Reading · Kusto Insights · RSS Amplifier

Welcome to a new Monthly Update. We will go through some news and the latest queries. The goal is to provide you, the reader, a quick summary of what is going on in the world of KQL including News and Blogs from the Community as well as from Microsoft.

Hunt Accounts With Leaked Credentials

By: Robbe Van den Daele [GitHub, LinkedIn]

IdentityInfo
| summarize arg_max(TimeGenerated, AccountUpn, AccountDisplayName, AccountDomain, CriticalityLevel, DistinguishedName) by AccountObjectId
| join kind=inner (
    ExposureGraphNodes
    // Get accounts with Leaked Credentials
    | where NodeProperties.rawData.hasAdLeakedCredentials == "true" or NodeProperties.rawData.hasLeakedCredentials == "true"
    // Get the AAD Object ID
    | mv-expand EntityIds
    | where EntityIds.type == "AadObjectId"
    | extend AccountObjectId = extract('objectid=(.*)', 1, tostring(EntityIds.id))
    | extend HasAdLeakedCredentials = tostring(NodeProperties.rawData.hasAdLeakedCredentials),
        HasLeakedCredentials = tostring(NodeProperties.rawData.hasLeakedCredentials)
    | distinct NodeLabel, AccountObjectId, HasAdLeakedCredentials, HasLeakedCredentials
) on AccountObjectId

Source: GitHub

We've handpicked a few blog posts for their insightful content and relevance, yet we acknowledge the wealth of quality submissions from the KQL community. While we can't feature every post, each contribution is valued and vital to our collective knowledge. Stay inspired and keep sharing your perspectives!

Detecting Threats When Attackers Exploit Management Tools (Microsoft Intune) - MITRE Technique ID T1072 describes how adversaries can exploit centralized software suites like SCCM, Altiris, AWS Systems Manager, Microsoft Intune, and others to run commands and move laterally within networks. These tools, common for system administration and integrated into CI/CD pipelines, can enable remote code execution across connected systems, facilitate lateral movement, and allow for malicious actions such as data wiping.

Introducing LOLRMM-KQL - Detecting abused RMM tools at scale is harder than it looks. LOLRMM helps by documenting these tools, but turning that dataset into something actionable in Microsoft Defender still takes some work. LOLRMM was created to track legitimate Remote Monitoring and Management (RMM) tools that are commonly abused during intrusions. These tools show up frequently in initial access or post-exploitation scenarios for persistence, remote access, and lateral movement, while blending in with normal activity.

Monitor New Actions in Sentinel & Defender XDR (V2) - Monitoring new actions in Microsoft Sentinel and Defender XDR is critical for continuously evaluating new possibilities to detect attacks and coverage. With the introduction of the Unified Security Operations Platform, the API support to run hunting queries has changed. Because of this, the original solution was due for an upgrade not only in the way it collected logs, but also to include support for very large environments.

Check out some of the latest queries added to KQLSearch.com:

Text within this block will maintain its original spacing when published