#KQLADS - Twitter Hashtag

almost 3 years ago

I have done a #KQLADS (KQL Adversary Detection Series) 🛡️🏹 in the past that covers imported custom detection rules for organizations. @all, If I need to make a second part of this series also let me know. Link to the first tweet of the series: https://t.co/wHQQhg8m8I

Deva Dasari @dileep1794

almost 3 years ago

@BertJanCyber Boss, could it be possible to share some unique queries for Defender that are really helpful for organizations.

0

1

0

7K

0

37

9

22

7K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 15🛡️. The last of the KQL Adversary Detection Series. This time special attention to #KQL queries you can use after an adversary has been detected. I have provided 20 different #DFIR queries to investigate malicious and related activities. https://t.co/5b5uXNE7rL

1

36

7

13

3K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 14🛡️. In order to detect adversaries you should have your security products enabled. Leverage the #KQL query below to see which devices in your organisation are not compliant with the EDR policy. https://t.co/eS8bBeVOYI

2

18

3

8

2K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 13🛡️. To further strengthen our preventive measures combine #KQL and the CISA known Exploited vulnerabilities list together to prioritize vulnerabilities. https://t.co/7vZvDNAfSA

1

19

6

3

2K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 12🛡️. The 2nd Tuesday of the month is important to remember, especially for internet-facing devices and potential exploits. The #KQL query of today helps you prioritize the assets that need to be patched first. https://t.co/0DcpHRIZK3

1

7

1

2

787

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 11🛡️. To detect adversaries it is recommended to actively hunt for suspicious activities. The reop contains three threat hunting cases that guide you through various #KQL queries to identify suspicious behaviour. Happy hunting! 🏹 https://t.co/EBJ0mjluYl

1

15

3

8

1K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 10🛡️. Use #KQL to get insight into the encoded PowerShell commands that have been executed by using the base64_decode_tostring() function. The query decodes base64 PowerShell commands and searches for a set of recon activities. #MDE #Sentinel https://t.co/Cce5wQ9QdK

1

30

6

9

4K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 9🛡️. Does an adversary use bloodhound or SMB used to discover the network? If this happens in your environment you would want to be alerted. Therefore use the #KQL query below to detect anomalous amounts of SMB traffic. https://t.co/0rsYdkdnRc

1

24

8

10

3K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 8🛡️. The C:\Users\Public folder is well known to be used by adversaries to deploy malicious content. Therefore it is important to actively monitor file creations in this folder. The #KQL query below can be used to detect the behaviour. https://t.co/l1xzktAd12

2

37

10

19

3K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 7🛡️. Adversaries try to gain access to sensitive accounts, those accounts allow them to perform actions that have more impact. The #KQL query below uses MDI's approach (similar to Bloodhound) to identify new paths to sensitive accounts. https://t.co/qa605u1Ofd

1

22

7

11

3K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 6🛡️. Today we move from AAD to AD and start by using a #KQL query to identify accounts with a password that never expires. This can be done by using the IdentityDirectoryEvents from Defender For identity. https://t.co/FOAPyqqC06

1

36

8

13

4K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 5🛡️. Today's query identifies Guest users in your Azure tenant that have dedicated roles. This might not be a direct detection rule, but it is important to know which roles have been assigned to external accounts. https://t.co/jcaCIC8uRM

0

16

7

1K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 4🛡️. Adversaries like to evade detections, therefore I have combined discovery or persistence activities with risky users. Those detections aim to detect adversaries that gained access to your Azure environment. Discovery: https://t.co/3F2uiGfBgN

1

24

6

8

2K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 3🛡️. If you have enabled AAD alerts, you probably get a lot of unfamiliar sign-in properties alerts. To reduce false positives those risky users can be combined with other info. The next days will focus on how #KQL can improve this part of AAD https://t.co/vKyUrqzXIG

2

35

11

23

5K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

#KQLADS Day 2🛡️. Are you alerting on the AsrRansomware events in MDE? This does not trigger an alert by default, thus if you have not implemented a #KQL query to identify this behavior yet, do so as soon as possible. #MDE #Sentinel Query: https://t.co/2rTs2urzVc

1

42

20

25

6K

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

The results are in, from today on I start the #KQLADS (KQL Adversary Detection Series) 🛡️🏹 We start with a #KQL query that is used to identify suspicious database discovery activities. Why you want to monitor this is described in the 🧵 #MDE #Sentinel https://t.co/gOo1PfC7UZ

Bert-Jan 🛡️ @BertJanCyber

about 3 years ago

The #KQL repository now contains 200+ KQL queries, which cover various areas. Should I create a small series/thread that covers the best x queries and explains why they should be used? If you want this to focus on a specific area please share below! Repo: https://t.co/03Zb3VVVqo

4

51

15

25

18K

2

92

26

42

14K

Top Tweets for #KQLADS

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users