Are you joining The KQL Cafe (@kqlcafe.bsky.social) next week? I will be talking about #KQL, Logic Apps, APIs and a combination of the three during the session. Interested? Register here: www.meetup.com/kql-cafe/eve... 📅 When: April 29 18:00 - 19:30 (CET) 🖥️ Where: Online 💰 Cost: Free of charge

Microsoft announced the public preview of the OAuthAppInfo table in the Advanced Hunting schema. I created multiple #KQL queries to help you kick-start the usage of this table.🚀 The queries help you to identify high-permissive, unused and external apps. github.com/Bert-JanP/Hu...

#100DaysOfKQL Day 100 - CScript.exe, WScript.exe or MSHTA.exe Executed from Web Browser Process IT'S FINALLY OVER! I had another query in store for today, but I feel like this challenge wouldn't be complete without that one. (cont) t.co/lwO1hmrqUk

Pushed a #KQL that returns the top 10 SecurityEvents with the largest ingestion size. This can help determine which events you may want to aggregate or filter, depending on your detection/forensic needs. github.com/Bert-JanP/Hu...

It's time to prepare some content for the next @kqlcafe.bsky.social . I will discuss #KQL, Logic Apps and hunting through the available APIs. The session is on April 29th and is completely free to attend online. 🗓️Event registration & details: www.meetup.com/kql-cafe/

On my way to #ELDK2025 🇩🇰 First stop Hamburg! 🇩🇪

🛡️Released DFIR PowerShell V3! New features include: - Granular response capabilities for Acquisition, Analysis, and Containment - Expanded support beyond Windows, enabling Cloud response activities via Graph API github.com/Bert-JanP/In...

Pushed a #KQL for: Successful device code sign-in from an unmanaged device. Query is available for AADSignInEventsBeta and SigninLogs. Less known is the AADSignInEventsBeta filter for device code: | where EndpointCall == "Cmsi:Cmsi" 🏹Query: github.com/Bert-JanP/Hu...

If your company runs Exchange Online and/or Microsoft 365 have a look at CISA's latest publication: Microsoft Expanded Cloud Logs Implementation Playbook. The report includes KQL, SPL and Powershell code to perform incident response. www.cisa.gov/resources-to...

These two mails keep providing great value to list new actions found in a tenant. Very useful to find new detection & hunting potential, anomalies or just to understand your data better. I will probably write a small blog about the topic soon. Deployment: github.com/Bert-JanP/Se...

📬 Have you checked latest Kusto Insights by @ugurkoc.de & @bertjancyber.bsky.social 🗓 December update is available now kustoinsights.substack.com/p/kusto-insi... #KustoInsights #KustoQuery #KustoQueryLanguage #KQL #MicrosoftSecurity

Created a #KQL hunting query to list the initial LDAPNightmare exploit (CVE-2024-49113) connection. With this, you can hunt for both successful and failed exploitation attempts 🏹 github.com/Bert-JanP/Hu...

A new tradition has been born, the yearly KQL Community Sources list for 2025 has been published! Happy hunting this year! 🏹 kqlquery.com/posts/kql-so...

It has been a good day. 😅 Az.SecurityInsights.internal\New-AzSentinelAlertRule : The maximum number of enabled Scheduled analytics rules (512) learn.microsoft.com/en-us/azure/...

NEW BLOG! 🚨 IOC hunting at scale using externaldata(). The blog includes queries for: - Suspicious NamedPipes - Tor connections - Active CISA KEV vulnerabilities - MISP Feeds kqlquery.com/posts/extern...

Latest #KQL additions: 1, Supisicous Named Piped Event 2. CISA Known Exploited Vulnerabilities Visualization 3. Large Number of Analytics Rules Deleted 4. Inbound Authentication From Public IP Individual links in 🧵 github.com/Bert-JanP/Hu...

Pushed some new VPN and TOR feeds to the list. github.com/Bert-JanP/Op...

Anyone already seen the column ThreatClassification land in their tenant? The column will be added to the EmailEvents table. Source: techcommunity.microsoft.com/blog/microso...

It is time for the monthly Kusto Insights newsletter! 📰 open.substack.com/pub/kustoins...

Time to get a #KQL query from the shelve: Potential Adversary in the middle Phishing If you have High-Risk users and axios useragents in the results please revoke some sessions. 🏹 github.com/Bert-JanP/Hu... Query is available for both SigninLogs and AADSignInEventsBeta.