GHSA-VPHC-468G-8RFP Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

Summary adx-mcp-server ListDictstr, Any: client = getkustoclient query = f"tablename | getschema" ListDictstr, Any: client = getkustoclient query = f"tablename | sample samplesize" ListDictstr, Any: client = getkustoclient query = f".show table tablename details" -- KQL injection resultset =...

Azure Data Explorer MCP Server 安全漏洞

The Azure Data Explorer MCP Server is a connection protocol server developed by Pavel Shklovsky, designed to connect AI assistants with data warehouses. Versions of the Azure Data Explorer MCP Server prior to 0.1.1 contain security vulnerabilities. These vulnerabilities stem from the tablename...

Malicious code in kusto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0bdb202529b567cdcf3b62e44352186db2cb5defbfbfec0e7646a684838e08d7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Towards Small Language Models for Security Query Generation in SOC Workflows

Analysts in Security Operations Centers routinely query massive telemetry streams using Kusto Query Language KQL. Writing correct KQL requires specialized expertise, and this dependency creates a bottleneck as security teams scale. This paper investigates whether Small Language Models SLMs can...

Malicious code in sqltools-kusto-driver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b4f7793f8ffb915758717bd05607ceb0b5f0d1525a564240e518e4191985f95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5796 Malicious code in sqltools-kusto-driver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b4f7793f8ffb915758717bd05607ceb0b5f0d1525a564240e518e4191985f95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Forrester names Microsoft a Leader in Q4 2022 Security Analytics Platforms Wave report

We’re excited to announce that Microsoft is named a Leader in The Forrester Wave: Security Analytics Platforms, Q4 2022. Microsoft achieved the highest possible score in 17 different criteria, including partner ecosystem, innovation roadmap, product security, case management, and architecture. Wi...

Malicious code in kusto-language-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50438481771fe83b3b502f836090be4febbacac36a79107fbf1c726b16e1cb19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4240 Malicious code in kusto-language-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50438481771fe83b3b502f836090be4febbacac36a79107fbf1c726b16e1cb19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Sentinel-Attack - Tools To Rapidly Deploy A Threat Hunting Capability On Azure Sentinel That Leverages Sysmon And MITRE ATT&CK

Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel. DISCLAIMER: This tool requires tuning and investigative trialling to be truly effective in a production environment. Overview Sentinel ATT&CK provides the...

Migrating content from traditional SIEMs to Azure Sentinel

In part two of this three-part series, we covered the five types of side-by-side security information and event management SIEM configurations commonly used during a long-term migration to Microsoft Azure Sentinel. For part three, we’ll be looking at best practices for migrating your data and...