Are you joining The KQL Cafe (@kqlcafe.bsky.social) next week? I will be talking about #KQL, Logic Apps, APIs and a combination of the three during the session. Interested? Register here: www.meetup.com/kql-cafe/eve... 📅 When: April 29 18:00 - 19:30 (CET) 🖥️ Where: Online 💰 Cost: Free of charge

KQL Cafe - April 2025, Tue, Apr 29, 2025, 6:00 PM | Meetup

Hi Kusto Fans, Another month another [KQL Cafe](https://kqlcafe.com/#upcoming-shows) session. As usual we cover what is new in KQL and what we did with KQL in the last mont

meetup.com

Microsoft announced the public preview of the OAuthAppInfo table in the Advanced Hunting schema. I created multiple #KQL queries to help you kick-start the usage of this table.🚀 The queries help you to identify high-permissive, unused and external apps. github.com/Bert-JanP/Hu...

Hunting-Queries-Detection-Rules/Defender For Cloud Apps/OAuthAppInfo at main · Bert-JanP/Hunting-Queries-Detection-Rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules. ...

github.com

#100DaysOfKQL Day 100 - CScript.exe, WScript.exe or MSHTA.exe Executed from Web Browser Process IT'S FINALLY OVER! I had another query in store for today, but I feel like this challenge wouldn't be complete without that one. (cont) t.co/lwO1hmrqUk

Pushed a #KQL that returns the top 10 SecurityEvents with the largest ingestion size. This can help determine which events you may want to aggregate or filter, depending on your detection/forensic needs. github.com/Bert-JanP/Hu...

It's time to prepare some content for the next @kqlcafe.bsky.social . I will discuss #KQL, Logic Apps and hunting through the available APIs. The session is on April 29th and is completely free to attend online. 🗓️Event registration & details: www.meetup.com/kql-cafe/

On my way to #ELDK2025 🇩🇰 First stop Hamburg! 🇩🇪

🛡️Released DFIR PowerShell V3! New features include: - Granular response capabilities for Acquisition, Analysis, and Containment - Expanded support beyond Windows, enabling Cloud response activities via Graph API github.com/Bert-JanP/In...

GitHub - Bert-JanP/Incident-Response-Powershell: PowerShell Digital Forensics & Incident Response Scripts.

PowerShell Digital Forensics & Incident Response Scripts. - Bert-JanP/Incident-Response-Powershell

github.com

Pushed a #KQL for: Successful device code sign-in from an unmanaged device. Query is available for AADSignInEventsBeta and SigninLogs. Less known is the AADSignInEventsBeta filter for device code: | where EndpointCall == "Cmsi:Cmsi" 🏹Query: github.com/Bert-JanP/Hu...

If your company runs Exchange Online and/or Microsoft 365 have a look at CISA's latest publication: Microsoft Expanded Cloud Logs Implementation Playbook. The report includes KQL, SPL and Powershell code to perform incident response. www.cisa.gov/resources-to...

These two mails keep providing great value to list new actions found in a tenant. Very useful to find new detection & hunting potential, anomalies or just to understand your data better. I will probably write a small blog about the topic soon. Deployment: github.com/Bert-JanP/Se...

📬 Have you checked latest Kusto Insights by @ugurkoc.de & @bertjancyber.bsky.social 🗓 December update is available now kustoinsights.substack.com/p/kusto-insi... #KustoInsights #KustoQuery #KustoQueryLanguage #KQL #MicrosoftSecurity

Created a #KQL hunting query to list the initial LDAPNightmare exploit (CVE-2024-49113) connection. With this, you can hunt for both successful and failed exploitation attempts 🏹 github.com/Bert-JanP/Hu...

A new tradition has been born, the yearly KQL Community Sources list for 2025 has been published! Happy hunting this year! 🏹 kqlquery.com/posts/kql-so...

It has been a good day. 😅 Az.SecurityInsights.internal\New-AzSentinelAlertRule : The maximum number of enabled Scheduled analytics rules (512) learn.microsoft.com/en-us/azure/...

NEW BLOG! 🚨 IOC hunting at scale using externaldata(). The blog includes queries for: - Suspicious NamedPipes - Tor connections - Active CISA KEV vulnerabilities - MISP Feeds kqlquery.com/posts/extern...

Latest #KQL additions: 1, Supisicous Named Piped Event 2. CISA Known Exploited Vulnerabilities Visualization 3. Large Number of Analytics Rules Deleted 4. Inbound Authentication From Public IP Individual links in 🧵 github.com/Bert-JanP/Hu...

GitHub - Bert-JanP/Hunting-Queries-Detection-Rules: KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom...

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules. ...

github.com

Pushed some new VPN and TOR feeds to the list. github.com/Bert-JanP/Op...

GitHub - Bert-JanP/Open-Source-Threat-Intel-Feeds: This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such ...

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash. - Bert-JanP/Open-Sourc...

github.com

Anyone already seen the column ThreatClassification land in their tenant? The column will be added to the EmailEvents table. Source: techcommunity.microsoft.com/blog/microso...

It is time for the monthly Kusto Insights newsletter! 📰 open.substack.com/pub/kustoins...

Kusto Insights - November Update

Welcome to a new Monthly Update.

open.substack.com

Time to get a #KQL query from the shelve: Potential Adversary in the middle Phishing If you have High-Risk users and axios useragents in the results please revoke some sessions. 🏹 github.com/Bert-JanP/Hu... Query is available for both SigninLogs and AADSignInEventsBeta.

BleepingComputer@bleepingcomputer.com · 2y ago

A new phishing-as-a-service (PhaaS) platform named 'Rockstar 2FA' has emerged, facilitating large-scale adversary-in-the-middle (AiTM) attacks to steal Microsoft 365 credentials. www.bleepingcomputer.com/news/securit...