🔥 #BlackFriday discounts are live🔥 ➤ 35% OFF all #KQL courses for threat hunting, detection engineering, and incident response. #ThreatHunting #DetectionEngineering #DFIR #incidentresponse #CyberSecurity #InfoSec 👉academy.bluraven.io/blackfriday2...

🔥 #BlackFriday discounts are live🔥 ➤ 35% OFF all #KQL courses for threat hunting, detection engineering, and incident response. #ThreatHunting #DetectionEngineering #DFIR #incidentresponse #CyberSecurity #InfoSec 👉academy.bluraven.io/blackfriday2...

Check out my new blog on nested app authentication.

🛑 Azure Resource Graph limits number of results to 1000 when queried from Sentinel or Defender XDR using KQL. There is a little trick that lets you bypass these limits.🤓 🔗 academy.bluraven.io/blog/queryin... #KQL #MicrosoftSentinel #AzureResourceGraph #DefenderXDR

Hello, friends! I'm thrilled to announce that The Homelab Almanac, v3.0 has officially launched! There is a **ton** of new stuff in this version, including: - Proper DNS - PKI - Automatic signed certificates - New secrets management - Proxmox clustering - Cloud integration

🚨 BadSuccessor = Bad OPSEC With the right audit config, it's pretty easy to detect BadSuccessor. academy.bluraven.io/blog/detecti... #ThreatHunting #DetectionEngineering #ThreatDetection #BadSuccessor

This blog is a little bitter, but it's what it is🫠 academy.bluraven.io/blog/detecti... #ThreatHunting #DetectionEngineering

This blog is a little bitter, but it's what it is🫠 academy.bluraven.io/blog/detecti... #ThreatHunting #DetectionEngineering

🚨 Test your Lateral Movement investigation skills! We have just added a new challenge to our FREE "Hands-On Introduction to KQL for Security Analysis" course! You can even test your AI agents' skills 😉 #KQL #Kusto #MicrosoftSentinel #MicrosoftDefender academy.bluraven.io/course/intro...

🐣 HAPPY EASTER CAPSTONE! 🛡️ My KQL courses now include a complete attack scenario to test your skills — end to end. 🎯 Hands-on labs 📉 20% OFF for a limited time! Crack it open 👇 #KQL #Kusto #ThreatHunting #DetectionEngineering #DFIR academy.bluraven.io

🎁 NEW UPDATE: I've added a small challenge to my FREE "Hands-On Introduction to KQL for Security Analysis" course. More will be coming soon! #KQL #Kusto #MicrosoftDefender #MicrosoftSentinel academy.bluraven.io/course/intro...

🚨 FREE unlimited lab access to "Introduction to KQL for Security Analysis" course! Thrilled to announce that my Intro to KQL for Security Analysis lab environment is now completely free with no time restrictions! academy.bluraven.io/course/intro... #KQL #Kusto #ThreatHunting #Infosec

🚨 Problem with Cyber Range/Training platforms ❓ Most range platforms and training labs provide you with all the questions to solve, hinting answers to other questions. I've implemented a trick to hide some questions that reveal hints for other questions for a real-life experience. Stay tuned.👀

🚨 Detect C2 Beacons! New Microsoft Defender for Endpoint telemetry provides new opportunities for threat detection! 🔗 academy.bluraven.io/blog/beaconi... #ThreatHunting #DetectionEngineering #MDE

When you group your logs by timestamp(binning) to detect threats, you probably cause false negatives. Solve it using sliding window counts! academy.bluraven.io/blog/advance... #KQL #ThreatHunting #DetectionEngineering

It appears Microsoft quietly mitigated most of the risk of the "Intune company portal" device compliance CA bypass by restricting the scope of Azure AD graph tokens issued to this app, making them almost useless for most abuse scenarios. Thx @domchell.bsky.social for the heads up.

