Are you joining The KQL Cafe (@kqlcafe.bsky.social) next week? I will be talking about #KQL, Logic Apps, APIs and a combination of the three during the session.
Interested? Register here: www.meetup.com/kql-cafe/eve...
📅 When: April 29 18:00 - 19:30 (CET)
🖥️ Where: Online
💰 Cost: Free of charge
Microsoft announced the public preview of the OAuthAppInfo table in the Advanced Hunting schema. I created multiple #KQL queries to help you kick-start the usage of this table.🚀
The queries help you to identify high-permissive, unused and external apps.
github.com/Bert-JanP/Hu...
#100DaysOfKQL
Day 100 - CScript.exe, WScript.exe or MSHTA.exe Executed from Web Browser Process
IT'S FINALLY OVER! I had another query in store for today, but I feel like this challenge wouldn't be complete without that one.
(cont)
t.co/lwO1hmrqUk
Pushed a #KQL that returns the top 10 SecurityEvents with the largest ingestion size. This can help determine which events you may want to aggregate or filter, depending on your detection/forensic needs.
github.com/Bert-JanP/Hu...
It's time to prepare some content for the next
@kqlcafe.bsky.social . I will discuss #KQL, Logic Apps and hunting through the available APIs.
The session is on April 29th and is completely free to attend online.
🗓️Event registration & details: www.meetup.com/kql-cafe/
On my way to #ELDK2025 🇩🇰
First stop Hamburg! 🇩🇪
🛡️Released DFIR PowerShell V3!
New features include:
- Granular response capabilities for Acquisition, Analysis, and Containment
- Expanded support beyond Windows, enabling Cloud response activities via Graph API
github.com/Bert-JanP/In...
What EndpointCall do you use for these detections? Or do you only rely on SignInLogs for device code auth?
I am aware, that is most often the case for the phishing flow. But this scenario focusses more on the flow of accessing management apis from unmanaged devices using device code auth.
Pushed a #KQL for: Successful device code sign-in from an unmanaged device.
Query is available for AADSignInEventsBeta and SigninLogs. Less known is the AADSignInEventsBeta filter for device code:
| where EndpointCall == "Cmsi:Cmsi"
🏹Query: github.com/Bert-JanP/Hu...
If your company runs Exchange Online and/or Microsoft 365 have a look at CISA's latest publication: Microsoft Expanded Cloud Logs Implementation Playbook.
The report includes KQL, SPL and Powershell code to perform incident response.
www.cisa.gov/resources-to...
These two mails keep providing great value to list new actions found in a tenant. Very useful to find new detection & hunting potential, anomalies or just to understand your data better.
I will probably write a small blog about the topic soon.
Deployment: github.com/Bert-JanP/Se...
📬 Have you checked latest Kusto Insights by @ugurkoc.de & @bertjancyber.bsky.social
🗓 December update is available now kustoinsights.substack.com/p/kusto-insi...
#KustoInsights #KustoQuery #KustoQueryLanguage #KQL #MicrosoftSecurity
Created a #KQL hunting query to list the initial LDAPNightmare exploit (CVE-2024-49113) connection. With this, you can hunt for both successful and failed exploitation attempts 🏹
github.com/Bert-JanP/Hu...
A new tradition has been born, the yearly KQL Community Sources list for 2025 has been published!
Happy hunting this year! 🏹
kqlquery.com/posts/kql-so...
That deployment pipeline is not finished yet :D
It has been a good day. 😅
Az.SecurityInsights.internal\New-AzSentinelAlertRule : The maximum number of enabled Scheduled analytics rules (512)
learn.microsoft.com/en-us/azure/...
NEW BLOG! 🚨
IOC hunting at scale using externaldata().
The blog includes queries for:
- Suspicious NamedPipes
- Tor connections
- Active CISA KEV vulnerabilities
- MISP Feeds
kqlquery.com/posts/extern...
1. github.com/Bert-JanP/Hu...
2. github.com/Bert-JanP/Hu...
3. github.com/Bert-JanP/Hu...
4. github.com/Bert-JanP/Hu...
Latest #KQL additions:
1, Supisicous Named Piped Event
2. CISA Known Exploited Vulnerabilities Visualization
3. Large Number of Analytics Rules Deleted
4. Inbound Authentication From Public IP
Individual links in 🧵
github.com/Bert-JanP/Hu...
Anyone already seen the column ThreatClassification land in their tenant? The column will be added to the EmailEvents table.
Source: techcommunity.microsoft.com/blog/microso...
Time to get a #KQL query from the shelve: Potential Adversary in the middle Phishing
If you have High-Risk users and axios useragents in the results please revoke some sessions.
🏹 github.com/Bert-JanP/Hu...
Query is available for both SigninLogs and AADSignInEventsBeta.
