Azure Sentinel this Week - Issue #28

Hi, all! Welcome to a new series on Azure Sentinel Notebooks! In this post, we want to introduce everyone to the Notebooks feature of Azure Sentinel and

There’s a mighty effort underway to ensure that Azure Sentinel customers have as much knowledge and understanding about the Notebooks feature as possible. Azure Sentinel Notebooks is a valuable asset for investigative and hunting analysts alike. There’s an introductory blog post available now that is a compliment to the upcoming free training series. See: Becoming…

Like many of you, over the last 18 months we have seen a huge shift in how our staff are working, people are at home, people working remotely permanently, or being unable to get into their regular office. That has meant a shift in your detections, previously you had people lighting up internal firewalls, or…

Fail2ban is a really simple but effective tool that has been around forever, it basically listens for incoming connections and then updates a firewall based on that, i.e. too many failed attempts then the IP is added to a ban list, rejecting new connections from it. If you are an Azure AD customer then Microsoft…

This time we are going to take a closer look at NTLM usage. Most likely, you have seen the news about the #PetitPotam and the attack scenarios around Active Directory Certificate Services.

In this blog post we will explore the new “Alert enrichment” in Azure Sentinel Analytics and do a deep dive into the “Alert details” dynamic

I’ve recently come across an awesome blog on EDR Bypass methods. Since I’m not so familiar with Windows internals, syscalls, etc., EDR Bypass methods have been a hard topic for me. After reading the…

As many of you already know, I have spent last couple of years purely focusing on security monitoring, leveraging Microsoft security solutions in the cloud. Even though, my work is focused on Microsoft technologies and how to get the most out of the MS security tools I’m more and more working with multi-cloud environments. The…

How to deploy data connectors in Azure Sentinel, listing all supported, built-in data connectors, together with links to generic deployment procedures and extra steps required for specific connectors.

Watch how Microsoft’s cloud-based SIM, Azure Sentinel, along with our XDR technologies, including Microsoft 365 Defender, provide an automated approach to th…

MSTIC has observed an increasing number of Linux attackers encoding their scripts into Base64 both for ease of use and to avoid detection. Because the comman…

Azure Sentinel is a modern SIEM solution offering cloud scale analytics to power your thereat detection and response requirements. Like most cloud

Google releases Chrome 93.0.4577.63 Security Fixes. Threat Hunting query(KQL) to investigate the released CVEs in your organization.

What activities have been performed by external users on Office files once they have been shared.

Monitoring for disabling of Anti-virus.

Suspected ProxyToken Exploitation - Looks for activity that might indicate exploitation of the ProxyToken vulnerability - CVE-2021-33766

Looking for systems that have two different IP addresses that share the same MAC address for potential ARP Poisoning

Due to some changes made within the Azure Storage account resource configuration itself, the connector also needs to be reconfigured. The storage account (parent) resource has within it other (child) resources for each type of storage: files, tables, queues, and blobs.

You can now write cross service queries between Azure Monitor and Azure Data Explorer, to access relevant data where you need it.

Azure Monitor support for Availability Zones (AZ) is now available on West US 2 and East US 2. Currently, only workspaces created on dedicated clusters can have AZ support, by selecting to use Availability Zones when creating the cluster.

While the CMMC Interim Rule allows companies to attest to their compliance with NIST 800-171, the ability to self-attest will eventually be retired. Starting in 2021, a phased-in approach will cause DoD contractors to need certification from an independent Certified Third-Party Assessor Organization (C3PAO). Certification provides the DoD with the assurance that a contractor (prime or sub) can be trusted to store Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). The CMMC model is created and managed by the DoD and confers a cybersecurity “maturity”—the efficacy of process and automation of practices—ranging from “basic” to “advanced.”

Use these playbooks to quickly respond to security incidents in the Microsoft cloud.

Darktrace, a leading autonomous cyber security AI company, today announced that it has joined the Microsoft Intelligent Security Association (MISA).

As traditional company barriers broke down, and remote working became the norm, the threat landscape rapidly changed, bringing cybersecurity to…