Microsoft Sentinel this Week

By Rod Trent

Microsoft Sentinel this Week - Issue #43

#43・ Jan 7, 2022

issues

Microsoft Sentinel this Week - Issue #43

By Rod Trent • Issue #43 • View online

Happy new year, everyone!

It’s great to be back. After the holiday hiatus, we’re ready to head deep into 2022 with lots of Microsoft Sentinel goodness. I hope all of you are ready for it.

I also hope - for those that celebrate during the holiday season - that you had time to rest and reflect and that you had the opportunity to enjoy family and friends.

The holiday season can be a busy time. It was for us as we scrambled to make sure all of our family’s schedules aligned. But, despite the busyness, we somehow found a way to all be together and enjoy the togetherness. The older my kids get, the harder it is to get all of them together under the same roof. So, this time of year is extra special to me.

I spent the last part of my time off with my best friend who is a chiropractor that lives in Ohio Amish country. So, the last week of my vacation was glorious. The Amish way of life is very different than ours. It’s a much slower life. And the Internet connection is horrible - which lends itself to many more quiet moments than you wish for.

All-in-all it was fantastic for us.

…

I want to highlight a few things before handing you off to the newsletter content - which is massive considering it’s been about a month since we’ve all been together.

…

First off, unless you’ve been living under a rock, you should know about the Must Learn KQL series. This is a series that I started in November to help our customers learn the query language. It started as a blog series, then turned into an eBook, and now I’ve heard from someone enjoying the series that they are going to take it and turn it into a video series. That is super awesome! The more folks can become comfortable with this simple query language, the more comfortable they will be using anything data-centric in Azure. It’s a very strategic skill.

But, beyond the engagement around the series, I’m happy to say - shocked even - that the effort is seeing real dividends. The series has exploded in popularity and has become more successful than I imagined. Based on a recent poll, many of you are planning to learn KQL as part of a New Year’s resolution. Please, please, please - I entreat that if you know someone that needs to learn this query language, send them the information on how to get started.

Must Learn KQL series: https://aka.ms/MustLearnKQL

Additionally, I opened a merch store for the series where all proceeds go to St. Jude Children’s Research Hospital. I’ll admit, the coffee/tea mugs that are available for purchase are absolutely over-priced, but they’re high quality and your purchase supports a very worthy cause.

Must Learn KQL merch store: https://cda.ms/3vg

…

A week or so ago, I updated the Microsoft Sentinel community resources list and the known available books list. For those wanting that want to get deeper engaged this year, here’s those updated links:

Microsoft Sentinel Community resources: https://cda.ms/3zc

Books for Microsoft Sentinel: https://cda.ms/3zd

…

Lastly, as a bit of levity - with every rebranding that Microsoft does, there’s a lot more to it than just choosing a name and sticking the new name on a blog or doc somewhere and forcing our customers to start using it. You’ll be happy to know that Microsoft submitted for an official trademark for Microsoft Sentinel in mid-December.

See it: https://cda.ms/3zf

Whew! I’m crossing my fingers that it passes.

…

With that, I’ll leave you to this week’s massive newsletter content.

Talk soon.

-Rod

Stuff to Read

Must Learn KQL Part 11: The Summarize Operator – Azure Cloud & AI Domain Blog

The Summarize operator does just what it suggests – it summarizes data. In deeper terms, it produces a table (in the results) that aggregates the content of the input table.

azurecloudai.blog • Share

Parameterized functions in Azure Log Analytics

When working with Active Directory logs, we have to work with many numbers, GUID’s, etc., which may be hard to understand in the first place.

www.linkedin.com • Share

Cloud Service Provider Access to Microsoft Sentinel Content Hub – Azure Cloud & AI Domain Blog

A few weeks ago an issue was raised from Cloud Service Providers (CSPs) that they could not access any Solutions in the newly released Content Hub for Microsoft Sentinel. There’s an effort underway to resolve this and allow CSPs access to the Content Hub solutions. In the Known Issues section of the Microsoft Sentinel GitHub…

azurecloudai.blog • Share

Logging User Access Admin elevations to Microsoft Sentinel – Adriaans ramblings

This week I was surprised to figure out that elevation logs that indicate a Global Admin becoming a User Access Administrator don’t flow to Log Analytics. It’s not possible to enable diagnostics settings for it.

