👉 Learn #KQL for #ThreatHunting, #DetectionEngineering, and #DFIR at
https://t.co/uAlYlXIpyV
- Founder @BluRavenSec | Microsoft Security MVP |
#DataScience
Jul 3, 2021 • 6 tweets • 3 min read
How to detect software supply chain attacks with #Sysmon, #MicrosoftDefender, or any other #EDR: 1. You use specific software in your environment. 2. The software is usually installed on a few servers that have privileges across the environment.
3. You probably have a naming convention for your servers. Also, servers have defined IP subnets. 4. Your EDR or Sysmon has "Company" information in the process event or process network logs.
Combining all together:
Jun 13, 2021 • 4 tweets • 2 min read
Here is how to hunt/detect 60% (possibly more than 60%) of lateral movement attacks:
On ALL endpoints, look for EID 4624 with LogonType 9 (NewCredentials), and check TargetOutboundUserName field. 1/4 #threathunting#dfir#lateralmovement
Then, check if the TargetOutboundUserName is supposed to be seen on the endpoint. Here is why:
Attackers most likely spawn a new process on the compromised machine with the credentials/tokens they steal. This is done by using "/NETONLY" flag. 2/4
