Discover and read the best of Twitter Threads about #365daysofkql
Most recents (2)
Are you using any of the Microsoft Security products and/or #Sentinel? Then this thread is for you! The best resources for #KQL Advanced Hunting Queries or Analytics rules in my opinion.
#MDE #ThreatHunting #Detection #DFIR
#MDE #ThreatHunting #Detection #DFIR
github.com/reprise99/Sent… by @reprise_99. Awsome source! With the #365daysofkql series a lot of useful queries have been added. The queries are categorized by the different Microsoft products.
github.com/Azure/Azure-Se… by @msftsecurity. A lot of KQL queries can be found here, all of which are categorised on the basis of @MITREattack tactics.
Holiday time and it's been a while since I did one of these. Here goes: a 2021 reading thread with some of my favourite blogs / tools / posts ✨thread✨
Cobalt Strike featured large in 2021 and if you're in the defensive arena, it's a good idea to familiarize yourself.
My colleague @ZephrFish had a great post on CS profiles
◾️blog.zsec.uk/cobalt-strike-…
My colleague @ZephrFish had a great post on CS profiles
◾️blog.zsec.uk/cobalt-strike-…
.@M_haggis also had a fantastic post at the start of the year going over the structure and options contained within CS profiles
◾️haggis-m.medium.com/malleable-c2-p…
◾️haggis-m.medium.com/malleable-c2-p…