TL;DR I built a Logic App that forwards those logs to Log Analytics so I can have Analytic rules in Sentinel report if this action happens.

adr.iaan.be • Share

Updated Log4j Microsoft Sentinel Solution Requires Manual Updating – Azure Cloud & AI Domain Blog

A few short weeks ago now during the initial reporting on Log4j, the Microsoft Sentinel team released a Solution in the recently christened Content Hub for Log4j. The first release (1.0.0) only supplied a couple Analytics Rules, despite This particular solution has now been updated. The update brings the solution to version 1.0.1 and now…

azurecloudai.blog • Share

Set up Microsoft Sentinel as a single pane of glass for Microsoft 365 alerts

Microsoft Sentinel helps organizations protect their Microsoft 365 tenants by providing insight into activity that might require investigation. This article shows how to set up Microsoft Sentinel with a basic configuration that delivers a great deal of value by enhancing your security posture. In just four simple steps, you can connect Microsoft Sentinel to other Microsoft Cloud Security products to get a single pane of glass for incidents and automate security response through playbooks.

practical365.com • Share

Detecting privilege escalation with Azure AD service principals in Microsoft Sentinel – Microsoft Sentinel 101

Defenders spend a lot of time worrying about the security of the user identities they manage. Trying to stop phishing attempts or deploying MFA. You want to restrict privilege, have good passphrase policies and deploy passwordless solutions. If you use Azure AD, there is another type of identity that is important to keep an eye…

learnsentinel.blog • Share

Configuring table level retention in Microsoft Sentinel - Microsoft 365 Security for IT Pros

While most organizations will be able to work with the global retention setting, some might have the need for granular retention. This could be because there are certain data sources they want to keep for a shorter time (to keep cost down) or for a longer time (for forensics). Let’s dive into some use cases.

m365securitybook.com • Share

Integrating Canary Tokens with Microsoft Sentinel

Canary tokens can be configured to send emails when they are triggered which is useful for starting out with a couple of tokens, however when you want to scale out, integration with existing security tools is really helpful. You could even automate an initial response to a token triggering with SIEM/SOAR tooling.

blog.rothe.uk • Share

Forward On-Premises Windows Security Event Logs to Microsoft Sentinel - Microsoft Tech Community

There is no need to load an agent on every device to capture the Windows Security Event Logs from your on-premises Windows workstations & servers. Windows hosts already have this built into the operating system. To capture the events without having to load the Azure Monitoring Agent (AMA) the Windows Event Forwarding process can be used to send logs to a “Windows Event Collector” (WEC). The WEC will then need the AMA loaded to send the events to a Log Analytics Workspace (LAW) that is monitored by Microsoft Sentinel.

techcommunity.microsoft.com • Share

Add Hunting Queries (for Log4Shell) faster to Microsoft Sentinel | Thoor.tech

Do you find it hard to add all of the Hunting Queries available to your Microsoft Sentinel Hopefully I have a PowerShell script that can help you.

thoor.tech • Share

Ollie, your personal Microsoft Sentinel assistant | The Collective

At The Collective, we are constantly looking to innovate and push the boundaries of the existing (Microsoft) capabilities. For the 2021 Microsoft Sentinel Hackathon, we developed an assistant for Microsoft Sentinel which will ease the day-to-day management of the SIEM & SOAR tool. The solution, aptly named Ollie after it’s…

thecollective.eu • Share

Bulk upload Log4Shell IoC to Microsoft Sentinel Threat Intelligence -Notes of Azure Security + Governance

This article provides a simple script to bulk upload Log4J IoC to Microsoft Sentinel Threat Intelligence using its REST API.

