Ayush Anand

Detection engineering, threat hunting, malware analysis.
One defender bit at a time.

[Ayush Anand @Securityinbits]

https://t.co/DSMNnCuIdZ

[Ayush Anand @Securityinbits]

Microsoft gives anyone with a Microsoft account a free Azure Data Explorer cluster.

No subscription, no credit card, full KQL. Mine took under 2 minutes to create.

https://t.co/QhwqEU1ClO

[Ayush Anand @Securityinbits]

Microsoft gives anyone with a Microsoft account a free Azure Data Explorer cluster.

No subscription, no credit card, full KQL. Mine took under 2 minutes to create.

https://t.co/QhwqEU1ClO

[Ayush Anand @Securityinbits]

An attacker installed ScreenConnect, then hid it from Programs and Features with one registry value.

SystemComponent = 1 on its Uninstall key.

- Service: running
- Programs and Features: no ScreenConnect

Sweep both HKLM Uninstall hives (incl. WOW6432Node) for SystemComponent = 1 and read the DisplayName. Installers hide sub-components this way too. A hidden RMM client is not one of them.

[Ayush Anand @Securityinbits]

My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic

One question, both stacks searched, one table back.

Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.

[Ayush Anand @Securityinbits]

An attacker installed ScreenConnect, then hid it from Programs and Features with one registry value.

SystemComponent = 1 on its Uninstall key.

- Service: running
- Programs and Features: no ScreenConnect

Sweep both HKLM Uninstall hives (incl. WOW6432Node) for SystemComponent = 1 and read the DisplayName. Installers hide sub-components this way too. A hidden RMM client is not one of them.

[Ayush Anand @Securityinbits]

@mbower @bohansec I'll release the MDE Hunt skill soon. Just the final testing is left.

[Ayush Anand @Securityinbits]

My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic

One question, both stacks searched, one table back.

Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.

[Ayush Anand @Securityinbits]

@NathanMcNulty Lol 😀 true

[Ayush Anand @Securityinbits]

@staysapien Works well for intermediate and simple KQL queries.

[Ayush Anand @Securityinbits]

Got tired of pasting KQL into the Defender portal, so I built an mde-hunt skill with Claude Code.

- I ask in plain English
- Claude writes the KQL
- a Python script runs it on live MDE (last 30 days) or my ADX archive (older)

First test: remote-access tools over 120 days. 3 hosts, one running AnyDesk renamed Invoice_Viewer.exe.

Interested? I can share it on GitHub.

[Ayush Anand @Securityinbits]

@0x554b Will do soon!

[Ayush Anand @Securityinbits]

@Cyb3rMik3 Will do soon! 😀

[Ayush Anand @Securityinbits]

Details about: MDE data past 30 days
https://t.co/WFPrC2HffC

[Ayush Anand @Securityinbits]

MDE Advanced Hunting only looks back 30 days.

For my lab I wanted to keep my own copy, so:

- Streaming API -> Azure Storage
- LightIngest -> free ADX cluster
- same KQL, now 162 days deep (587k events)

How do you keep MDE data past 30 days? Sentinel, data lake, ADX, or something better?

[Ayush Anand @Securityinbits]

@staysapien In the beginning, I had it display the query before firing. Once I was comfortable with it, I just let it execute on its own.

[Ayush Anand @Securityinbits]

@_josehelps Thank you for sharing

[Jose Enrique Hernandez @_josehelps]

Two ScreenConnect implants on one host, 9 minutes apart. A signed cloud client to get in, then a self-hosted one on port 8041, pushed through the first, with the tray icon and banner turned off.

Ayush Anand (@Securityinbits) detonated it in a lab:
https://t.co/Jj768wOcbg

[Ayush Anand @Securityinbits]

I ran my detection lab in VMware on my laptop for a long time.

But I wanted Proxmox on bare metal, plus room for real monitoring. So I moved the lab to a Beelink SER10 MAX:

- 12 cores / 24 threads, 64 GB, 1 TB
- 11 VMs: DC, workstations, servers, Kali, router
- Elastic, MDE, Suricata and Velociraptor deployed

One of those VMs runs Claude, and it controls the rest of the lab.

[Ayush Anand @Securityinbits]

Two different scanners. Same detection.

Advanced IP Scanner hit 254 IPs. Advanced Port Scanner hit 190.

Both across 5 ports, both one process, both in one time window.

dcount on DeviceNetworkEvents catches the fan-out, not the tool name.

Behavior gives it away, not the binary. 🎯

[Ayush Anand @Securityinbits]

https://t.co/qBnJ7YpxsA

[Ayush Anand @Securityinbits]

@_josehelps Thanks for the mention, Jose! & @M_haggis.

So far I've covered AnyDesk and ScreenConnect. FleetDeck is next.

LOLRMM has been a great resource for this series. Thanks for maintaining it.