Marvens Decayette
@IronBrandedCompletionist
1 follower50 downloads396 copies10 likes3,286 views
11 detections
Filters
Last updated
All Time
Detection languages
7
4
Categories
2
1
1
1
1
Platforms
6
Products / Services
1
1
1
MITRE Techniques
2
1
1
1
1
IDS Classtypes
1
The current AI ecosystem has significant security gaps that can be weaponized for corporate espionage, supply-chain compromise, data harvesting, and even nation-state operations.
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
This rule identifies successful device logons that meet all of the following criteria:
Logon was successful
Logon was performed by a non-machine account
Logon type is not a service or scheduled task
Logon occurred:
- Before 06:00 local time, or
- After 20:00 local time, or
- On Saturday or Sunday
The configuration details can be modified (timezone, start and end hours...) as needed.
Logon was successful
Logon was performed by a non-machine account
Logon type is not a service or scheduled task
Logon occurred:
- Before 06:00 local time, or
- After 20:00 local time, or
- On Saturday or Sunday
The configuration details can be modified (timezone, start and end hours...) as needed.
Detect the execution of popular remote access and RDP applications. This can be used as a means to block their usage post incident.
I recommend a Cool-Off time period of at least 8hours to aggregate the threat events.
I recommend a Cool-Off time period of at least 8hours to aggregate the threat events.
This rule identifies outbound HTTP/HTTPS connections initiated by a known set of living-off-the-land binaries (LOLBins). This has been widely used by malware and threat actors to download payloads, establish C2 channels, or execute remote scripts without dropping additional binaries.
Detect file creation or modification events occurring on external storage devices, such as USB drives, external hard drives, or removable media. This can be indicative of:
Data exfiltration
Unauthorized copying of sensitive files
Insider threat activity
Accidental or negligent use of removable media
Data exfiltration
Unauthorized copying of sensitive files
Insider threat activity
Accidental or negligent use of removable media
Detect outbound connections initiated by P2P file-sharing applications. This can be used to find unauthorized P2P applications in enterprises environments that can be used to bypass security controls.
This query identifies user sign-ins leveraging legacy authentication protocols in Azure Active Directory (AAD). Legacy authentication methods, such as IMAP, POP3, Exchange ActiveSync, SMTP, and older Outlook protocols, do not support modern security features like multi-factor authentication (MFA). Their use increases the risk of account compromise, brute force attacks, and credential theft.
Monitoring for legacy authentication activity is a critical security control to detect potential unauthorized access or accounts bypassing modern security protections.
Monitoring for legacy authentication activity is a critical security control to detect potential unauthorized access or accounts bypassing modern security protections.
This KQL query identifies vulnerable VPN clients installed on endpoints that have High or Critical severity CVEs. VPN software is a high-value target for attackers because vulnerabilities can be exploited to bypass network access controls, intercept traffic, or gain remote access to internal networks.
This query identifies onboarded devices in the environment that have not completed a successful antivirus scan within the last 30 days. It provides visibility into endpoint compliance, ensuring that all devices are actively monitored and protected by Microsoft Defender or other antivirus solutions.
Maintaining up-to-date AV scan activity is critical as devices without recent scans may harbor unobserved threats or be at increased risk of compromise.
Maintaining up-to-date AV scan activity is critical as devices without recent scans may harbor unobserved threats or be at increased risk of compromise.
This hunting query validates the health and availability of Microsoft Defender telemetry sources across environments based on their respective common data tables.
This includes the different Defender solution:
Defender for Endpoint
Defender for Identity
Defender for Office 365
Defender for Cloud Apps
Defender for Cloud
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Monitoring these sources ensures that critical endpoint, identity, email, and cloud security telemetry is being ingested into Microsoft Sentinel as a singular method.
This includes the different Defender solution:
Defender for Endpoint
Defender for Identity
Defender for Office 365
Defender for Cloud Apps
Defender for Cloud
The query enumerates all key log tables within the Log Analytics workspace and checks whether they:
Are present and actively ingesting data (logs seen within the last 7 days)
Are stale (no new events within the last 7 days)
Are missing entirely, indicating the data connector is disabled or misconfigured
The output provides a quick health status (✅ Active, ⚠️ Stale, or ❌ Missing) for each core log source
Monitoring these sources ensures that critical endpoint, identity, email, and cloud security telemetry is being ingested into Microsoft Sentinel as a singular method.
Page 1 of 2