John Lambert

Corporate Vice President, Security Fellow, Microsoft Security Research, johnla(AT)

[John Lambert @JohnLaTwC]

Complex log analysis without a computer

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, compromising hospitality-related networks worldwide to steal credentials, access cloud environments, and deliver malware to travelers. https://t.co/bnizYidwOk

Since early May 2026, the threat actor has conducted widespread but targeted traffic manipulation attacks involving networks served by captive portals. In some cases, users were redirected through actor-controlled phishing infrastructure, while other activity led to the delivery of malware on impacted systems.

Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard and details the malware, tradecraft, and cloud-focused techniques used throughout the campaign, including device code phishing and credential theft activity targeting travelers.

Get detections, mitigation, and hunting guidance from this Microsoft Threat Intelligence blog post.

[John Lambert @JohnLaTwC]

Under the covers it uses the {result} parameter which is a reference to the current dataframe and is equivalent to:

{result}
<| KQL fragment appended here>

[John Lambert @JohnLaTwC]

Small quality of life improvement coming in #Kusto Explorer 1560.

Ever forget a clause in a query like a project or filter and want to apply it to the current dataframe without re-running the entire query?

Now you can select the KQL fragment and apply it to the current dataframe using Shift + Alt + Enter

🙏 Saar Ron

[John Lambert @JohnLaTwC]

@Cyb3rMonk absolutely.
Page 54: Instrument the terrain for better visibility

[John Lambert @JohnLaTwC]

My copy of Threat-Driven Software Development arrived yesterday. I think this is an important book.

In security, as in many fields, we go to training and we are told what to do. But I love the adage: "Training is for certainty. Education is for uncertainty."

I've found the best way to work with developers is not to tell them what to do. It's to help them understand what the problem is. That starts with education.

When we were responding to the early Internet worms like Blaster and Code Red, we had engineers who knew how to write code that did what it was supposed to do. But many didn't yet know how to determine whether that code was susceptible to things it wasn't supposed to do.

Back then, we started with education as well. @michael_howard and David Leblanc wrote Writing Secure Code, which went through multiple editions. It was instrumental in giving developers something practical to learn from—something that connected threats and risks to the code they wrote.

I had the opportunity to work with the authors over the last couple of years, and I was an early supporter of adapting the concepts of secure development to be more aware of how threat actors actually attack systems—especially highly adaptive ones. How do you design software that is resilient to those attacks? How do you build software that also helps incident responders understand what happened when something goes wrong?

In Threat-Driven Software Development, @michael_howard, @Lee_Holmes , @sherrod_im , and Shawn Hernan bring together expertise in secure coding, security architecture, threat intelligence, and application security. They blend the insights from those disciplines into something that's approachable for developers without losing the depth that practitioners will appreciate.

This book is full of gems, and it packs a remarkable amount into its 360 pages.

Get it➡️ https://t.co/e0PeBjaipB

[John Lambert @JohnLaTwC]

Hear from the authors 🎙️: https://t.co/eEeTKaSwdU

[John Lambert @JohnLaTwC]

Pacific Northwest: Land, water, timber, rock. Just add a pair of boots.

[John Lambert @JohnLaTwC]

Quotes that stuck with me recently:
· "If everyone wrote down their problems and put them in a hat, would you risk grabbing one or keeping yours?"
· "We are determined not by our experiences themselves but by the meaning we give them."
· "The amount of good things in your life depends on your ability to notice them."
· "I hope you never lose the version of you who still believes something beautiful is on the way."
· "That’s what I am, but not who I am."
· "If you are patient in one moment of anger, you will avoid one hundred days of sorrow."

[John Lambert @JohnLaTwC]

Pacific Northwest: The solemn silencing of your mind when you come upon a truly old tree

[💻 Sherrod @sherrod_im]

Go get this book:
https://t.co/49OWJOK3t1

[John Lambert @JohnLaTwC]

@dinodaizovi @Dave_Maynor @anton_chuvakin When we were developing Hyper-V, a colleague pointed me to a paper detailing attack techniques to piece boundaries: hardware vulns, finding undocumented instructions, lack of input sanitization, and more.
I see your 1988 and raise you the USAF in 1974: https://t.co/DBAOjHnKjy

[John Lambert @JohnLaTwC]

@greglesnewich It's basically de-dimensionalizing the data to reduce volumes to allow longer retention, but preserving relevant properties.

Best references might be looking up "Medallion Architecture" in particular the Gold Layer.

[John Lambert @JohnLaTwC]

What is the German word for trying to spell a word, and you spell it so poorly, not even the spell checker can offer suggestions.

[John Lambert @JohnLaTwC]

You can see other feature enhancements or bug fixes by clicking What's New 💡

[John Lambert @JohnLaTwC]

Some recent quality of life improvements to #Kusto Explorer (h/t Saar Ron)

👇👇👇

[John Lambert @JohnLaTwC]

...You can now use Ctrl + Alt + Click to filter out those values.

[Speaker 25 @rodtrent]

IRQL: Incident Response Query Language https://t.co/P5I4Uai0WK

#MustLearnKQL #KQL #KQLMysteries