Hunting-Queries-Detection-Rules

KQL Sentinel & Defender 쿼리 KQL for Defender XDR, Microsoft Sentinel 및 기타 Microsoft 솔루션 이 저장소의 목적은 누구나 사용할 수 있고 이해할 수 있는 KQL 쿼리를 공유하는 것입니다. 이 쿼리들은 Microsoft 보안 제품의 로그를 통해 탐지 범위를 늘리기 위한 것입니다. 모든 의심스러운 활동이 기본적으로 경고를 생성하는 것은 아니지만, 이러한 활동 중 많은 부분이 로그를 통해 탐지 가능하게 만들 수 있습니다. 이 쿼리에는 탐지 규칙, 헌팅 쿼리, 보안 설정 오...

Azure-Sentinel

Microsoft Sentinel および Microsoft 365 Defender Microsoft Sentinel と Microsoft 365 Defender の統合リポジトリへようこそ！このリポジトリには、すぐに使える検出、探索クエリ、ハンティングクエリ、ブック、プレイブックなどが含まれており、Microsoft Sentinel の導入を迅速に進め、環境を保護して脅威を追跡するためのセキュリティコンテンツを提供します。ハンティングクエリには、Microsoft 365 Defender および Microsoft Sentinel...

KQL-Hunting_and_Detection-Queries

이 저장소에는 README가 없습니다...

Microsoft-Sentinel-SecOps

Microsoft Sentinel - SEC Operations Microsoft Sentinel - SOC Operations へようこそ このリポジトリには、探索、ハンティング、その他のアクティビティ用のクエリを含む、多数のMicrosoft Sentinelコンテンツが含まれています。 リソース ハンティング プロセス セキュリティイベント 更新情報 その他 Elli ShlomoブログのAzure Sentinel記事 貢献について...

Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

In this article 1. Multi-step social engineering campaign leading to credential theft 2. Mitigation and protection guidance 3. Microsoft Defender detections 4. Hunting queries 5. Indicators of compromise Phishing campaigns continue to improve sophistication and refinement in blending social...

Top 10 actions to build agents securely with Microsoft Copilot Studio

Organizations are rapidly adopting Copilot Studio agents, but threat actors are equally fast at exploiting misconfigured AI workflows. Mis-sharing, unsafe orchestration, and weak authentication create new identity and data‑access paths that traditional controls don’t monitor. As AI agents become...

Unmasking Lumma Stealer: Analyzing Deceptive Tactics with Fake CAPTCHA

Summary Lumma Stealer is an information-stealing malware available through a Malware-as-a-Service MaaS. It specializes in stealing sensitive data such as passwords, browser information, and cryptocurrency wallet details. The attacker has advanced its tactics, moving from traditional phishing to...

A closer look at Qakbot’s latest building blocks (and how to knock them down)

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan,...

Email Campaign Spreads StrRAT Fake-Ransomware RAT

An email campaign is delivering a Java-based remote access trojan RAT that can not only steal credentials and take control of systems, but also presents as fake ransomware, Microsoft researchers have discovered. The Microsoft Security Intelligence MSI team has outlined details of a “massive email...

Microsoft open sources CodeQL queries used to hunt for Solorigate activity

A key aspect of the Solorigate attack is the supply chain compromise that allowed the attacker to modify binaries in SolarWinds’ Orion product. These modified binaries were distributed via previously legitimate update channels and allowed the attacker to remotely perform malicious activities, suc...

Collaborative innovation on display in Microsoft’s insider risk management strategy

The disrupted work environment, in which enterprises were forced to find new ways to enable their workforce to work remotely, changed the landscape for operations as well as security. One of the top areas of concern is managing insider risks, a complex undertaking even before the pandemic, and ev...