Hunting-Queries-Detection-Rules

KQL Sentinel & Defender 쿼리 KQL for Defender XDR, Microsoft Sentinel 및 기타 Microsoft 솔루션 이 저장소의 목적은 누구나 사용할 수 있고 이해할 수 있는 KQL 쿼리를 공유하는 것입니다. 이 쿼리들은 Microsoft 보안 제품의 로그를 통해 탐지 범위를 늘리기 위한 것입니다. 모든 의심스러운 활동이 기본적으로 경고를 생성하는 것은 아니지만, 이러한 활동 중 많은 부분이 로그를 통해 탐지 가능하게 만들 수 있습니다. 이 쿼리에는 탐지 규칙, 헌팅 쿼리, 보안 설정 오...

Threat-Hunting

위협 헌팅 | 탐지 엔지니어링 위협 헌팅 및 탐지 쿼리 모음: CrowdStrike Falcon CQL – CrowdStrike Query Language 사용 Microsoft Defender XDR KQL – Kusto Query Language 사용 의심스러운 프로세스, 비정상적인 네트워크 동작, LoLBinsLiving-off-the-Land 바이너리, 지속성 메커니즘, 자격 증명 액세스, 측면 이동, C2 활동, 잠재적 APT 행위를 표면화하는 것을 목표로 합니다. 가능한 경우 모든 내용은 MITRE ATT &CK 기...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering 私が運用しているライブなMicrosoft SentinelおよびDefender XDR環境での検出エンジニアリング。9つのカスタム分析ルールが3つのプレーンにまたがり、それぞれがMITRE ATT&CKにマッピングされ、エンドツーエンドで実証されています。制御されたアクションがルールをトリガーし、ルールがインシデントを生成し、インシデントが調査および文書化されます。7つはAzure コントロールプレーン...

KQL-threat-hunting-queries

KQLクエリを使用した脅威ハンティング/検出 | |/ / | | | | | | | | | / | | | | | | | | | \ | | | | \ | |/ | | ' | | | | | | | | || | | | | / \ | | | || | | | | | | | | | || | | | | . | || | | | | | | !NOTE 1月27日: 約1年間のコントリビューションを経て、このリポジトリは現在のコミュニティの状況に対応し、さらに貢献を続けるためのより良い文脈化を実現するため、大規模な再構築を行っています。...

redsun-bluehammer-undefend-detection-pack

RedSun、BlueHammer、UnDefend、およびCrossFamily検出パック 重要:...

Microsoft named a Leader in the IDC MarketScape for XDR

When cybersecurity stakes are high and complexity is the norm, Microsoft doesn’t just participate, it excels with Microsoft Defender XDR—built to anticipate, disrupt, and outpace modern cyberthreats. We are excited to announce that Microsoft has been named a Leader in the IDC MarketScape: Worldwi...

Unified security operations with Microsoft Sentinel and Microsoft Defender XDR

Numerous cybersecurity tools exist to help organizations protect their data, people, and systems. There are different tools that check emails for phishing attempts, secure infrastructure and cloud, and provide generative AI to detect threats and uplevel response beyond human ability. While each o...

Threat actors misuse OAuth applications to automate financially driven attacks

Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...

Microsoft unpacks comprehensive security at Gartner and Forrester virtual events

Every day, Microsoft is committed to maintaining comprehensive security for all across our interconnected global community. With that purpose in mind, we recently sponsored the 2021 Gartner Security and Risk Summit and 2021 Forester Security and Risk Forum, where we discussed ongoing changes in t...