ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs

cyb3rmik3.bsky.social

17 June 2025 19:48

April's Kusto Insights newsletter curated by @ugurkoc.de & @bertjancyber.bsky.social just dropped! 🔗 kustoinsights.substack.com/p/kusto-insi... #MicrosoftSecurity #MicrosoftDefender #MicrosoftSentinel #KustoQuery #KQL #KustoQueryLanguage

securityaura.bsky.social

13 April 2025 08:01

#100DaysOfKQL Day 100 - CScript.exe, WScript.exe or MSHTA.exe Executed from Web Browser Process IT'S FINALLY OVER! I had another query in store for today, but I feel like this challenge wouldn't be complete without that one. (cont) t.co/lwO1hmrqUk

Fabian Bader

fabian.bader.cloud

01 April 2025 05:11

Now in the official documentation. Session ID was long missing from the Entra Signin Logs outside of XDR but since early February 25 we can use it. It already has proven a powerful addition in detecting token theft.

ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs

cyb3rmik3.bsky.social

31 March 2025 18:05

Another great newsletter of Kusto Insights curated by @ugurkoc.de and @bertjancyber.bsky.social! Awesome highlighted #KQL query by @robbevddaele.bsky.social. 🔗 kustoinsights.substack.com/p/kusto-insi... #MicrosoftSecurity #MicrosoftDefender #MicrosoftSentinel #KustoQuery

Fabian Bader

fabian.bader.cloud

18 February 2025 17:07

ATM the latter. But since they now have session id there is no big downside