azsec.azurewebsites.net • Share

Building SOC Efficiency with Microsoft Sentinel – Azure Cloud & AI Domain Blog

For those that missed it or had to walk away to do actual work during the event, here’s my Building SOC Efficiency with Microsoft Sentinel talk for AzureFunBytes. One of these days, I’d love to complete this talk. It really deserves 3-4 hours instead of the 1 hour allotted for this event. But it was…

azurecloudai.blog • Share

Enabling the Log4j Vulnerability Exploit Analytics Rule for Microsoft Sentinel – Azure Cloud & AI Domain Blog

There’s a new Analytics Rule for Microsoft Sentinel customers that monitors against the known IOCs for Log4j. This is available in the console to be enabled. Log4j Analytics rule The KQL query behind the Analytics Rule uses the externaldata operator to query against the Log4j_IOC_List.csv file that is continually being updated with newly discovered IP…

azurecloudai.blog • Share

Enabling the Network Security Groups Connector for Microsoft Sentinel – Azure Cloud & AI Domain Blog

The Network Security Groups connector is now available in the Microsoft Sentinel console. This enables customers to monitor rules for things like virtual network subnets and network interfaces. The connector streams the NSG diagnostic logs directly into Microsoft Sentinel. Two new Data Types are available: NetworkSecurityGroupEvent and NetworkSecurityGroupRuleCounter The Data Types are exposed through the…

azurecloudai.blog • Share

FalconFriday —Monitoring for public shares — 0xFF1A | by Jos van der Peet | FalconForce | Dec, 2021 | Medium

In this blog we will explore the possibilities to use Microsoft Sentinel to monitor a Windows environment for the creation of public SMB shares (i.e., accessible to the entire domain including users, service accounts and computer accounts). The objective is to try preventing accidental information leakage, vulnerabilities or other abuse through inappropriate share permissions.

medium.com • Share

Microsoft Sentinel and the power of functions | Microsoft Sentinel 101

Functions in Microsoft Sentinel are an overlooked and underappreciated feature in my experience, there is no specific Sentinel guidance provided by Microsoft on how to use them, however they are covered more broadly under the Azure Monitor section of the Microsoft docs site. In general terms though, they allow us to save queries to our…

learnsentinel.blog • Share

Why Microsoft Sentinel should be your first choice for a SIEM - Atech

Microsoft Sentinel is Microsoft’s cloud-native SIEM solution that gets deployed in an organisation’s Azure tenant and accessed via the Azure portal, ensuring alignment with pre-existing organisational policies.

atech.cloud • Share

Dastardly Detection of DirSync Deleted Groups

A corner case to investigate some of Microsoft Sentinels capabilities

swiftsolves.substack.com • Share

Microsoft Sentinel Jupyter Notebooks knowledge check test - Microsoft Tech Community

Microsoft Sentinel leverages a common API to expand the SIEM’s native capabilities by providing access to external tools such as Jupyter notebooks and

techcommunity.microsoft.com • Share

ServiceNow Integration (part 1)

We can easily create a ServiceNow Security Incident Response (SIR) incident with the help of a playbook as follows.

ashwinitpro.blogspot.com • Share

ServiceNow Integration (part 2)

Your description for this link…

ashwinitpro.blogspot.com • Share

Stuff to Watch/Listen To

AzureFunBytes Episode 64 - Building SOC Efficiency with @Azure Sentinel with @rodtrent

It’s been a few weeks but AzureFunBytes is back with a new episode all about mitigating risk in the cloud by using tools provided by Azure. If you’re current…

www.youtube.com • Share

Azure Sentinel: How to deploy a SOC service in seconds - Drew Perry

Gone are the days of waiting 6 months for an MSSP service or to get a functionating Security Operation Centre up and running. Learn how this can be done in s…

www.youtube.com • Share

KQL - The Next Query Language You Need to Learn | Data Exposed: MVP Edition - Microsoft Tech Community

Azure is the leading platform for many companies, and to manage your databases and other infrastructure you need to have insights into what is happening.

techcommunity.microsoft.com • Share

Microsoft Sentinel Best Practice for Admin Users

Microsoft Sentinel - Best Practice for Admin Users————————————————————————————————–🔔 Subsc…

www.youtube.com • Share

Learning with the Microsoft Sentinel Training Lab - Microsoft Sentinel in the Field #2

