pfransc

[pfransc @pfransces]

@ThruntingLabs Nice!

[pfransc @pfransces]

@Cyb3rMonk @passtheprt Hybrid device or compliant device CA requirement solves this? Other than blocking the flow entirely. The same accounts that need the flow isnt complaint/hybrid I guess. Might as well block the flow + make exceptions?

[pfransc @pfransces]

@ThruntingLabs No Sentinel and KQL? 🥲

[pfransc @pfransces]

@UjlakiMarci @jgreigj Invalid link

[pfransc @pfransces]

@kjackson @cyb3rops Can you pull the hashes of the installers from DeviceTvm tables or similar for comparison? For those running MDE.

[pfransc @pfransces]

@gregor_suttie Any good articles?

[pfransc @pfransces]

@SecurityAura Which AI do you prefer for kql? Chatgpt is decent. Not sure if the Code variants perform any better.

[pfransc @pfransces]

@Cyb3rMonk Link?

[pfransc @pfransces]

@Cyb3rMonk Kql or python?

[pfransc @pfransces]

@Cyb3rMonk Currently doing the advanced course. Much recommended! 👌

[pfransc @pfransces]

@ZackKorman I'll only use it if it also says Mail.ReadWrite

[pfransc @pfransces]

@UK_Daniel_Card New?

[pfransc @pfransces]

@inversecos Where can I see the available labs? Its impossible to use the web page from Android.

[pfransc @pfransces]

@0xEnleak Sherlock? How do you like it compared to its competitors? 🙂

[pfransc @pfransces]

@malmoeb Do you know which Defender service detected this?

[pfransc @pfransces]

@leak_ix Found no result for

+plugin:React2ShellPlugin

[pfransc @pfransces]

@SecurityAura @techspence MDE P2 or just regular MDAV?

[pfransc @pfransces]

@NathanMcNulty What issues does it cause, typically? Other than being bad UI wise

[pfransc @pfransces]

@NathanMcNulty @MihaPecnik @reprise_99 @JeffreyAppel7 'New schema' as in the MDE event types?