Azure Sentinel this Week - Issue #31

Following the September 14th, 2021 release of three Elevation of Privilege (EoP) vulnerabilities (CVE-2021-38645, CVE-2021-38649, CVE-2021-38648) and one unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-38647) in the Open Management Infrastructure (OMI) Framework, analysts in the Microsoft Threat Intelligence Center (MSTIC) have been monitoring for signs of exploitation and investigating detections to further protect customers. We have some things to share about current attacks in the wild, agents and software involved, indicators for defenders to look for on host machines, and to share new detections in Azure Sentinel.

Our first Azure Sentinel Notebooks Ninja public training is on tap. For those that have already registered, the first session is scheduled for September 30, 2021. If you want to be included in additional training sessions, register using the form: https://cda.ms/2D1 As a lead-up to our first public-facing Azure Sentinel Notebooks training session and the upcoming…

This installment is part of a broader learning series to help you become a Jupyter Notebook ninja in Azure Sentinel. The installments will be bite-sized

This article shows you how to create Data Collection Rules for the Windows Security Events data connector in Azure Sentinel. Before you continue, please read the older articles around Azure Arc and how to collect “Security Events” from on-premises servers.

Microsoft recently added a new function that gives the option for stream events from Azure AD Identity Protection into Azure Sentinel. In this blog the instruction for export user risk events from Azure AD Identity protection into Azure Sentinel. 

This is one of the more enjoyable projects I’ve done recently during my spare time. I run Azure Sentinel in all of my Azure ..

This tutorial guides you through the basic steps of using notebooks for security analysis. It covers all the basic steps you need to understand to start using the notebooks provided with Azure Sentinel.

This video talks about how the Office 365 Data Connector can be onboarded in Azure Sentinel to allow ingestion of SharePoint, Exchange and Microsoft Teams lo…

Azure AD failed logon attempts

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Azure OMI Crypto Miner Detection

Last week, on September 14 th , 2021, Microsoft released fixes for three Elevation of Privilege (EoP) vulnerabilities CVE-2021-38645 , CVE-2021-38649 ,

Now with Windows Server 2022 generally available, you can start using this agent to monitor your resources running the latest Windows operating systems

Here’s a rundown on some new and updated Microsoft security certifications along with information on how to take the exams.

Q: I try to parse my JSON with the handy dandy “ConvertFrom-JSON” cmdlet but it only works in PowerShell 7, not in my good old PowerShell 5.1. How do I

Last week, cloud security outfit Wiz announced what they called a ‘secret agent’ group of vulnerabilities that enable takeover and privilege escalation of Linux servers in the Azure cloud.  

Join this Microsoft webinar to learn how to monitor health and performance of your Azure and hybrid infrastructure with Azure Monitor.