Light

cyb3r-monk / threat-hunting-and-detection Goto Github PK

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

License: BSD 3-Clause "New" or "Revised" License

Jupyter Notebook 100.00%

threat-hunting threat-detection cybersecurity defender-for-endpoint detection-engineering dfir kql kusto-language microsoft-sentinel

threat-hunting-and-detection's Introduction

Threat Hunting and Detection

Repository for threat hunting and detection queries, tools, etc.

Learn Kusto Query Language (KQL)

If you want to elevate your threat hunting, detection engineering, and incident response skills using KQL, check out my KQL courses!

Warning!

Whatever you use from the repository, double check its correctness, test it in your environment. Please, DO NOT just copy and paste.

Presenting it as your own is illegal and forbidden. Apart from that, you can use the content anyway you like with a reference to @Cyb3rMonk (Twitter) or Cyb3r-Monk (Github). It is much appreciated.

Want to Support?

If you like my work, have benefited from it, and want to show appreciation, pay it forward

threat-hunting-and-detection's People

Contributors

Stargazers

Watchers

Forkers

reverse-ex hatchetxuexi superqcheng materaj2 payaljaiswani pabit mendedsiren63 uionto beahunt3r zha0 blue-infosec 5l1v3r1 invokethreatguy lhaizhu darioongit pinkuto fxcebx secwin idsdarg defendingenterprises aben1979 mbunde superuser5 leidy-tector cyb3rid10ts thebigplate fr0gger tekkeedi3 lovidad cybersecops star-dot-star darksidesfear zicreamz poruchikrj jitmun 5m7x kraken8585 anhnh121 jkb-s stayingahead mavjs atdavidpark liujie40 farid-feyzi fabiomb17 davidedg 10000tigers zorroroot bijaysenihang randomsecman jawczan bigbrobro loggarfve data-gami catcheryp fengjixuchui sulaimanzai hitch5874 rafiq0007 thantzinbluethings mellonaut blu3r4z0r benabraha chelsea-limboy fairhopeweb knightz1 irfan0113 alexmon0 blue-infosec vitorribeirof psdb1337 kprasad-143 mondogenerate exe-keppler ethicalsecurity-agency zpaav raystyle c0unt1ngst4rs pxsekar kernelcaleb orotalt mgstate professorkilo chanpu9 cyb3rwarri0r theomilan3 msalikoc visioninhope

threat-hunting-and-detection's Issues

DCs(must be FQDN of the DCs)

Hi,

are you sure about this statement?
[...]
DCs(must be FQDN of the DCs)
[...]

in the EventID 4768 i saw all the time the NetBiosName with the $

when you compare computer list with the DCs, it works because the format is FQDN with FQDN
| where Computer in~ (DCs)

but when you do the DCs (FQDN ) compare with TargetUserName(NetBiosName) it shouldn't work
| where DCs has replace_string(TargetUserName,"$","")

also, because i think it is impossible to have the $ in TargetUserName with the FDQN format:

yourdc1.yourdomain.local$
yourdc1$.yourdomain.local

DLL Hijacking clarification

On DLL Hijacking - HijackLibs.md you extend DLLDir from tolower(InitiatingProcessFileName).

I was expecting it to be something like tolower(FolderPath). Am I missing something?

Thanks in advance!

requirements

What would the requirements be for this query to work and where can I run it?

New Expected Path

Hello, I believe this path %system32%\wbem should be added as Expected Location for both DLLs. Seem false positives:
wbemprox.dll
wbemsvc.dll

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.