Elli Shlomo (IR)(@ellishlomo) 's Twitter Profile Photo

Hunting for LOLBins with particular tables and actions

If you've got an ASR configuration in place, the result will be much more accurate.

let LOLBins = (externaldata(LOLBinsStr:string)
['raw.githubusercontent.com/api0cradle/LOL…'] with (format='txt'));
let LBArray = LOLBins
| extend LB =…

Hunting for LOLBins with particular tables and actions

If you've got an ASR configuration in place, the result will be much more accurate.

let LOLBins = (externaldata(LOLBinsStr:string)
['raw.githubusercontent.com/api0cradle/LOL…'] with (format='txt'));
let LBArray = LOLBins
| extend LB =…
account_circle
Kijo Ninja(@kj_ninja25) 's Twitter Profile Photo

Mango Sandstorm & Storm-1084 KQL hunting 🎉🎉🎉

KQL : lnkd.in/eW4qvTng

Wrote an out of the box query for tracking Mango Sandstorm & Storm-1084.
- externaldata()
- IoCs from MS blog

Mango Sandstorm & Storm-1084 KQL hunting 🎉🎉🎉 

KQL : lnkd.in/eW4qvTng

Wrote an out of the box query for tracking Mango Sandstorm & Storm-1084.
- externaldata()
- IoCs from MS blog
account_circle
Elli Shlomo (IR)(@ellishlomo) 's Twitter Profile Photo

Detect SQL Injection based on a payload list against Azure resources.

let SIPayload = (externaldata(payload:string)
[@'raw.githubusercontent.com/eshlomo1/Azure…'
]);
AppServiceHTTPLogs
| where TimeGenerated >= ago(10d)
| where Referer contains 'domain.com' and CsUriQuery has_any…

Detect SQL Injection based on a payload list against Azure resources.

let SIPayload = (externaldata(payload:string)
[@'raw.githubusercontent.com/eshlomo1/Azure…' 
]);
AppServiceHTTPLogs
| where TimeGenerated >= ago(10d)
| where Referer contains 'domain.com' and CsUriQuery has_any…
account_circle
Kijo Ninja(@kj_ninja25) 's Twitter Profile Photo

KQL externaldata() with IoCs Threat Hunting 🎉🎉🎉
Leverage KQL externaldata for hunting suspicious activities with IoCs !!

GitHub : lnkd.in/evTqZCdn

KQL externaldata() with IoCs Threat Hunting 🎉🎉🎉 
Leverage KQL externaldata for hunting suspicious activities with IoCs !!

GitHub : lnkd.in/evTqZCdn

#KQL #SQL #Defender #MDTI #OSINT #ThreatHunting #MicrosoftSecurity #XDR #EPP #EDR
account_circle
YourDataConnect, LLC(@YourDataConnec1) 's Twitter Profile Photo

Companies need to demonstrate the ROI of their data assets. The YDC platform helps companies quantify the financial benefits of data using internal and external data sources
yourdataconnect.com/product/
valuation value

Companies need to demonstrate the ROI of their data assets. The YDC platform helps companies quantify the financial benefits of data using internal and external data sources
yourdataconnect.com/product/
#data #analytics #datavaluation #datavalue #ROI #internaldata #externaldata
account_circle
Akshay Dixit(@kustonaut) 's Twitter Profile Photo

Azure Data Explorer: operator
Day186

Query data from external storage services like Azure Blob Storage or Azure Data Lake Storage
learn.microsoft.com/en-us/azure/da…

Kijo Ninja uses the same to hunt suspicious activities-github.com/LearningKijo/K…

@AzDataExplorer: #Externaldata operator
#365daysofADX Day186

Query data from external storage services like Azure Blob Storage or Azure Data Lake Storage
learn.microsoft.com/en-us/azure/da…

@kj_ninja25 uses the same to hunt suspicious activities-github.com/LearningKijo/K…

#ADX #kusto #KQLDB
account_circle
Grant Thornton Bharat(@GrantThorntonIN) 's Twitter Profile Photo

The effective utilisation of remains imperative for creating robust, adaptive, and successful business strategies. See how incorporating external data can help enhance the adaptability for organisational excellence: brnw.ch/21wJ35r

Advisory

The effective utilisation of #externaldata remains imperative for creating robust, adaptive, and successful business strategies. See how incorporating external data can help enhance the adaptability for organisational excellence: brnw.ch/21wJ35r

#Data #DataAdvisory #dGTL
account_circle
Explorium(@Explorium_ai) 's Twitter Profile Photo

Heading to the Gartner Data and Analytics Summit in London? Meet us to learn why external data is crucial for data-driven insights in business today.
Schedule a meeting here hubs.li/Q01QDd7m0

Heading to the Gartner Data and Analytics Summit in London? Meet us to learn why external data is crucial for data-driven insights in business today. 
Schedule a meeting here hubs.li/Q01QDd7m0

#GartnerDA #externaldata #dataanalytics #businessinsights
account_circle
Robotic Marketer(@Roboticmarketer) 's Twitter Profile Photo

Internal data provides exclusivity, but external sources unlock unlimited potential.

Today, brands that harness the power of gain a competitive edge, understanding their customers' needs better than ever before.

More: ow.ly/GlW150N38P2

Internal data provides exclusivity, but external sources unlock unlimited potential. 

Today, brands that harness the power of #externaldata gain a competitive edge, understanding their customers' needs better than ever before.

More: ow.ly/GlW150N38P2

#AI #roboticmarketer
account_circle
Techopedia(@techopedia) 's Twitter Profile Photo

When a smart contract requires external data, it will send a request to the oracle by using a communication protocol like HTTPS.
Learn more: mtr.cool/vsehixuwrh

When a smart contract requires external data, it will send a request to the oracle by using a communication protocol like HTTPS.
Learn more: mtr.cool/vsehixuwrh

#BlockchainOracle #SmartContractDataAccess #ThirdPartyService #MiddlewareLayer #ExternalData
account_circle
Matt Zorich(@reprise_99) 's Twitter Profile Photo

lolbas network usage, from Nathan McNulty

DeviceNetworkEvents
| where RemoteIPType == 'Public'
| where InitiatingProcessVersionInfoOriginalFileName in ((externaldata ( Name:string ) ['lolbas-project.github.io/api/lolbas.csv'] with (format=csv, ignoreFirstRecord=true) | distinct Name ))

account_circle
Matt Zorich(@reprise_99) 's Twitter Profile Photo

CISA CVE info

externaldata(cveID: string, vendorProject: string, product: string, vulnerabilityName: string, dateAdded: datetime, shortDescription: string, requiredAction: string, dueDate: datetime, knownRansomwareCampaignUse:string,notes:string)
[h@'cisa.gov/sites/default/…

account_circle