Sentinel-Queries

KQL per Microsoft Sentinel Alcuni suggerimenti, trucchi ed esempi per l'uso di KQL con Microsoft Sentinel. 1. Introduzione 2. L'anatomia di una query KQL 3. Le basi 1. Nozioni di base sul tempo 2. Nozioni di base su Where 3. Nozioni di base su Project 4. Nozioni di base su Summarize 5. Nozioni di...

Sentinel-GPT

Sentinel-GPT: Agentische KI für die Bedrohungssuche 🛡️ Eine automatisierte Cybersicherheits-Pipeline, die rohe Azure-Protokolle mithilfe von LLM-basiertem Denken in umsetzbare Erkenntnisse umwandelt. 📖 Übersicht Sentinel-GPT ist ein KI-Agent, der auf die Bedrohungssuche in der Cybersicherheit...

DEFCON-KQL-KUNG-FU-22

DEFCON-KQL-KUNG-FU-22 Meine DEFCON30 Cloud Village KQL Kung Fu Workshop-Foliensammlung befindet sich hier: DEFCON30-KQL-Kung-Fu.pdf Wenn du deine KQL-Fähigkeiten üben möchtest, besuche diesen Log Analytics-Arbeitsbereich, der von Microsoft mit einer Menge Logdaten gepflegt wird: aka.ms/lademo...

hays-london-azure-platform-2-poc

Hays London Azure Platform Engineer POC — AKS Operations & Pla...

CVE-2025-55321 Azure Monitor Log Analytics Spoofing Vulnerability

...

CVE-2025-55321 Azure Monitor Log Analytics Spoofing Vulnerability

...

Azure Monitor Log Analytics Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Monitor allows an unauthorized attacker to perform spoofing over a network...

KLA89197 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Entra ID can be exploited remotely to gain privilege...

security-analytics

This repository is a community-driven set of security analytics for auditing cloud usage and detecting threats to data & workloads in Google Cloud. It provides a list of sample security analytics for auditing cloud usage and detecting threats, which may assist detection engineers, threat hunters,...

threat-detection-as-code

This repository is a community-driven set of security analytics for auditing cloud usage and detecting threats to data & workloads in Google Cloud. It provides a list of sample security analytics for auditing cloud usage and for detecting threats to your data & workloads in Google Cloud. The...

AI-Driven IRM: Transforming Insider Risk Management with Adaptive Scoring and LLM-Based Threat Detection

Insider threats pose a significant challenge to organizational security, often evading traditional rule-based detection systems due to their subtlety and contextual nature. This paper presents an AI-powered Insider Risk Management IRM system that integrates behavioral analytics, dynamic risk...

KLA65131 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Data Studio can be exploited...

Microsoft Open Management Infrastructure Security Vulnerability

Microsoft Open Management Infrastructure is a free, open source Common Information Model CIM management server from Microsoft. A security vulnerability exists in Microsoft Open Management Infrastructure. An attacker could exploit this vulnerability to gain elevated privileges. The following...

PurpleKeep - Providing Azure Pipelines To Create An Infrastructure And Run Atomic Tests

With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs Endpoint Detection and Response and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually re-running...

Azure Serial Console Attack and Defense - Part 2

This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines. While the first blog post discussed various tracing activities, such as using Azure activit...

Microsoft Azure 安全漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Azure. The following products and versions are affected: Azure Automation State Configuration, DSC Extension, Azure...

Exploit for CVE-2021-38647

OMIGOD Proof on Concept Exploit for CVE-2021-38647 OMIGOD F...

KLA12297 Multiple vulnerabilities in Microsoft System Center

Multiple vulnerabilities were found in Microsoft System Center. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Open Management...

Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft

Last month, we introduced the SimuLand project to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of th...

Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft

Last month, we introduced the SimuLand project to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of th...