DEFCON-KQL-KUNG-FU-22

DEFCON-KQL-KUNG-FU-22 Mi presentación del taller KQL Kung Fu del Cloud Village del DEFCON30 se encuentra aquí: DEFCON30-KQL-Kung-Fu.pdf Si quieres practicar tus habilidades con KQL, visita este Log Analytics Workspace, mantenido por Microsoft y repleto de datos de registro: aka.ms/lademo...

Sentinel-Queries

KQL para Microsoft Sentinel Algunos consejos, trucos y ejemplos para usar KQL con Microsoft Sentinel. 1. Introducción 2. La anatomía de una consulta KQL 3. Los fundamentos 1. Fundamentos de tiempo 2. Fundamentos de Where 3. Fundamentos de Project 4. Fundamentos de Summarize 5. Fundamentos de Rend...

Sentinel-GPT

Sentinel-GPT：用于威胁狩猎的智能AI代理 🛡️ 一个自动化网络安全流水线，利用基于LLM的推理将原始Azure日志转化为可执行情报。 📖 概述 Sentinel-GPT 是一个专为网络安全威胁狩猎设计的AI代理。它与Azure Log Analytics工作区（日志生成源）以及OpenAI的ChatGPT API（该代理的大脑）相集成。我们将日志提供给经过训练的代理，使其能够识别可疑活动、搜索威胁、向用户发出警报，同时提供修复步骤。 ⚠️ 问题与解决方案 问题：...

hays-london-azure-platform-2-poc

Hays London Azure Platform Engineer POC — AKS Operations & Pla...

CVE-2025-55321 Azure Monitor Log Analytics Spoofing Vulnerability

...

CVE-2025-55321 Azure Monitor Log Analytics Spoofing Vulnerability

...

Azure Monitor Log Analytics Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Monitor allows an unauthorized attacker to perform spoofing over a network...

KLA89197 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Entra ID can be exploited remotely to gain privilege...

security-analytics

This repository is a community-driven set of security analytics for auditing cloud usage and detecting threats to data & workloads in Google Cloud. It provides a list of sample security analytics for auditing cloud usage and detecting threats, which may assist detection engineers, threat hunters,...

threat-detection-as-code

This repository is a community-driven set of security analytics for auditing cloud usage and detecting threats to data & workloads in Google Cloud. It provides a list of sample security analytics for auditing cloud usage and for detecting threats to your data & workloads in Google Cloud. The...

AI-Driven IRM: Transforming Insider Risk Management with Adaptive Scoring and LLM-Based Threat Detection

Insider threats pose a significant challenge to organizational security, often evading traditional rule-based detection systems due to their subtlety and contextual nature. This paper presents an AI-powered Insider Risk Management IRM system that integrates behavioral analytics, dynamic risk...

KLA65131 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Data Studio can be exploited...

Microsoft Open Management Infrastructure Security Vulnerability

Microsoft Open Management Infrastructure is a free, open source Common Information Model CIM management server from Microsoft. A security vulnerability exists in Microsoft Open Management Infrastructure. An attacker could exploit this vulnerability to gain elevated privileges. The following...

PurpleKeep - Providing Azure Pipelines To Create An Infrastructure And Run Atomic Tests

With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs Endpoint Detection and Response and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually re-running...

Azure Serial Console Attack and Defense - Part 2

This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines. While the first blog post discussed various tracing activities, such as using Azure activit...

Microsoft Azure 安全漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Azure. The following products and versions are affected: Azure Automation State Configuration, DSC Extension, Azure...

Exploit for CVE-2021-38647

OMIGOD Proof on Concept Exploit for CVE-2021-38647 OMIGOD F...

KLA12297 Multiple vulnerabilities in Microsoft System Center

Multiple vulnerabilities were found in Microsoft System Center. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Open Management...

Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft

Last month, we introduced the SimuLand project to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of th...

Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft

Last month, we introduced the SimuLand project to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of th...