Hunt For Suspicious SMB Sessions
SMB can be used in various ways by attackers, such as accessing remote shares, transfering files, interacting with systems using
Read MoreWhere Every Failure Becomes A Manual
SMB can be used in various ways by attackers, such as accessing remote shares, transfering files, interacting with systems using
Read MoreDescription Collect the top 10 user with the most IP used to successfully sign in to a tenant. This KQL
Read MoreDescription This KQL query can be used to display all Guest users in the tenant who have Azure Active Directory
Read MoreDescription This KQL query lists the incidents that are automatically closed by Microsoft Defender XDR. It is good practice to
Read MoreDescription This KQL query detects successful sign-ins from countries that have not been seen before. Depending on where you run
Read MorePowerShell can be used encoded to obfuscate the commands that have been executed. An attacker can choose encoding to hide
Read MoreThis Threat Hunting case is based on the DeviceNetworkEvents table. The goal is to find malicious HTTP traffic. Step 1:
Read MoreDescription This KQL query identifies the users that are currently at risk. Based on that it performs a lookup on
Read MoreDescription This KQL query can be used to detect rare operating systems that are used to sign into your tenant.
Read More