Monitoring Service principal sign-ins with AzureAD and Azure Sentinel

Posted onLeave a comment

Here is a conversation between Jeffrey (Developer) and Marc (IT Admin) working for ECorp Ltd. Looks familiar? Take a look in your Azure Active directory, how many applications do you have there? In an ideal world you maintain an inventory of all these applications somewhere in your asset management database so that you know who is the owner of the Application and what it is used for and what API permissions are granted. As for Read More …

Finding Ignite 2020 and Tech Community video hub content with PowerShell

Posted onLeave a comment

This week at Ignite 2020 Microsoft delivered 811 sessions. Although I did attend several sessions during the live event, I was not able to join all the sessions I wanted to. But luckily most of the sessions are recorded so they can be watched online or if you prefer you can download the video and content. Like every year, Microsoft provides a PowerShell script to download all the content or specific sessions. When you click Read More …

MTP Advanced Hunting – Public free E-Mail services

Posted onLeave a comment

Today I received an e-mail from a customer explaining to me that at times they have false positives with e-mail Impersonation. Depending on your configuration the e-mail will end up being moved to the user’s junk folder or into quarantine. When releasing such a message and have safety tips turned on, you might see the following message at the top of the message. Reading Tip: Protect yourself from phishing schemes and other forms of online Read More …

Hunting for Local Group Membership changes

Posted onLeave a comment

Hello there, A couple of days ago, someone in a forum asked whether it would be possible to detect changes to the local administrator’s group using Microsoft Defender Advanced Threat protection. Before I continue why would you want to monitor such changes? Well here is what comes to my mind: An attacker tries to maintain persistence, creates an account, and adds it to the local administrator’s group. T1136.001 – Create Account: Local Account A user Read More …

Generating Advanced hunting queries with PowerShell

Posted onLeave a comment

I was recently writing some advanced hunting queries for Microsoft Defender ATP to search for the execution of specific PowerShell commands. If you are just looking for one specific command, you can run query as sown below But if you are looking for several functions, then there is going to be a lot of manual editing, and so the idea was born to use PowerShell to help me generate an advanced hunting query. The below Read More …

Defender ATP Advanced hunting with TI from URLhaus

Posted on6 Comments

Hello everyone, in today’s article we are going to take look at how we can use Threat Intelligence (TI) data from URLhaus with Microsoft Defender ATP advanced hunting. URLhaus URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution. https://urlhaus.abuse.ch/ The project provides several ways to find and retrieve information about malware URLs. You can browse the URL database interactively through https://urlhaus.abuse.ch/browse/ You can also Read More …

Managing Time Zone and Date formats in Microsoft Defender Security Center

Posted onLeave a comment

When you receive security alerts or are investigating security related events , the aspect of time is important element. By default, date and time is displayed in Coordinated Universal Time (UTC) within the Microsoft Defender security center portal. In todays’ blog post, I want to provide you with some insights and tips how to manage Timezone and the date time format within the Microsoft Defender security center. Time zones You can use the Time zone Read More …

Advance your Microsoft Defender ATP hunting skills using the Atomic execution framework

Posted on1 Comment

Hello everyone, during the past months I took a closer look at MITRE ATT&CK to advance my hunting skills using Microsoft Defender Advanced Threat Protection. For those not familiar with MITRE ATT&CK, in short, it is a knowledge base knowledge base of adversary tactics and techniques based on real-world observations. To familiarize myself with MITRE ATT&CK, I first started reading through all the tactics and techniques, to be honest while reading, I often couldn’t resists Read More …

Meet the new Microsoft Defender ATP evaluation lab

Posted onLeave a comment

This week Hadar Feldmann, senior program manager and security researcher at Microsoft announced the public preview of the new Microsoft Defender ATP evaluation lab that now includes two attack simulation solutions from AttackIQ and SafeBreach. The term ‘evaluation’ might indicate that the lab is only intended for new customers hat are in the process of evaluating Microsoft Defender ATP, but that’s not the case, personally I think that it is also a perfect playground for Read More …

Windows 10 2004 – What is new in the Windows Security App

Posted onLeave a comment

When all goes well, Microsoft will soon release the next version of Windows 10 aka as Windows 10 2004. I am an active Windows Insider user and noticed a few little changes within the Windows 10 Security App that I think are worth sharing. I used the following Windows 10 builds to identify changes, new features: Windows 10, 1909, Version 10.0.18363.836 Windows 10, 2004, Version 10.0.19628.1 Windows Security App Icon First thing you will notice Read More …