In this episode, we talk to Yaniv Shasha about the new Microsoft Sentinel Training Lab solution that allows users to get hands-on experience with very little…

www.youtube.com • Share

Hunt for Log4Shell with Azure Sentinel, the fastest way, find obfuscations

While everyone’s sharing obfuscations for #log4shell we share behaviour based and performance optimised threat hunting queries for Azure Sentinel. Video illu…

www.youtube.com • Share

Stuff to Have

Sentinel-Queries/Identity-ManagedIdentityAccessingNewResources.kql at main · reprise99/Sentinel-Queries · GitHub

Detect when an Azure AD managed identity accesses a resource for the first time, i.e an identity that previously only accessed storage accesses a key vault

github.com • Share

Sentinel-Queries/SecurityIncident-DaysSinceLastIncident.kql at main · reprise99/Sentinel-Queries · GitHub

Calculate how many days since each analytic rule last triggered, useful to determine if rules are still valid

github.com • Share

Sentinel-Queries/OfficeActivity-DetectFullMailboxAccess.kql at main · reprise99/Sentinel-Queries · GitHub

Detect when an Exchange admin grants full mailbox access to another user

github.com • Share

Sentinel-playground/Update-DetectionRules.ps1 at main · SecureHats/Sentinel-playground · GitHub

PowerShell script to update all the existing active detection rules and add the missing properties

github.com • Share

Threat-Hunting-and-Detection/RITA Beacon Analyzer - Windows Firewall.md at main · Cyb3r-Monk/Threat-Hunting-and-Detection · GitHub

RITA Beacon Analyzer for Windows Firewall Events

github.com • Share

GitHub - mdecrevoisier/Windows-auditing-mindmap: Set of Mindmaps providing a detailed overview of the different #Windows auditing capacities and event log files.

Windows auditing mindmap provides a simplified view of Windows Event logs and auditing capacities that enables defenders to enhance visibility for different purposes:

Log collection (eg: into a SIEM) Threat hunting Forensic / DFIR Troubleshooting

github.com • Share

Sentinel-Queries/Identity-ServicePrincipalSigninsbyIP.kql at main · reprise99/Sentinel-Queries · GitHub

Make a set of IP addresses that your Azure AD service principals have signed in from AADServicePrincipalSignInLogs

github.com • Share

Sentinel-Queries/Azure-ServicePrincipalAddedtoAzure.kql at main · reprise99/Sentinel-Queries · GitHub

Detect when an Azure AD service principal is given access to an Azure RBAC scope, i.e subscription or resource group

github.com • Share

Sentinel-Queries/Identity-VisualizeGuestRedemptionswithTrend.kql at main · reprise99/Sentinel-Queries · GitHub

Visualize how many guests are redeeming invites over the time period with trend

github.com • Share

Sentinel-Queries/Identity-InactivePrivilegedUsers.kql at main · reprise99/Sentinel-Queries · GitHub

Find users who hold privileged Azure AD roles but haven’t signed onto Azure for 30 days

github.com • Share

Sentinel-Queries/Device-ASRAudit.kql at main · reprise99/Sentinel-Queries · GitHub

Alert when attack surface reduction rules are triggered while ASR is in audit mode

github.com • Share

Sentinel-Queries/Identity-MFAPercentageperapp.kql at main · reprise99/Sentinel-Queries · GitHub

Calculate the percentage of signins to each of your Azure AD applications that require MFA

github.com • Share

Sentinel-Queries/Device-VisualizeOSBuildspermonth.kql at main · reprise99/Sentinel-Queries · GitHub

Visualize the OS build numbers of your Windows 10 and 11 devices per month over the last year

github.com • Share

Sentinel-Queries/Identity-ServicePrincipalSigninfromnewIP.kql at main · reprise99/Sentinel-Queries · GitHub

Detect when an Azure AD service principal signs in from an IP previously not seen

github.com • Share

Sentinel-Queries/SecurityAlert-DefenderforIDRecon.kql at main · reprise99/Sentinel-Queries · GitHub

