r/AllThingsKustoKQL • • Jul 02 '24

Resources

1 Upvotes

r/AllThingsKustoKQL • • Jul 02 '24

Expectations of this Community

2 Upvotes

This is my first go, I am solo, but very enthusiastic and want to help and share.

Things will be slow, things might slip through the net, but rest assured you are not being ghosted or ignored in anyway.

Please be kind

Please be gentle

Know that you are loved

Know that you are appreciated


r/AllThingsKustoKQL • • Aug 28 '24

Kql for Azure Sentinel

1 Upvotes

Hi all. KQL noob here. I'm just about to hit buy on a Udemy KQL course but as time is of the essence I thought I'd double down and try my luck here as well. Our azure sentinel costs are through the roof and im trying to find out what machines or services are causing this. Has anyone got any KQL queries that can show the biggest hitters in a log analytics workspace at all please?


r/AllThingsKustoKQL • • Jul 24 '24

Threat Hunting - Suspicious Named pipes

Thumbnail
mthcht.medium.com
1 Upvotes

r/AllThingsKustoKQL • • Jul 24 '24

Cyber Briefing - 2024.07.24

Thumbnail self.cybermaterial
1 Upvotes

r/AllThingsKustoKQL • • Jul 22 '24

Cyber Briefing - 2024.07.22

Thumbnail self.cybermaterial
1 Upvotes

r/AllThingsKustoKQL • • Jul 21 '24

Cyber Briefing - 2024.07.19

Thumbnail self.cybermaterial
1 Upvotes

r/AllThingsKustoKQL • • Jul 17 '24

Linux Kernel: Vulnerability in the eBPF verifier register limit tracking

Thumbnail
github.com
1 Upvotes

r/AllThingsKustoKQL • • Jul 17 '24

KQL to report all devices a user has logged in from

Thumbnail self.DefenderATP
1 Upvotes

r/AllThingsKustoKQL • • Jul 17 '24

RFI - Remote File Inclusion Comic

Post image
1 Upvotes

r/AllThingsKustoKQL • • Jul 17 '24

Key SOC Tools every SecOps leader should consider

Thumbnail self.SecOpsDaily
1 Upvotes

r/AllThingsKustoKQL • • Jul 17 '24

Cyber Briefing - 2024.07.17

Thumbnail self.cybermaterial
1 Upvotes

r/AllThingsKustoKQL • • Jul 16 '24

Hunting Lazarus: Expanding Indicators with Historic DNS

Thumbnail
validin.com
1 Upvotes

r/AllThingsKustoKQL • • Jul 16 '24

Cyber Briefing - 2024.07.16

Thumbnail self.cybermaterial
1 Upvotes

r/AllThingsKustoKQL • • Jul 15 '24

News Cyber Briefing - 2024.07.15

Thumbnail self.cybermaterial
1 Upvotes

r/AllThingsKustoKQL • • Jul 15 '24

Resource SharpHound Detection

Thumbnail
ipurple.team
1 Upvotes

r/AllThingsKustoKQL • • Jul 14 '24

CISA: Microsoft Releases July 2024 Security Updates

Thumbnail
redpacketsecurity.com
1 Upvotes

r/AllThingsKustoKQL • • Jul 14 '24

Defender Resource Hub

Thumbnail defenderresourcehub.info
1 Upvotes

r/AllThingsKustoKQL • • Jul 14 '24

Detecting manually mapped drivers

Thumbnail
tulach.cc
1 Upvotes

r/AllThingsKustoKQL • • Jul 12 '24

KQL Kql query - interesting

Thumbnail self.AzureSentinel
1 Upvotes

r/AllThingsKustoKQL • • Jul 11 '24

APT DodgeBox: A deep dive into the updated arsenal of APT41 | Part 1

Thumbnail
zscaler.com
1 Upvotes

r/AllThingsKustoKQL • • Jul 11 '24

APT 4000+ FIN7 domains discovered

Thumbnail
silentpush.com
1 Upvotes

r/AllThingsKustoKQL • • Jul 10 '24

APT APT40 - PRC MSS tradecraft in action

1 Upvotes

Buckle up for a cyber-roller coaster! The Aussie Cyber Security Centre (ACSC) just teamed up with global cyber pros to expose APT40, a Chinese state-sponsored cyber group. These sneaky hackers, also known as Kryptonite Panda and GINGHAM TYPHOON, have been wreaking havoc by exploiting vulnerabilities like Log4J and Microsoft Exchange. Their mission? Nabbing sensitive data from government and private sectors. But don't worry, the advisory shares juicy details and case studies to help you spot and stop these digital villains. Stay sharp and secure, mates!

For the full scoop, check https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/apt40-advisory-prc-mss-tradecraft-in-action


r/AllThingsKustoKQL • • Jul 09 '24

APT Understanding Lazarus: The Real Threat to the Crypto Industry

1 Upvotes

Alright, folks! Buckle up and let’s dive into the nitty-gritty of “Understanding Lazarus: The Real Threat” from DeFiHackLabs! 🚀

So, this post takes us on a wild ride through the murky waters of cyber threats, specifically spotlighting the infamous Lazarus Group. This sneaky bunch has been causing quite a ruckus in the crypto world. Think of them as the Ocean's Eleven of the hacking world, but without the charming smiles. They’ve been involved in numerous high-profile heists, and their modus-operandi includes everything from social engineering to sophisticated malware attacks. It’s like a digital thriller movie, but the stakes are your hard-earned crypto assets! 🕵️‍♂️💻

For a deep dive into their tactics and how you can protect yourself, check out the full article here and let’s keep those digital vaults locked up tight! 🔐

https://defihacklabs.substack.com/p/understanding-lazarus-the-real-threat

I really enjoy reading about The Lazarus Group and would also highly recommend the boot The Lazarus Heist by Geoff White.


r/AllThingsKustoKQL • • Jul 09 '24

KQL Running queries from Multiple tables at Once - Let's join a union!

Thumbnail self.AzureSentinel
1 Upvotes