Threat Hunting
Building Your First Threat Hunting Hypothesis (The MITRE Way)
All right class.
Lots of SOC teams say they do threat hunting. What they actually do is run a couple of saved KQL queries on a Friday afternoon
Topic
KQL
KQL you can actually run in Microsoft Sentinel and Defender Advanced Hunting, from beginner basics to detections, hunting queries and investigations.
67 posts
Threat Hunting
Building Your First Threat Hunting Hypothesis (The MITRE Way)
All right class.
Lots of SOC teams say they do threat hunting. What they actually do is run a couple of saved KQL queries on a Friday afternoon
Microsoft Sentinel
Azure Key Vault: The High-Value Queries Your SOC Isn't Running
All right class.
Key Vault is where your secrets live. Connection strings, API keys, certificates, encryption keys, service account credentials. If an attacker gets into your environment and
KQL
Hunting PowerShell Abuse in MDE: Eight Queries, Real Results
All right class
PowerShell is in every serious Windows intrusion. Not because attackers are creative, but because it works, it's already there, and it leaves just
Microsoft Sentinel
Your Sentinel Detection Setup Is Probably Broken. Here's How to Know.
All right class
Most environments running Sentinel today have the same problem. The toggle is on. Rules are firing. UEBA is enabled. And nobody trusts any of it.
Defender XDR
Defender XDR Incident Investigation: A to Z Using a Real Example
All right class.
There are a few ways you end up staring at an incident queue with no idea what to do with it.
Operation Silent Ledger: SOC
KQL
Conditional Access Health Check: What Your Policies Actually Do
All right class.
This is highly technical post referencing KQL logic and my own (which is even worse than KQL), feel free to skip to the end for
Detection Engineering
Detection Engineering and Why It's a Must Have Part 2
All right class
This is a continuation of part 1 that you can find here.
Detection Engineering: Why Your SIEM Won’t Save YouDetection engineering bridges the gap
Microsoft Sentinel
Detection Engineering and Why It's a Must Have
Why Your SIEM Won't Save You Without It
All right class
I've seen people think that you can just turn on Microsoft Sentinel, wiring
Microsoft Sentinel
Why KQL Enrichment Actually Works (And Why Your Alerts Are So Much Better With It)
All right class.
You run an analytic rule. It fires (duh). Your SOC analyst opens the incident. They see a CallerIpAddress, a Caller name, and OperationNameValue. Then what?
Microsoft Sentinel
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds
All right class.
This is the workbook I wish people would build once, instead of recreating the same “user activity timeline” from scratch every time HR/Legal comes
SOC
KQL User Audit Playbook V2: The Insider Threat Investigation Guide
All right class.
This is a continuation of my previous lesson, which contains useful queries for insider risk hunting. Make sure to read it first, as it may
Microsoft Sentinel
Teams Threat Protection: What Actually Changed and What You Can Actually Hunt
All right class
Your SOC has limited visibility into Teams. Attackers run credential theft campaigns in chat. You see some of it through audit logs if you'
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.