When Defender for Identity alerts on user and group reconnaissance, parse the relevant accounts, hosts and groups affected

github.com • Share

Sentinel-Queries/Identity-VisualizeMFAChallengevsPreviouslySatisfied.kql at main · reprise99/Sentinel-Queries · GitHub

Visualize when your users are actively challenged for MFA vs when it was previously satisfied

github.com • Share

Sentinel-Queries/Bastion-AuditUsage.kql at main · reprise99/Sentinel-Queries · GitHub

Audit usage of Azure Bastion, find which users have attempted to connect to virtual machines using RDP or SSH

github.com • Share

Sentinel-Queries/OfficeActivity-DetectNewExchangeAdminRole.kql at main · reprise99/Sentinel-Queries · GitHub

Detect when a new Exchange admin role is created and parse the permissions

github.com • Share

Sentinel-Queries/Identity-YourUsersSigningIntoOtherTenantsAsGuests.kql at main · reprise99/Sentinel-Queries · GitHub

Collection of KQL queries. Contribute to reprise99/Sentinel-Queries development by creating an account on GitHub.

github.com • Share

Microsoft Sentinel Log4j Ubiquiti Analytic Rule

I created a quick Analytic Rule for those using Ubiquiti logs with Microsoft Sentinel. First of all, I just took two existing rules and made a new one. To get the IOCs for Log4j published on the Sentinel GitHub page, I utilized the code from a recently published rule in Microsoft Sentinel. Read more about it on Rod Trent’s post, Enabling the Log4j Vulnerability Exploit Analytics Rule for Microsoft Sentinel.

cybermohr.ghost.io • Share

Sentinel-Queries/OfficeActivity-NewTeamsAppInstalled.kql at main · reprise99/Sentinel-Queries · GitHub

Detect when an app is installed into Teams for the first time compared to the previous timerange

github.com • Share

Sentinel-Queries/SecurityAlert-FindSigninsforAnomalousToken.kql at main · reprise99/Sentinel-Queries · GitHub

When an anomalous token alert is flagged, join the event with both the AADUserRiskEvents and SigninLogs table to find the signins which generated the alert

github.com • Share

Kusto-Query-Language-KQL-/Log4j_Threat_Hunting at main · AdarshPandey-dev/Kusto-Query-Language-KQL- · GitHub

Log4j Threat Hunting using defender’s TVM(Threat and vulnerability Management) feature

github.com • Share

Sentinel-Queries/AzureStorage-FirstTimeStorageKeyEnumeration.kql at main · reprise99/Sentinel-Queries · GitHub

Detect when a user retrieves keys for Azure storage for the first time

github.com • Share

Sentinel-Queries/IdentityDirectoryEvents-EncryptionChange.kql at main · reprise99/Sentinel-Queries · GitHub

Alert when the encryption types on a device are changed and parse the previous and current encryption types

github.com • Share

Sentinel-Queries/SecurityAlert-RetrieveEmailforSuspiciousEmailPatterns.kql at main · reprise99/Sentinel-Queries · GitHub

When a user is flagged for suspicious email sending patterns retrieve all the email they have sent around the time of the alert

github.com • Share

Stuff to Attend

Microsoft Tech Talks - Microsoft Sentinel 101 - what's new, aside from the name! (MTT0AEDT)

So you may have noticed that Microsoft Sentinel got itself a fancy new name! Not to worry though, it’s still the same awesome product you know and love, but with some new amazing features and functionality. This talk will do a quick dive into some of the new functionality released over the last 6 months within Microsoft Sentinel and give you an idea of what’s new – aside from the name!

mtt.eventbuilder.com • Share

Secure SAP on Microsoft Azure Airlift - Home - Welcome

In this virtual airlift, Microsoft partners will learn how Microsoft can help secure SAP on cloud migration and modernization journey by leveraging the native Azure security controls including Microsoft Sentinel threat monitoring for SAP.

saponazure.eventcore.com • Share

MYTHIC Webinar - Sign up

How we fixed MDR to be what you REALLY need using the Microsoft Security Stack.

go.tiberium.io • Share

Stuff That's New or Updated

Build and monitor Zero Trust (TIC 3.0) security architectures with Microsoft Sentinel | Microsoft Docs

