GroundZero]

So i polished my KQL notes and ended up with a 70 page long pdf. You can find it here https://t.co/esDVonbFkG
Thx and credits also go to @DebugPrivilege @rpargman @olafhartong as i rely a lot on their insights.

[-Yiannis- @Sec_GroundZero]

@arcanecode Thank you. I use notion for technical notes and obsidian for non tech research/book but i will check this out as well.

[-Yiannis- @Sec_GroundZero]

Switched from Evernote to Notion and finally my notes are starting to make visual sense.

[-Yiannis- @Sec_GroundZero]

@Max_Mal_ @olafhartong @falconforceteam This might be different as the PE header is also changed if i am reading this correct in order to bypass this detection.

[-Yiannis- @Sec_GroundZero]

Quick KQL query to hunt for renamed lolbins not running from c:\windows, \system32 or \syswow64. @olafhartong showed it in a more elegant way for MDE as part of the @falconforceteam FalconFriday. #threathunting (https://t.co/oqHNnG3Lo0)

https://t.co/RFnbxJ8Q1j

[-Yiannis- @Sec_GroundZero]

First attempt with standard dev in KQL based on @rpargman beaconing analysis to detect potential bruteforce attacks with EID4625.

https://t.co/X2Ywjn9l0a

[-Yiannis- @Sec_GroundZero]

Discord bot cnc https://t.co/SsUnmHeeH7 - @GeorgePatsias1

[Monica @MonicaPolemitis]

Last Tuesday I moderated an event organized by the Int'al Chamber of Commerce National Committee of CY,titled Digital Economy&the Importance of ICT for Business in a post-COVID environment. If you didn't have the chance to watch it, check out the recording https://t.co/qVbwDftBqV

[-Yiannis- @Sec_GroundZero]

4 days of intense detection engineering training with @olafhartong done.
So much info to ingest from the trainers and the great course participants. Now back to that detection cycle.

[-Yiannis- @Sec_GroundZero]

Day 1 of @falconforceteam detection engineering course done. Amazing content, tons of new learning and @olafhartong makes it easy. Looking forward for the next days.

[-Yiannis- @Sec_GroundZero]

@s4n7h0 @InfoSecCampus Any of the projects @olafhartong is working on

[-Yiannis- @Sec_GroundZero]

Answer is that they don't have to be normalized. EQL understands the schema and it can be queried directly.

[-Yiannis- @Sec_GroundZero]

Help needed: anyone normalized security logs with eqllib? Sysmon is fine and i see that security logs are supported but the format it not identified @EndgameInc

[-Yiannis- @Sec_GroundZero]

@0xffhh @DebugPrivilege Little bit of a hacky solution but I think i got it working working with milliseconds.

https://t.co/ic2vWGPES6

[-Yiannis- @Sec_GroundZero]

Is there a way to do similar to EQL (sequence with maxspan) with KQL? Basically want to compare the time generated of 2 different events. #azure #Sentinel

[-Yiannis- @Sec_GroundZero]

1986 when my dad (center) was the distributor for the new North Star microcomputers (mainframes) in Cyprus.

[-Yiannis- @Sec_GroundZero]

@0xffhh @DebugPrivilege As you said it wont be elegant it seems. I dont think ago will do it but i will try with datetime_diff. went through @DebugPrivilege guide but couldnt find anything close to this. Probably do 2 let commands to hold each date from and then compare the two. Union & iif or something