List Untrusted SSH File Transfer Protocol Connection Not Blocked By Symantec Endpoint Protection
Description This KQL query lists all untrusted SSH file transfer protocol connection events that Symantec Endpoint Protection detected but did
Read More
Saturday, May 17, 2025
Build+Break+Secure
Learn by building. Master by breaking. Secure by obsession.
Build+Break+Secure
Learn by building. Master by breaking. Secure by obsession.
Author: Wayne Andes
List P2P Torrent Traffic Not Blocked By Symantec Endpoint Protection
Description This KQL query lists all P2P torrent traffic events that Symantec Endpoint Protection detected but did not block and
Read More
NBI Data Breach Exposes Millions of Filipino Records
MANILA, PHILIPPINES —The National Bureau of Investigation (NBI), the Philippines’ premier investigative agency, has suffered a major cybersecurity breach that
Read MoreList Generic Directory Traversal Not Blocked By Symantec Endpoint Protection
Description This KQL query lists all suspicious general directory traversal events that Symantec Endpoint Protection detected but did not block
Read MoreList Tamper Protection Alert Triggered By VMware Carbon Black App Control
Description This KQL query looks for where Tamper Protection is detected by VMware Carbon Black App Control. Query Microsoft Sentinel
Read MoreList Suspicious Process Accessing A Website Not Blocked By Symantec Endpoint Protection
Description This query lists all suspicious process accessing a website events that Symantec Endpoint Protection detected but did not block
Read MoreList Banned File Written To Computer Detected By VMware Carbon Black App Control
Description This KQL query identifies banned files written to computer detected by VMware Carbon Black App Control. Risk An adversary
Read MoreList Suspicious File Found By VMware Carbon Black App Control
Description This KQL query identifies potential risky files that were detected by VMware Carbon Black App Control. Risk An adversary
Read MoreList Malicious File Found By VMware Carbon Black App Control
Description This KQL query identifies malicious files that were detected by VMware Carbon Black App Control. Risk An adversary may
Read More