iiinova — where your digital self keeps evolving

BertJanCyber @bertjancyber.bsky.social · 22/04/2025

Are you joining The KQL Cafe (@kqlcafe.bsky.social) next week? I will be talking about #KQL, Logic Apps, APIs and a combination of the three during the session. Interested? Register here: www.meetup.com/kql-cafe/eve... 📅 When: April 29 18:00 - 19:30 (CET) 🖥️ Where: Online 💰 Cost: Free of charge

meetup.com

KQL Cafe - April 2025, Tue, Apr 29, 2025, 6:00 PM | Meetup

Hi Kusto Fans, Another month another [KQL Cafe](https://kqlcafe.com/#upcoming-shows) session. As usual we cover what is new in KQL and what we did with KQL in the last mont

010

BertJanCyber @bertjancyber.bsky.social · 14/04/2025

Microsoft announced the public preview of the OAuthAppInfo table in the Advanced Hunting schema. I created multiple #KQL queries to help you kick-start the usage of this table.🚀 The queries help you to identify high-permissive, unused and external apps. github.com/Bert-JanP/Hu...

github.com

Hunting-Queries-Detection-Rules/Defender For Cloud Apps/OAuthAppInfo at main · Bert-JanP/Hunting-Queries-Detection-Rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules. ...

010

Reposted by BertJanCyber

securityaura.bsky.social @securityaura.bsky.social · 13/04/2025

#100DaysOfKQL Day 100 - CScript.exe, WScript.exe or MSHTA.exe Executed from Web Browser Process IT'S FINALLY OVER! I had another query in store for today, but I feel like this challenge wouldn't be complete without that one. (cont) t.co/lwO1hmrqUk

t.co

https://github.com/SecurityAura/DE-TH-Aura/blob/main/100DaysOfKQL/Day%20100%20-%20CScript.exe%2C%20WScript.exe%20or%20MSHTA.exe%20Executed%20from%20Web%20Browser%20Process.md

251

BertJanCyber @bertjancyber.bsky.social · 12/04/2025

Pushed a #KQL that returns the top 10 SecurityEvents with the largest ingestion size. This can help determine which events you may want to aggregate or filter, depending on your detection/forensic needs. github.com/Bert-JanP/Hu...

github.com

030

BertJanCyber @bertjancyber.bsky.social · 31/03/2025

It's time to prepare some content for the next @kqlcafe.bsky.social . I will discuss #KQL, Logic Apps and hunting through the available APIs. The session is on April 29th and is completely free to attend online. 🗓️Event registration & details: www.meetup.com/kql-cafe/

052

BertJanCyber @bertjancyber.bsky.social · 03/03/2025

On my way to #ELDK2025 🇩🇰 First stop Hamburg! 🇩🇪

010

BertJanCyber @bertjancyber.bsky.social · 27/02/2025

🛡️Released DFIR PowerShell V3! New features include: - Granular response capabilities for Acquisition, Analysis, and Containment - Expanded support beyond Windows, enabling Cloud response activities via Graph API github.com/Bert-JanP/In...

github.com

GitHub - Bert-JanP/Incident-Response-Powershell: PowerShell Digital Forensics & Incident Response Scripts.

PowerShell Digital Forensics & Incident Response Scripts. - Bert-JanP/Incident-Response-Powershell

040

BertJanCyber @bertjancyber.bsky.social · 17/02/2025

Pushed a #KQL for: Successful device code sign-in from an unmanaged device. Query is available for AADSignInEventsBeta and SigninLogs. Less known is the AADSignInEventsBeta filter for device code: | where EndpointCall == "Cmsi:Cmsi" 🏹Query: github.com/Bert-JanP/Hu...

253

BertJanCyber @bertjancyber.bsky.social · 20/01/2025

If your company runs Exchange Online and/or Microsoft 365 have a look at CISA's latest publication: Microsoft Expanded Cloud Logs Implementation Playbook. The report includes KQL, SPL and Powershell code to perform incident response. www.cisa.gov/resources-to...

cisa.gov

Microsoft Expanded Cloud Logs Implementation Playbook | CISA

041

BertJanCyber @bertjancyber.bsky.social · 20/01/2025

These two mails keep providing great value to list new actions found in a tenant. Very useful to find new detection & hunting potential, anomalies or just to understand your data better. I will probably write a small blog about the topic soon. Deployment: github.com/Bert-JanP/Se...

031

Reposted by BertJanCyber

ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs @cyb3rmik3.bsky.social · 12/01/2025

📬 Have you checked latest Kusto Insights by @ugurkoc.de & @bertjancyber.bsky.social 🗓 December update is available now kustoinsights.substack.com/p/kusto-insi... #KustoInsights #KustoQuery #KustoQueryLanguage #KQL #MicrosoftSecurity

021

BertJanCyber @bertjancyber.bsky.social · 06/01/2025

Created a #KQL hunting query to list the initial LDAPNightmare exploit (CVE-2024-49113) connection. With this, you can hunt for both successful and failed exploitation attempts 🏹 github.com/Bert-JanP/Hu...

github.com

010

BertJanCyber @bertjancyber.bsky.social · 23/12/2024

It has been a good day. 😅 Az.SecurityInsights.internal\New-AzSentinelAlertRule : The maximum number of enabled Scheduled analytics rules (512) learn.microsoft.com/en-us/azure/...

120

BertJanCyber @bertjancyber.bsky.social · 18/12/2024

NEW BLOG! 🚨 IOC hunting at scale using externaldata(). The blog includes queries for: - Suspicious NamedPipes - Tor connections - Active CISA KEV vulnerabilities - MISP Feeds kqlquery.com/posts/extern...

kqlquery.com

IOC hunting at scale

The KQL External Data operator might be the holiday gift for you! This powerful capability enables you to seamlessly incorporate external data into your KQL queries, such as GitHub IOC lists or MISP F...

000

BertJanCyber @bertjancyber.bsky.social · 06/12/2024

Anyone already seen the column ThreatClassification land in their tenant? The column will be added to the EmailEvents table. Source: techcommunity.microsoft.com/blog/microso...

130

BertJanCyber @bertjancyber.bsky.social · 03/12/2024

It is time for the monthly Kusto Insights newsletter! 📰 open.substack.com/pub/kustoins...

open.substack.com

Kusto Insights - November Update

Welcome to a new Monthly Update.

010

BertJanCyber @bertjancyber.bsky.social · 02/12/2024

Time to get a #KQL query from the shelve: Potential Adversary in the middle Phishing If you have High-Risk users and axios useragents in the results please revoke some sessions. 🏹 github.com/Bert-JanP/Hu... Query is available for both SigninLogs and AADSignInEventsBeta.

github.com

062