We are looking for some interns to join our team here at Microsoft. If you are currently studying cyber security, computer science, mathematics or anything similar and based in Ireland or Cheltenham then we would love to hear from you - https://t.co/N0ECP8eiGM
People often share full Kusto queries, which is awesome, but what about those handy one liners and tips you have picked up along the way? Here are some of my favourites, share yours below!
Extend an additional column for your local time, example +5 UTC:
| extend LocalTime = TimeGenerated +5h
Find events only on weekends, cast a variable to make it easy to read:
let Saturday = time(6.00:00:00);
let Sunday = time(0.00:00:00);
AuditLogs
| where dayofweek(TimeGenerated) in (Saturday, Sunday)
Find events during certain hours of the day:
| where hourofday(TimeGenerated) !between (4 .. 23)
Calculate the minutes (or hours or days etc) between two events:
| extend ['Minutes Between Events']=datetime_diff("minute",Timestamp1,Timestamp2)
Parse the details, including browser family and version etc of a user agent:
| extend UserAgentDetail = todynamic(parse_user_agent(UserAgent, "browser"))
Decode base64 encoded strings, useful for PowerShell:
| extend DecodedCommand = base64_decode_tostring(EncodedCommand)
Rename columns while using project:
| project LogTime=TimeGenerated, SigninLocation=Location, IP=IPAddress, Agent=UserAgent
excited to announce @sublime_sec has raised a $60M Series B led by @IVP@CNBC wrote about the news this morning: https://t.co/TQuFhwhkP2
@ianthiel and I are so grateful and humbled by the trust our customers and community have placed in us. we won't let you down
Enjoy punching phish? Experience writing detections for phish, using regex, Yara, etc., and looking to grow as a researcher within an experienced team? Join me and the rest of the Splunk Attack Analyzer Misfits of Detection Science. US only, fully remote https://t.co/Crr9enas1y
Proofpoint has tracked this technique since August 2024, and call it “brooxml”. Our researchers do not consider this a zero-day or vulnerability in general.
We’ve released Emerging Threats and YARA signatures at the end of this thread.
Microsoft’s Digital Crimes Unit has seized 240 fraudulent websites, disrupting a major “Phishing-as-a-Service” operation. These campaigns targeted sensitive industries like financial services, jeopardizing data, transactions, and even life savings. https://t.co/0wNWO09dP2
I'm told we are hiring in MSTIC: https://t.co/ltfZcQbg5n
Come for the data, stay for the data. Creative problem solvers have the most impact.
If we've worked together, I'm happy to refer you.
But...
you can deploy verifiable coverage for this with @sublime_sec (for free), here’s the detection that’s been out for over a year (h/t @zoomequipd@ajpc500): https://t.co/DeufOQqIP3
Announcing our latest NLU model update: BERT Large Language Model (LLM), which is better at understanding tone, intent, and context than ever before.
We’ve detailed our research in our latest blog and how it’s used to combat AI-generated attacks: https://t.co/M7vAv8uFTG
We are now developing @elastic threat hunting queries, alongside our detection rules, and openly sharing these as well! 🎉🎉
Can visually explore these with https://t.co/DYH1CkmLYN! 🔥🔥
#ThreatHunting#DetectionEngineering
We're excited to announce the release of our new Public EML Analyzer: a free, unauthenticated tool for analyzing email messages.
Upload any EML and get Sublime's analysis results along with URL sandbox and attachment previews, insights, and more: https://t.co/LCU2LK988F
Microsoft has been running massive deception campaigns that flood new phishing sites with bogus credentials for bogus companies on MS tenants. When attackers log in, they deliver a torrent of fresh threat intelligence that can be used to defend: #infosec https://t.co/hFqljCGndq