Install and learn how to use the Microsoft Sentinel Zero Trust (TIC3.0) solution for an automated visualization of Zero Trust principles, cross-walked to the Trusted Internet Connections framework.

docs.microsoft.com • Share

What’s New: Detecting Apache Log4j vulnerabilities with Microsoft Sentinel - Microsoft Tech Community

Microsoft’s security research teams have been tracking threats taking advantage of the remote code execution (RCE) vulnerability in Apache Log4j 2

techcommunity.microsoft.com • Share

Advanced KQL Framework Workbook - Empowering you to become KQL-savvy - Microsoft Tech Community

Kusto Query Language (KQL) is the language used in Microsoft Sentinel to perform search, analysis, write detection rules and visualise data in Workbooks.

techcommunity.microsoft.com • Share

Stuff That's Related

DeviceTvmSoftwareEvidenceBeta KQL Advanced Hunting Use Case

Microsoft have recently added a new table to their MDE Advanced Hunting capability which is DeviceTvmSoftwareEvidenceBeta. As the name implies, this table will surface data around why MDE believes why a piece of software exists, be it due to certain file paths or registry paths.

www.linkedin.com • Share

Leveraging the Power of KQL in Incident Response - Microsoft Tech Community

When your organization is faced with investigating a security incident, whether that’s something as simple as a phishing campaign or more complex like a

techcommunity.microsoft.com • Share

An Adaptive Security Strategy Is Critical for Stopping Advanced Attacks

Ransomware demands a new approach to incident response.

www.darkreading.com • Share

Stuff from Partners

Azure Sentinel deployment | Adatis

Want to integrate cyber security within your Azure environment? Contact Adatis today to discuss Azure purview data governance to ensure security by design!

adatis.co.uk • Share

No-Code Security Automation Funding: ContraForce Raises $2 Million - MSSP Alert

DataTribe invests in ContraForce, a no-code security automation & compliance solutions company for small and midsize businesses (SMBs).

www.msspalert.com • Share

Cyber Risk Aware’s Security Behaviour Change Training Platform Now Available in the Microsoft Azure Marketplace - Cyber Risk Aware

Microsoft Azure customers worldwide can now gain access to Cyber Risk Aware’s security behaviour change training platform to take advantage of the scalability, reliability and agility of Azure to drive application development and shape business strategies.

www.cyberriskaware.com • Share

Introducing Senserva's open-source toolkit - Senserva

With great pleasure, we would like to introduce the open-source version of Senserva’s Azure Active Directory toolkit to help you secure your environment built on top of Microsoft Sentinel.

www.senserva.com • Share

Wipro Deepens Microsoft Cybersecurity Expertise - EquityBulls.com

Wipro Limited, a leading global information technology, consulting and business process services company, announced that it has expanded its portfolio of end-to-end solutions delivered on Microsoft’s cybersecurity stack.

www.equitybulls.com • Share

Stuff from the News

Google Cloud acquires SOAR provider Siemplify for a reported $500 million | SC Media

Security analysts call latest acquisition by Google Cloud a great move in its efforts to deliver a more secure cloud experience for customers and MSSPs.

www.scmagazine.com • Share

Microsoft Sentinel Launches New Log4j Vulnerability Solution In Public Preview

Microsoft has announced some important updates for Microsoft Sentinel, its scalable cloud-native SIEM tool that provides AI-powered security analytics in enterprise environments. The Redmond giant has launched a new solution in public preview that should help IT Admins to detect Apache Log4j vul …

petri.com • Share

Hunt for Log4Shell with Azure Sentinel, the fastest way, find obfuscations

While everyone’s sharing obfuscations for #log4shell we share behaviour based and performance optimised threat hunting queries for Azure Sentinel. Video illu…

www.youtube.com • Share

Did you enjoy this issue?

By Rod Trent

The Microsoft Sentinel weekly newsletter helps uncover the new and important features and news for Microsoft's cloud-based SIEM+SOAR security tool.

Tweet

Share

In order to unsubscribe, click here.

If you were forwarded this newsletter and you like it, you can subscribe here.