🥲 Seems like you don't even have to use residential proxies for device code phishing for evasion. Just get a machine in one of the cloud providers' corresponding regions. 🤷‍♂️

💙Fall in Love with Threat Hunting, Incident Response, and Detection Engineering using #KQL💙 Code: VLTN30 Valid until 17.02 #ThreatHunting academy.bluraven.io

Window functions do wonders! academy.bluraven.io/blog/advance... #ThreatHunting #KQL

🚨 Time to check your detection queries for MDE: DLL load events are recorded in DeviceImageLoadEvents table, NOT DeviceEvents table. I keep seeing people sharing queries with the wrong table and even with the wrong ActionType filters.

Here it is: your complete guide to building a Wireguard network that doesn't require any open ports at home, and doesn't require any third-party tools. Just Wireguard, your devices, and a little elbow grease. taggart-tech.com/wir...

It seems like there is an easy way to block VS Code tunnels (Dev Tunnels) on Windows to prevent malicious usage. 😮 techcommunity.microsoft.com/blog/azurede...

#LOLBAS project update: Entries now have placeholders for paths, URLs, and more. This makes it easier to visually see what parts are "variable", and for LOLBAS API users (lolbas-project.github.io/api/) it'll be easier to use with automation. Check it out: ⭐ lolbas-project.github.io

Detectable by Design? We keep failing on "shift left", "secure by design", etc. to prevent malicious activities. How about "detectable by design" approach? It's certain your product will fail on the prevention side but you could design it in a way that makes it easy to detect malicious activities.

New Year, New Blog academy.bluraven.io/blog/masteri... #DetectionEngineering #SIEM #XDR

Summiting the Pyramid: Bring the Pain with Robust and Accurate Detection medium.com/mitre-engenu... #ThreatHunting #DetectionEngineering

Detection for Microsoft Recommended Driver Block List github.com/Cyb3r-Monk/T... #ThreatHunting #DetectionEngineering

❓Curious about the Hands-on KQL for Security Analysts course? Read the review 👇 #Kusto #KQL kcyerrid.com/2024/12/07/c...

[NEW BLOG] academy.bluraven.io/blog/microso...

Detection Engineering Weekly Issue 95 is LIVE! https://buff.ly/4gmqbvv In this post: * 💎 by Mark Ellzey on Censys' new automated hunting tool, Censeye. Tons of great infrastructure pivoting tips for folks getting into this space * Fabian Bader on EDR Silencer techniques using Windows' NRPT

Last day of the sale! Don't miss your chance to get the best homelab guide around for just $10!

[NEW BLOG] EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2 In collaboration with @fabian.bader.cloud academy.bluraven.io/blog/edr-sil... #redteam

@deck.blue Scheduled posts doesn't seem to be working (updated and followed the new instructions)

Incoming blog

Last days for 35% OFF! academy.bluraven.io/blackfriday2...

For the few people who maybe missed the list: github.com/0x90n/InfoSe...

Just added a boatload of new detection engineers who joined Bluesky this week. Make sure to check this starter pack out

Hmm. That's why "link in the comments". I think this is also true for LinkedIn?

Detecting AiTM Phishing and other ATO Attacks academy.bluraven.io/blog/detecti... #ThreatHunting #DetectionEngineering #Kusto #KQL #MicrosoftSentinel

Thank God, it's now possible to turn off reposts with Deck Blue 💖

@deck.blue is awesome!

🥲

🔥 You can now allow/block FQDNs using Windows Firewall learn.microsoft.com/en-us/window...

For the newcomers, I'm running a Black Friday deal if you are into threat hunting, detection engineering, rapid triage using Microsoft Defender, Sentinel, Kusto/KQL.

Some keywords for the algorithm: Threat Hunting Detection Engineering DFIR Data Science ML Machine Learning KQL Kusto Microsoft Sentinel Microsoft Defender MVP

I made a Detection Engineering starter pack, will be adding more as more folks jump over to bluesky! go.bsky.app/HenXJUR

Starter Pack containing #infosec trainers — if I missed any, lmk! go.bsky.app/V5iocw6

🎁 Mega savings are here! 👉 academy.bluraven.io/blackfriday2... #KQL #Kusto #BlackFriday